Install SSL Certificates on Ubuntu

By Khimananda Oli | Last reviewed: August 2026

You need to install SSL certificates on Ubuntu to encrypt traffic, satisfy browser security requirements, and meet compliance standards like SOC 2 or ISO 27001. On Ubuntu 24.04 LTS, the standard production path is Certbot with the Nginx plugin, which handles issuance, installation, and automated renewal without downtime. This guide walks you through the exact commands, secure configuration, and verification steps I use in client environments ranging from Kathmandu-based startups to global SaaS platforms.

How Do You Install SSL Certificates on Ubuntu Using Certbot?

The most reliable way to install SSL certificates on Ubuntu in 2026 is via Certbot with the official Nginx plugin. This method avoids manual file placement errors and integrates directly with your web server configuration. Before starting, ensure your domain resolves to this server’s public IP and that ports 80 and 443 are open in UFW. If you’re setting up a fresh VPS, follow the initial Ubuntu server setup guide first to harden SSH and configure the firewall correctly.

Prerequisites and Installation

1. Update package indexes and install Certbot with the Nginx plugin:

   sudo apt update && sudo apt upgrade -y
   sudo apt install certbot python3-certbot-nginx -y

2. Verify Nginx is running and has a valid server block for your domain:

   sudo systemctl status nginx
   sudo nginx -t

3. Ensure DNS A/AAAA records point to this server. Propagation delays will cause validation failures.

Certificate Issuance and Automatic Configuration

Run Certbot in interactive mode to obtain and install the certificate in one step:

sudo certbot --nginx -d example.com -d www.example.com

Certbot will prompt for an email (used for expiry warnings), agree to terms, and optionally redirect HTTP to HTTPS. Choose redirect unless you have a specific reason not to. The tool edits your Nginx server block in place, adding ssl_certificate, ssl_certificate_key, and modern TLS parameters. It also creates a renewal hook that reloads Nginx only when a new certificate is successfully deployed.

How Do You Configure Nginx for Secure SSL After Installation?

Certbot applies sensible defaults, but production environments require additional hardening. Edit your server block at /etc/nginx/sites-available/example.com to enforce modern TLS and security headers. These settings align with Mozilla’s Intermediate compatibility profile and satisfy PCI-DSS and SOC 2 technical controls.

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name example.com www.example.com;

    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
    ssl_trusted_certificate /etc/letsencrypt/live/example.com/chain.pem;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
    ssl_prefer_server_ciphers off;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 1d;
    ssl_stapling on;
    ssl_stapling_verify on;

    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
    add_header X-Content-Type-Options nosniff;
    add_header X-Frame-Options DENY;

    root /var/www/example.com/html;
    index index.html;
}

Key improvements over default Certbot output:

• OCSP Stapling: Reduces latency and improves privacy by having Nginx fetch and cache OCSP responses.
• HSTS with preload: Prevents downgrade attacks. Only enable after confirming HTTPS works flawlessly; submission to hstspreload.org is irreversible for the domain.
• TLS 1.3 priority: Modern ciphers only; disables legacy CBC modes vulnerable to padding oracle attacks.
• Session caching: Avoids repeated handshakes for returning visitors, improving Core Web Vitals.

After editing, test and reload:

sudo nginx -t && sudo systemctl reload nginx

For deeper Nginx tuning, especially if hosting Laravel or PHP applications, refer to the Laravel deployment guide with Nginx which covers PHP-FPM integration alongside SSL.

How Does Automated SSL Renewal Work on Ubuntu?

Let’s Encrypt certificates expire every 90 days. Manual renewal is unsustainable and error-prone. Certbot installs a systemd timer (certbot.timer) that runs twice daily and renews certificates within 30 days of expiry. This automation is critical for maintaining uptime and compliance evidence.

Verify and Test Renewal

Always confirm the timer is active and functional:

sudo systemctl list-timers | grep certbot
sudo certbot renew --dry-run

The dry-run simulates renewal without hitting rate limits. Successful output shows “Congratulations, all simulated renewals succeeded.” If it fails, check logs at /var/log/letsencrypt/letsencrypt.log and verify DNS/firewall haven’t changed.

Custom Post-Renewal Actions

If your application requires more than an Nginx reload (e.g., restarting a Node.js app that caches certs), create a deploy hook:

sudo nano /etc/letsencrypt/renewal-hooks/deploy/restart-app.sh

#!/bin/bash
# Only run for specific domains
if [[ "$RENEWED_DOMAINS" == *"example.com"* ]]; then
    systemctl restart myapp.service
    logger "SSL renewed for example.com; myapp restarted"
fi

sudo chmod +x /etc/letsencrypt/renewal-hooks/deploy/restart-app.sh

This hook executes only after successful renewal, preventing unnecessary restarts during dry-runs or failed attempts. For teams managing multiple services, consider integrating renewal events into your observability stack as described in the Prometheus and Grafana monitoring guide.

Certbot vs Manual SSL: Which Method Should You Use on Ubuntu?

While Certbot dominates, understanding alternatives prevents lock-in and informs architectural decisions. Here’s a practical comparison based on real-world trade-offs:

In practice, Certbot is the right choice for 95% of Ubuntu deployments. Switch to acme.sh only if Python is prohibited (e.g., hardened container images) or you need DNS-01 with a provider Certbot doesn’t support. Commercial certificates rarely offer technical advantages today; their value lies in warranty and EV indicators, which browsers no longer emphasize.

How Do You Troubleshoot Common SSL Issues on Ubuntu?

Even with automation, issues arise. Here are the most frequent problems and fixes from production incidents:

• Mixed Content Warnings: Your site loads over HTTPS but references HTTP assets. Fix by updating asset URLs to protocol-relative (//cdn.example.com) or absolute HTTPS. Use browser devtools Network tab to identify offenders.
• Certificate Not Trusted: Usually caused by missing intermediate chain. Certbot includes it by default, but manual installs often omit fullchain.pem. Always use fullchain.pem, not just cert.pem.
• Renewal Failures: Check /var/log/letsencrypt/letsencrypt.log. Common causes: blocked port 80, changed DNS, or moved webroot. Re-run certbot certificates to verify current state.
• OCSP Stapling Errors: Ensure ssl_trusted_certificate points to the chain file and that Nginx can reach ocsp.int-x3.letsencrypt.org. Test with openssl s_client -connect example.com:443 -status.
• HSTS Lockout: If HTTPS breaks after enabling HSTS, users can’t access your site until max-age expires. Always test thoroughly before adding preload. Keep a non-HSTS staging environment for recovery.

For comprehensive server diagnostics beyond SSL, the Linux server monitoring guide with Netdata provides real-time visibility into TLS handshake performance and certificate expiry alerts.

Secure and Maintain Your Ubuntu SSL Setup

To reliably install SSL certificates on Ubuntu and keep them secure, treat SSL as part of your infrastructure-as-code and compliance posture—not a one-time task. Automate issuance with Certbot, harden Nginx beyond defaults, validate renewal monthly, and integrate certificate metrics into your monitoring. Document your TLS configuration in your runbooks; auditors will ask for it. If you’re managing multiple servers or need help designing a compliant infrastructure pipeline, reach out for a consultation—I help teams build systems that pass audits and survive traffic spikes.