/PLAYBOOK · 2026-08-07

HTTPS Certificate Automation in Practice: Certbot Configuration and Auto-Renewal

Issue free Lets Encrypt certificates with Certbot, auto-configure Nginx HTTPS, and schedule auto-renewal for a zero-touch certificate lifecycle. Includes verification commands and common error handling.

HTTPS certificate automation is baseline ops for a live site. This article uses Certbot to issue free Lets Encrypt certificates, auto-configure Nginx, and schedule auto-renewal so HTTPS certificate management is fully automated. No more site security alerts from expired certificates.

Use cases

Enable HTTPS with free certificates to cut cost
Centralize certificates on multi-domain, multi-site servers
Auto-renew before expiry so nothing is missed
After moving to HTTPS, unify HSTS and HTTP redirect config

Prerequisites

Linux server (this tutorial uses Ubuntu 22.04 + Nginx)
Domain already resolves to the server IP, and port 80 is reachable from the public internet (required for issuance validation)
Nginx installed and the site configured
root or sudo

How it works

Certbot is the ACME client recommended by Lets Encrypt. ACME flow: client requests a certificate from the CA → CA verifies domain control (HTTP-01 places a temporary challenge file in the web root, or DNS-01 adds a TXT record) → on success the certificate is issued → Certbot installs it on the web server and configures a renewal timer. Lets Encrypt certificates last 90 days, so auto-renewal is the critical HTTPS ops step.

Steps

1. Install Certbot and the Nginx plugin

`# Update package sources and install
sudo apt update
sudo apt install -y certbot python3-certbot-nginx

# Verify installation
certbot --version`

The `python3-certbot-nginx` plugin lets Certbot edit Nginx config and load the certificate automatically, skipping manual edits.

2. Issue the certificate and auto-configure Nginx

`# Issue certificate (auto-edit Nginx config, enable HTTPS and HTTP redirect)
sudo certbot --nginx -d helixcyber.ai -d example.com`

Interactive prompts: accept the subscriber agreement (A), share email (optional), and whether to redirect HTTP to HTTPS (choose 2, recommended). On success Certbot issues the certificate, installs it on Nginx, opens 443 in the site config, and sets 80→443 redirect.

After issuance, inspect certificate info:

`# List certificates and expiry dates
sudo certbot certificates`

3. Dry-run renewal

`# Simulate renewal (no actual changes, test only)
sudo certbot renew --dry-run`

Output containing `Congratulations, all simulated renewals succeeded` means the renewal path works. Certbot install creates a `systemd timer` (checks twice daily). Actual renewal only runs within 30 days of expiry.

4. Verify the auto-renewal timer

`# Check systemd timer status
sudo systemctl status certbot.timer

# Check timer schedule
sudo systemctl list-timers | grep certbot

# Check renewal logs
sudo journalctl -u certbot.service --since today`

If the server has no systemd (e.g. CentOS 6), Certbot uses `/etc/cron.d/certbot`. Check with `crontab -l`.

5. Add HSTS to harden HTTPS

After issuance, append the HSTS header in the Nginx 443 server block so browsers use HTTPS only:

`server {
    listen 443 ssl;
    server_name helixcyber.ai;

    ssl_certificate     /etc/letsencrypt/live/helixcyber.ai/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/helixcyber.ai/privkey.pem;

    # Append HSTS response header
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

    # Enable TLS 1.2/1.3
    ssl_protocols TLSv1.2 TLSv1.3;
}`

Reload Nginx after the change: `sudo nginx -t && sudo systemctl reload nginx`.

Verify

Check HTTPS from three angles:

Browser: open `https://helixcyber.ai`. Lock icon in the address bar, no certificate warning
Certificate validity: `sudo certbot certificates` shows valid status and correct expiry (issue date +90 days)
Online: SSL Labs (ssllabs.com/ssltest). Grade A or better means the config is correct

FAQ

FAQ 1: Issuance fails with Invalid response from http:///.well-known/acme-challenge/?

The CA cannot fetch the HTTP challenge file. Check in order: DNS is live (`dig <domain>` or `nslookup`); port 80 is open and not redirected (forced HTTPS blocks validation—disable it temporarily); Nginx site root (`root` directive) matches the real path, and Certbot can write.

FAQ 2: Certificate expired and did not auto-renew?

Run `sudo certbot renew --dry-run` first to isolate the issue. Common causes: timer not running (check with `systemctl status certbot.timer`); port 80 blocked by firewall during renewal validation; DNS changed so validation failed. Then run `sudo certbot renew` by hand and confirm the systemd timer is `active (running)`. You can also set email alerts (renewal logs go to `/var/log/letsencrypt`) to track results.

Summary

Certbot plus Lets Encrypt automates HTTPS certificate issue, install, and renew end to end. 90-day certificates stay valid under the systemd timer with no manual work. Add HSTS and TLS 1.2/1.3 and the site meets the current HTTPS baseline. Put `certbot renew --dry-run` on the monthly checklist so the renewal path stays healthy.