Install Certbot

# Remove any apt-installed certbot first
sudo apt remove certbot

# Install
sudo apt update
sudo apt install software-properties-common
sudo add-apt-repository ppa:certbot/certbot
sudo apt install certbot -y

# Verify
certbot --version

Manual DNS Validation

For a one-time certificate or when you don’t have API access, use manual DNS validation:

sudo certbot certonly 
    --manual 
    --preferred-challenges dns 
    -d example.com 
    -d '*.example.com'

Enter your email address, accept the Terms of Service. Certbot will display a TEXT record to add:

Saving debug log to /var/log/letsencrypt/letsencrypt.log
Enter email address or hit Enter to skip.
 (Enter 'c' to cancel): email@example.com

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Please read the Terms of Service at:
https://letsencrypt.org/documents/LE-SA-v1.6-August-18-2025.pdf
You must agree in order to register with the ACME server. Do you agree?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: y

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Would you be willing, once your first certificate is successfully issued, to
share your email address with the Electronic Frontier Foundation, a founding
partner of the Let's Encrypt project and the non-profit organization that
develops Certbot? We'd like to send you email about our work encrypting the web,
EFF news, campaigns, and ways to support digital freedom.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: y
Account registered.
Requesting a certificate for example.com and *.example.com

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Please deploy a DNS TXT record under the name:

_acme-challenge.example.com.

with the following value:

i7v03U3AqROIrvN...

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Press Enter to Continue

Verify your TXT record is ready, then press Enter to continue.

# Verify TXT record is visible
dig +short TXT _acme-challenge.example.com
nslookup -type=TXT _acme-challenge.example.com 8.8.8.8

Automated DNS Validation with DNS Plugins

Certbot has official plugins for major DNS providers. These plugins use provider APIs to add and remove TXT records automatically, enabling fully automated renewal.

Cloudflare

Create Cloudflare API Token

Go to ‘My Profile’ page and click on ‘API Tokens’.

Click Create Token and click Use template to the right of ‘Edit zone DNS’

Set Permissions to Zone > DNS > edit and Add: Zone > Zone > Read

Set Zone Resources to Include > Specific zone > select your domain(s) for this API Token.

Set Client IP Address Filtering, if feasible, to lock down the IP address and only allow our server to make changes.

Click Continue to summary > Create Token

Install Cloudflare plugin and configure Let’s Encrypt

# Install the Cloudflare plugin
sudo apt install python3-certbot-dns-cloudflare

# Create a credential file
sudo mkdir -p /etc/letsencrypt/
sudo nano /etc/letsencrypt/cloudflare.ini
dns_cloudflare_api_token = your-api-token-here

# Lock the file
sudo chmod 600 /etc/letsencrypt/cloudflare.ini

# Issue the certificate
sudo certbot certonly \
    --dns-cloudflare \
    --dns-cloudflare-credentials /etc/letsencrypt/cloudflare.ini \
    --email admin@example.com --agree-tos \
    --no-eff-email \
    -d example.com \
    -d '*.example.com'
 
# Some DNS providers are slow to propagate. Certbot's DNS plugins default to waiting 10 seconds before checking. Add this for slow providers:
--dns-cloudflare-propagation-seconds 30

Certificate Locations

After successful issuance, certificates are in /etc/letsencrypt/live/example.com/

privkey.pem: Private key – keep permissions strict (mode 600)
fullchain.pem: Use this for most web servers (certificate + intermediate chain)
cert.pem: Certificate only (rarely used directly)

Setting Up Automatic Renewal

Certbot installs a systemd timer for automatic renewal

# Check timer status
sudo systemctl status snap.certbot.renew.timer
# Or for apt-installed certbot:
sudo systemctl status certbot.timer

# Test renewal dry run
sudo certbot renew --dry-run

Generate .pfx from Let’s Encrypt ssl

openssl pkcs12 -export \
  -out certificate.pfx \
  -inkey privkey.pem \
  -in fullchain.pem

Configuring Nginx to Use the Certificate

Configure Nginx to Use the Certificate

server {
    listen 443 ssl;
    server_name example.com *.example.com;

    # Certificate files
    ssl_certificate     /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

    # Recommended SSL settings
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers off;
    ssl_session_timeout 1d;
    ssl_session_cache shared:SSL:10m;
    ssl_stapling on;
    ssl_stapling_verify on;

    location / {
        # Your application config
    }
}

sudo nginx -t
sudo systemctl reload nginx

How to Setup Let’s Encrypt with DNS-01 Validation on Ubuntu