Stop Paying for SSL Certificates — Free HTTPS using Let's Encrypt and Certbot

If you're deploying a website or API, securing it with HTTPS is non-negotiable. But SSL/TLS certificates used to be expensive. Enter Let's Encrypt and Certbot — two tools that democratized secure web traffic.

What is Let's Encrypt?

Let's Encrypt is a free, automated certificate authority (CA) launched in 2015 by the Internet Security Research Group (ISRG). It issues SSL/TLS certificates that enable HTTPS encryption for your website.

Key features:

• Free — no cost, no hidden fees
• Automated — certificates can be issued and renewed programmatically
• Fast — certificates are issued in seconds
• Short-lived — certificates expire after 90 days, encouraging automation
• Open — the entire process is transparent and open-source

The 90-day expiration might seem inconvenient, but it's actually a security feature. Short-lived certificates reduce the impact of key compromise and encourage automated renewal workflows.

What is Certbot?

Certbot is a free, open-source tool developed by the Electronic Frontier Foundation (EFF) that automates the process of obtaining and renewing Let's Encrypt certificates.

Why you need it:

Certbot handles the entire certificate lifecycle:

• Proves domain ownership via HTTP or DNS challenges
• Obtains certificates from Let's Encrypt
• Installs certificates on your server
• Automatically renews certificates before expiration
• Works with major web servers (Nginx, Apache, etc.)

How They Work Together

Here's the typical flow:

┌─────────────┐
│   Certbot   │ (Your computer or server)
└─────────────┘
      │
      │ Uses ACME protocol
      ▼
┌─────────────────────┐
│  Let's Encrypt      │ Issues certificate
│  (Certificate Auth) │
└─────────────────────┘
      │
      ▼
┌─────────────┐
│ Your Server │ (HTTPS enabled)
└─────────────┘

Getting Started: A Quick Example

Installing Certbot

# Ubuntu/Debian
sudo apt-get install certbot python3-certbot-nginx

# macOS
brew install certbot

# Or use pip
pip install certbot

Obtaining a Certificate

For Nginx:

sudo certbot --nginx -d yourdomain.com -d www.yourdomain.com

For Apache:

sudo certbot --apache -d yourdomain.com -d www.yourdomain.com

Standalone (if you don't have a web server yet):

sudo certbot certonly --standalone -d yourdomain.com

Automatic Renewal

Certbot sets up a cron job or systemd timer automatically:

# Verify renewal works
sudo certbot renew --dry-run

Certificates are renewed 30 days before expiration, so you never have to think about it.

Real-World Benefits

Before Let's Encrypt/Certbot:

• SSL certificates cost $50-200+ per year
• Manual renewal process
• Discouraged small projects from using HTTPS

After Let's Encrypt/Certbot:

• Free, automated HTTPS for everyone
• Security is no longer a luxury feature
• Millions of websites are now encrypted
• Perfect for side projects, portfolios, and staging servers

Common Use Cases

1. Single Domain

certbot certonly -d example.com

2. Multiple Domains

certbot certonly -d example.com -d www.example.com -d api.example.com

3. Wildcard Certificate (covers all subdomains)

certbot certonly --manual --preferred-challenges=dns -d '*.example.com' -d example.com

4. Docker Deployment

FROM nginx:latest
RUN apt-get update && apt-get install -y certbot python3-certbot-nginx
COPY entrypoint.sh /entrypoint.sh
CMD ["/entrypoint.sh"]

Challenges You Might Face

DNS Challenge Failed: Make sure your DNS records are updated before validation completes.

Port 80 Not Available: Use DNS validation instead of HTTP validation with --preferred-challenges=dns.

Certificate Not Renewing: Check that your renewal cron job is running or set up a systemd timer.

Multiple Certificates: Certbot can manage multiple certificates. Keep them organized and renewed separately if needed.

Best Practices

✅ Do:

• Set up automatic renewal and monitor it
• Keep Certbot updated
• Use DNS validation for wildcard certificates
• Test renewal with --dry-run first
• Store your certificates securely

❌ Don't:

• Manually manage certificate renewal
• Share your private keys
• Use the same certificate across different domains (unless it's a wildcard)
• Ignore renewal failures

Alternatives

While Certbot is the most popular, alternatives for Certbot:

• Certify the Web — Windows GUI
• acme.sh — Lightweight shell script
• Lego — Go-based ACME client
• Caddy — Web server with built-in auto HTTPS
• Traefik — Reverse proxy with automatic ACME management
• ZeroSSL — Free alternative CA with a limited number of free certificates (check their current terms, as limits change)
• Buypass Go SSL — Free CA with wildcard support and 180-day validity

But Certbot remains the gold standard for Linux/Unix systems.

Conclusion

Let's Encrypt and Certbot have made HTTPS the default, not a premium feature. Whether you're running an enterprise application, a side project, or a personal blog, there's no reason not to use them. Setup takes minutes, renewal is automatic, and you get encryption for free.

Start securing your domain today! 🔒