Back to: Technology Guides

How to install an SSL Certificate with certbot on Ubuntu and Apache

To install an SSL certificate with certbot on Ubuntu and Apache, install certbot as a snap, then run sudo certbot --apache. Certbot gets a free certificate from Let’s Encrypt, adds it to your Apache virtual host, redirects HTTP to HTTPS and schedules automatic renewal. On a server whose DNS already points to it, the whole job takes six short steps.

The commands below follow certbot’s official instructions for Apache on Linux (snap), as of November 2026. They apply to the current Ubuntu LTS releases, Ubuntu 26.04 LTS and 24.04 LTS. We use example.ca and www.example.ca as the domains; swap in your own.

What you need before you install certbot

You need an Ubuntu server running Apache, a domain whose DNS points to that server, and ports 80 and 443 open. Check each one first, because most certbot failures come from one of them.

  • A supported Ubuntu release. Ubuntu 26.04 LTS (April 2026) and 24.04 LTS are the current long-term releases; 22.04 LTS leaves standard support in 2027. See Ubuntu’s release cycle.

  • Apache 2.4 serving the site on port 80, with a <VirtualHost *:80> block whose ServerName is example.ca and whose ServerAlias is www.example.ca. If the site has no virtual host yet, follow our guide to setting up an Apache virtual host for a domain or subdomain.

  • DNS records (an A record, plus AAAA if the server has IPv6) for both example.ca and www.example.ca, pointing to the server’s public IP address.

  • Port 80 open. Let’s Encrypt checks domain control over HTTP, and its HTTP-01 challenge only works on port 80. Port 443 must be open for HTTPS visitors.

  • A user with sudo rights on the server.

Before we run certbot on a server at msmtech, we confirm DNS with dig +short example.ca and dig +short www.example.ca. Both must print the server’s IP address. If one still shows an old host, wait for DNS to update before you continue.

If you use Ubuntu’s UFW firewall, allow web traffic with the profile Apache installs:

sudo ufw allow 'Apache Full'

Step 1: Check that snapd is installed

Certbot is distributed as a snap, so the server needs snapd. Ubuntu Server ships with snapd, so this is usually a quick check:

snap version

If the command isn’t found, install snapd from Ubuntu’s repositories, as described in Snapcraft’s snapd installation guide:

sudo apt update sudo apt install snapd

Step 2: Remove any older certbot package

Remove certbot if it was installed earlier with apt, so the snap is the only certbot on the server. Certbot’s instructions ask for this step:

sudo apt remove certbot

If apt reports that certbot isn’t installed, move on.

Step 3: Install certbot with snap

Install certbot with classic confinement, then link the command so it runs from anywhere:

sudo snap install --classic certbot sudo ln -s /snap/bin/certbot /usr/local/bin/certbot

Older guides, including the first version of this one, linked to /usr/bin/certbot. Certbot’s current instructions use /usr/local/bin/certbot. If ln says the file exists, the link is already in place.

Step 4: Run certbot --apache to get and install the certificate

Run certbot with the Apache plugin. It requests the certificate, proves you control the domains and edits your Apache configuration for you:

sudo certbot --apache

To skip the domain menu, name the domains on the command line instead:

sudo certbot --apache -d example.ca -d www.example.ca

The first run asks a few questions:

  1. An email address for your Let’s Encrypt account. Let’s Encrypt stopped sending expiry reminder emails on 4 June 2025, so don’t count on that address to warn you about a failed renewal.

  2. The Let’s Encrypt terms of service. You must agree to continue.

  3. Whether to share your email with the EFF, the non-profit that develops certbot. This one is optional.

  4. Which names to secure. Certbot lists the ServerName and ServerAlias values it found. Leave the input blank to select all of them, which is what you want for example.ca and www.example.ca.

When the challenge succeeds, certbot prints something like this (output shortened):

Successfully received certificate. Certificate is saved at: /etc/letsencrypt/live/example.ca/fullchain.pem Key is saved at: /etc/letsencrypt/live/example.ca/privkey.pem Certbot has set up a scheduled task to automatically renew this certificate in the background. Deploying certificate Successfully deployed certificate for example.ca to /etc/apache2/sites-available/000-default-le-ssl.conf Successfully deployed certificate for www.example.ca to /etc/apache2/sites-available/000-default-le-ssl.conf Congratulations! You have successfully enabled HTTPS on https://example.ca and https://www.example.ca

Certbot writes a new port 443 virtual host, the file ending in -le-ssl.conf, next to your original one. With --apache, certbot also redirects all HTTP traffic to HTTPS by default; add --no-redirect if you need to keep plain HTTP working. Both behaviours are listed in certbot’s user guide.

Step 5: Test automatic renewal with certbot renew --dry-run

Renewal is automatic: the certbot snap installs a systemd timer that runs certbot renew for you. Test it once, so you know a real renewal will work:

sudo certbot renew --dry-run

A dry run talks to Let’s Encrypt’s staging service and changes nothing on your server. To see the timer itself, run:

systemctl list-timers | grep certbot

On a snap install, the timer is named snap.certbot.renew.timer. Certbot renews a certificate once less than a third of its lifetime remains, according to certbot’s renewal documentation.

That rule matters because lifetimes are getting shorter. Let’s Encrypt certificates last 90 days today. According to Let’s Encrypt’s upcoming changes, new certificates will last 64 days from 10 February 2027 and 45 days from 16 February 2028. If the dry run passes, you don’t need to change anything for either date.

Step 6: Check HTTPS in a browser

Open https://example.ca and https://www.example.ca. Both should load with the padlock and no warning. Then check the redirect from the server:

curl -I http://example.ca

The response should be a 301 Moved Permanently with a Location: https://example.ca/ header. If your site runs WordPress, also change the WordPress Address and Site Address to https:// under Settings, then General, as described in our guide to installing WordPress on an Ubuntu VPS.

Frequently asked questions

Is a certbot SSL certificate free?

Yes. Certbot is free software from the EFF, and Let’s Encrypt doesn’t charge for its certificates. The only cost is the server you install it on.

Why does certbot fail the challenge?

The usual causes are a DNS record that still points to another server, port 80 blocked by a firewall or cloud security group, or an Apache virtual host without a matching ServerName. Fix the one that applies, then run sudo certbot --apache again.

Can certbot --apache issue a wildcard certificate?

No. A wildcard such as *.example.ca needs the DNS-01 challenge, and the Apache plugin uses HTTP-01. To cover one or two extra subdomains, add them to your existing certificate with certbot instead.

Do these steps work on Debian?

Yes. Certbot’s snap instructions are the same on any Linux distribution with snapd, and Debian’s Apache uses the same sites-available layout as Ubuntu. Debian doesn’t install snapd by default, so do step 1 there.

Do I need a VPS to use certbot?

You need root or sudo access to the server, which shared hosting rarely gives you. That access is one of the reasons to move a business site to a VPS.

Need help with SSL on your server? Talk to msmtech.

No off-the-shelf solution? We'll build it.