VPS guide

How to Install Nginx and a Free Let's Encrypt Certificate on Ubuntu

By Gander Web · Published 16 October 2026 · 3 min read

This guide uses Ubuntu 24.04; the steps are the same on Debian 12. Replace example.co.uk with your own domain throughout. You'll need a firewall that allows ports 80 and 443, and the domain's DNS pointing at the server before you request the certificate.

Point the domain at the server

At your DNS provider, create A records for example.co.uk and www pointing at your VPS's IP address. From your own computer, check they've updated:

nslookup example.co.uk
nslookup www.example.co.uk

Both should return your server's IP address. Let's Encrypt checks the domain over the internet, so the certificate request fails until DNS is right.

Install Nginx

sudo apt update
sudo apt install nginx
sudo ufw allow 'Nginx Full'

Visit http://your-vps-ip and you should see the Welcome to nginx page.

Create the site folder

sudo mkdir -p /var/www/example.co.uk/html
sudo chown -R $USER:$USER /var/www/example.co.uk/html
echo "<h1>It works</h1>" > /var/www/example.co.uk/html/index.html

Add a server block

sudo nano /etc/nginx/sites-available/example.co.uk

server {
    listen 80;
    listen [::]:80;
    server_name example.co.uk www.example.co.uk;

    root /var/www/example.co.uk/html;
    index index.html;

    location / {
        try_files $uri $uri/ =404;
    }
}

Turn the site on, test the configuration and reload Nginx:

sudo ln -s /etc/nginx/sites-available/example.co.uk /etc/nginx/sites-enabled/
sudo nginx -t
sudo systemctl reload nginx

nginx -t names the file and line of any mistake. Reload only after it reports that the test is successful. Visit http://example.co.uk and you should see "It works".

Get the certificate

Install Certbot with its Nginx plugin, then request one certificate covering both names:

sudo apt install certbot python3-certbot-nginx
sudo certbot --nginx -d example.co.uk -d www.example.co.uk

Certbot asks for an email address and for you to accept the terms. It then proves you control the domain, saves the certificate under /etc/letsencrypt/live/example.co.uk/, and adds the HTTPS settings to your server block, including a redirect from HTTP. If it asks whether to redirect, choose redirect. Certbot's own instructions install it with snap; the Ubuntu package above does the same job.

Check renewal

Let's Encrypt certificates currently last 90 days. The Certbot package adds a timer that renews them before they expire. Check the timer and run a test renewal:

systemctl list-timers | grep certbot
sudo certbot renew --dry-run

Running an app behind Nginx

For a Node.js, Python or Docker app listening on a local port, replace the location / block with a proxy, then test and reload Nginx as before:

location / {
    proxy_pass http://127.0.0.1:3000;
    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
}

Keep the app itself listening on 127.0.0.1 so the only way in is through Nginx and HTTPS.

Questions

Related guides

Sources

1. Certbot instructions (EFF)
2. Let's Encrypt documentation

Commands are for Ubuntu 24.04, Debian 12 and AlmaLinux 9, as of 16 October 2026. If something here no longer matches what you see, tell us and we'll update it.