Security / HTTPS guide
Use Let's Encrypt and Certbot to enable HTTPS on an Ubuntu server running Nginx. These commands are examples for a self-managed VPS; adapt them to your OS, firewall and web server.
Prerequisites: SSH/sudo access, a domain you control, an accessible public IP, and working inbound ports 80 and 443.
Create an A record for your domain pointing at the public IPv4 address of the server. Add an AAAA record only if IPv6 is configured and working. DNS changes may need time to propagate.
dig +short A example.com
dig +short AAAA example.comOn a supported Ubuntu release, install Nginx and configure a server block with your real domain. Confirm that port 80 serves the expected site before requesting a certificate.
sudo apt update
sudo apt install nginx
sudo nginx -t
sudo systemctl reload nginxLet's Encrypt HTTP-01 validation normally requires inbound TCP port 80. Permit both 80 and 443 in your host firewall and any provider firewall. Verify SSH access before changing firewall rules.
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw statusInstall Certbot with the Nginx integration using a currently supported method for your OS. Replace example.com with a domain you control. Certbot may update the Nginx HTTPS configuration.
sudo apt install certbot python3-certbot-nginx
sudo certbot --nginx -d example.com -d www.example.comCheck the certificate details and confirm that an automated renewal job exists. The dry run simulates certificate renewal, rather than issuing a new production certificate.
sudo certbot certificates
sudo certbot renew --dry-run
curl -I https://example.comCheck that the domain resolves to this server, public HTTP port 80 is reachable, your reverse proxy serves the requested hostname, and no conflicting AAAA record sends traffic elsewhere. If you are using Cloudflare, distinguish edge TLS from the certificate installed on your origin.