Let's Encrypt with Apache
This guide explains how to install a free Let's Encrypt SSL certificate with Certbot on a Linux server running Apache (Debian, Ubuntu, AlmaLinux or Rocky Linux) and how to check the automatic renewal.
Prerequisites: Apache must be installed and running. The A record of your domain must point to your server's IP. Ports 80 and 443 must be open in the firewall.
Step 1: Install Certbot
Debian / Ubuntu
AlmaLinux / Rocky Linux
Step 2: Enable the SSL module in Apache
Step 3: Issue the certificate
Replace your-domain.com with your actual domain name. Add further -d parameters for multiple domains:
On the first run, Certbot asks for an email address and for your agreement to the terms of service. It then sets up the redirect from HTTP to HTTPS automatically. If you do not want a redirect, add --no-redirect.
Step 4: Verify the installation
Open your domain in a browser — you should see https:// and the padlock icon. For a detailed check you can use SSL Labs.
Step 5: Verify automatic renewal
Test automatic renewal with a dry run:
If --dry-run succeeds, automatic renewal is working correctly.
Manually renew the certificate
Common error messages
| Error | Cause & fix |
|---|---|
| Connection refused on port 80 | Port 80 is blocked by the firewall. Open it in iptables or nftables. |
| Could not reliably determine the server's fully qualified domain name | Add ServerName your-domain.com to the Apache configuration and restart Apache. |
| DNS problem: NXDOMAIN | The domain's A record does not point to this server. Check DNS and wait for propagation. |
| AH00526: Syntax error | Certbot modified the Apache config incorrectly. Check with apachectl configtest and fix manually. |