Free SSL certificates with Let's Encrypt

Overview

Let's Encrypt is a free certificate authority, and its certificates are short-lived: they expire after 90 days by design. That short life is not a flaw. The authority wants you to run an automated client (ACME) that renews long before expiry, so your certificate is never a forgotten manual chore. "Install Let's Encrypt" really means "install certbot, validate the domain, and set up the cron that renews it for the rest of the site's life."

Why 90 days and not a year

Short certificates limit the damage when a private key leaks, because the certificate is only useful while it is un-expired. They also force automation on the practical side, since a human-scale manual renewal of a 90 day cycle creates "certificate expired" incidents. The same automation that issues the first certificate renews it automatically, and that produces none of the cost, so the owner rarely thinks about it again.

How the validation works

Before a certificate is issued, ACME proves you control the domain. Two common methods:

• HTTP-01: the ACME client places a challenge file on the web server path /.well-known/acme-challenge/, and the CA fetches http://<domain>/.well-known/acme-challenge/<token>. Good for Live web servers with port 80 reachable.
• DNS-01: you add a temporary TXT record with the challenge value, and the CA reads it over DNS. Good for wildcard certificates and for a server that is not yet live.

The CA only issues a certificate for the name you demonstrated; a wildcard therefore requires the DNS method, because HTTP challenges are per-hostname.

Install with certbot in ordered steps

Working examples for a typical web server (Apache on Linux; the Nginx version uses --nginx):

1. Install certbot and the plugin for your web server, for example on Debian/Ubuntu sudo apt install certbot python3-certbot-apache.
2. Confirm HTTP reachability on port 80, because the http-01 challenge needs it.
3. Run a single issuance, for example sudo certbot --apache -d example.com -d www.example.com. Certbot creates the domain config, obtains the certificate, and wires the https vhost.
4. Check the result: curl -vI https://example.com uses the new certificate. Test the www host as well.

Make renewal automatic

1. Certbot installs a renewal timer or cron when installed through the package, so check whether one exists: systemctl list-timers | grep certbot on systemd or crontab -l | grep certbot elsewhere.
2. Run a dry run now: sudo certbot renew --dry-run executes the full renewal path against the staging server without changing live certificates. Fix any errors before expiry month.
3. Make sure the ACME-verify path and nameservers are in place, and the email account connected to the CA account is monitored, so expiration warnings and DNS challenges land somewhere you actually see.
4. Keep a reminder anyway: poll status of a cobweb check such as openssl s_client in a scheduled monitor, so a renewal that stopped because the host moved or the firewall changed surfaces within days rather than at an owner panic.

Troubleshooting

| Symptom | Likely cause | Fix |

| Renewal failed, cert expired | The cron or timer stopped on the new host | Reinstall or re-enable the timer, then certbot renew --dry-run |

| http-01 validation fails | Port 80 blocked or redirect loop on the challenge path | Serve /.well-known/acme-challenge/ on http and allow port 80 |

| Too many requests from the CA | Repeated failures against the live endpoint | Work on the staging endpoint during testing |

| Wildcard validation fails | No challenge TXT record visible | Confirm the TXT record at a resolver and re-run within its TTL |

Prevention

• Never rely on a manual "renew by hand every 90 days" habit. Certificates expire, automation is the fix.
• If a certificate originally issued on a previous host, DNS has moved to the new one, re-run the same orders where the commands work.
• Keep the mail address on the CA account current and re-issue, never into the maintenance mode, after a host or domain changes.

The related renewal article walks a full renewal drill, and the handshake article explains what the browser demands the server prove.