Configure SSL on Apache Ubuntu with Let's Encrypt

Configuring an SSL certificate on Apache with Let's Encrypt on Ubuntu comes down to four commands — the Certbot client handles everything else. You can have HTTPS running with automatic renewal in under ten minutes.

This guide walks you through the complete process: prerequisites, installation, certificate issuance, and final verification — with exact commands you can copy and paste.

Prerequisites

Before running Certbot, make sure you have:

A server running Ubuntu 20.04, 22.04, or 24.04 with root or sudo access.
Apache 2.4+ installed and running.
A domain with its A record (or AAAA for IPv6) pointing to your server's IP address and DNS fully propagated — verify with dig +short yourdomain.com.
Ports 80 and 443 open in your firewall (UFW or your provider's security groups).

If you use UFW, open both ports with:

sudo ufw allow 'Apache Full'
sudo ufw reload

Step 1 — Install Certbot and the Apache Plugin

Certbot is the official Let's Encrypt client. The most up-to-date installation method on Ubuntu is via snap:

sudo snap install --classic certbot
sudo ln -s /snap/bin/certbot /usr/bin/certbot

The symlink makes certbot available globally across the system.

Step 2 — Obtain and Install the Certificate

Certbot can read your existing Apache configuration and update it automatically. Run:

sudo certbot --apache

The interactive wizard will ask for:

Your email address (for renewal notices).
Agreement to Let's Encrypt's Terms of Service.
Which domain(s) to secure — Certbot reads these from your existing Virtual Hosts.

To explicitly include both the root domain and www, use the -d flag:

sudo certbot --apache -d yourdomain.com -d www.yourdomain.com

When finished, Certbot writes a new Virtual Host file at /etc/apache2/sites-available/yourdomain.com-le-ssl.conf and, if you opt in, adds a permanent redirect from HTTP to HTTPS.

Step 3 — Verify the Apache Configuration

Always check for syntax errors before reloading Apache:

sudo apache2ctl configtest

If you see Syntax OK, reload the service:

sudo systemctl reload apache2

Open your site in a browser at https://yourdomain.com. You should see the padlock icon in the address bar confirming a secure connection.

Confirm the certificate from the terminal

sudo certbot certificates

This lists the certificate path, private key location, and expiration date.

Step 4 — Automatic Renewal

Let's Encrypt certificates expire every 90 days. Certbot installs a systemd timer that attempts renewal twice a day whenever the certificate is within 30 days of expiry.

Check that the timer is active:

sudo systemctl status snap.certbot.renew.timer

Simulate a renewal to confirm everything works:

sudo certbot renew --dry-run

If the output ends with "Congratulations, all simulated renewals succeeded," automatic renewal is fully configured.

Troubleshooting Common Issues

Error	Common Cause	Fix
`Connection refused on port 80`	Firewall blocking HTTP	`sudo ufw allow 80`
`DNS problem: NXDOMAIN`	Domain not pointed to server	Check the A record in your DNS settings
`Too many certificates already issued`	5 certs/domain/week limit hit	Use `--staging` flag for testing
Mixed content warnings	Internal resources loaded over HTTP	Update asset URLs to `//` or `https://`

If you manage several sites and want SSL handled for you from day one, explore managed hosting plans with SSL included so your team can focus on building rather than maintaining certificates.

For more articles on web security, visit our SSL security guide.

Key Takeaways

Certbot's --apache flag automates both certificate issuance and Virtual Host configuration.
The full setup takes under ten minutes if DNS is already propagated.
The systemd timer renews automatically — no calendar reminders needed.
When things go wrong, check your firewall rules and DNS resolution first.
Always use --staging during testing to avoid hitting rate limits.

Want a hosting environment where SSL is configured and renewed for you automatically? Check out elenlace.com's hosting plans and hand off the technical overhead to experts.

FAQ

Is Let's Encrypt safe for a production website?

Yes. Let's Encrypt issues domain-validated (DV) certificates with 2048- or 4096-bit keys, trusted by all modern browsers. The encryption strength is identical to many paid certificates. The distinction between DV, OV, and EV certificates lies in identity validation, not in the level of encryption provided.

What happens if the certificate expires before renewal?

Browsers display a "certificate expired" error that blocks visitors from accessing the site. Certbot's automatic timer prevents this, but if you ever disable it you'll need to run sudo certbot renew manually before the 90-day window closes.

Can I use this process for multiple domains on the same server?

Yes. Each Apache Virtual Host can have its own certificate. Run sudo certbot --apache again for each additional domain, or include all of them in a single SAN (Subject Alternative Name) certificate using multiple -d flags in one command.

Will Certbot modify my existing Apache configuration files?

Yes — it adds SSL directives to the port-443 Virtual Host and optionally a redirect in the port-80 block. It saves a .bak backup before making changes. If you prefer full control, use certonly to obtain certificate files only, then configure the Apache directives yourself.

Compare providers

Other providers and guides worth comparing: