certbot in Linux: Free TLS Certificates

certbot is the Let's Encrypt client: it proves you control a domain, obtains free TLS certificates, installs them into your web server, and renews them automatically before they expire. HTTPS stops being a project and becomes a fact.

The one-command certificate #

Obtain and install, nginx plugin

$ sudo certbot --nginx -d aospix.com -d www.aospix.com
Saving debug log ...
Requesting a certificate ...
Successfully received certificate.
Deploying certificate             # nginx config edited, reloaded

The --nginx plugin (or --apache, or --caddy-handled separately) reads the web server config, answers Let's Encrypt's HTTP challenge on port 80, and writes the certificate paths into the right blocks. The DNS must point at this machine first — the challenge literally verifies it.

The two challenge types #

Challenge	Requirement	Use when
HTTP-01	Port 80 reachable	The normal case for public sites
DNS-01	A TXT record created on demand	Wildcards; no inbound HTTP

The wildcard case, DNS challenge

$ sudo certbot certonly --manual --preferred-challenges dns -d "*.aospix.com"
$ # add the TXT record it shows, press enter, certificate issued

DNS-01 is the only path to wildcard certificates and the right choice for machines behind restrictive firewalls — with the operational caveat that automated renewal needs a DNS API plugin (certbot-dns-cloudflare and friends) to create the TXT record unattended.

Renewal: automatic, verifiable #

Certificates last 90 days; certbot installs a systemd timer that renews at 30 days remaining. Trust it, and verify it:

The renewal checks

$ sudo certbot renew --dry-run       # full rehearsal, no real request
$ systemctl list-timers | grep certbot

--dry-run is the line that matters: it walks the entire renewal path against the staging API and reports per-certificate success. Run it after any server config change — renewal breaks quietly when the challenge path moved.

The certificates themselves #

Where they live, what they cover, when they expire

$ sudo certbot certificates
  Certificate Name: aospix.com
    Domains: aospix.com www.aospix.com
    Expiry Date: 2027-01-19 (valid: 89 days)
    Certificate Path: /etc/letsencrypt/live/aospix.com/fullchain.pem

Path	Contents
`fullchain.pem`	Certificate + intermediates — what servers present
`privkey.pem`	The private key — never leaves this machine
`/etc/letsencrypt/renewal/`	Per-certificate renewal settings

Rate limits are real: Let's Encrypt allows ~5 duplicate certificates per week. Develop against the staging API (--staging) and switch to production only when the flow works — the classic trap is testing the plugin loop five times and being locked out for days.

For the servers these certificates feed, see nginx and Caddy — the latter does this whole note internally. The network series continues.