The following instructions will guide you through installing an ACME-enabled SSL certificate on an Apache or NGINX web server running on Linux. This guide uses Certbot, the most popular ACME client, which can automatically obtain and install certificates and configure your web server.<\/p>\n
After you complete the initial setup, your SSL certificate should be hands-free: renewals and updates happen automatically without you needing to worry about it.<\/p>\n
Note: <\/strong>Certbot requires a supported, up-to-date operating system with the necessary dependencies. Using an outdated OS may result in installation errors. Root or sudo access is required for all installation steps.<\/p>\n Before you begin, make sure you have the following:<\/p>\n Tip: you can run certbot –version to see if certbot is already installed on your server.<\/p>\n Certbot is the recommended ACME client for Apache and NGINX. Installation steps vary by operating system and web server. Select your OS family below, then choose one<\/strong> of the available installation methods.<\/p>\n The following instructions apply to Debian, Ubuntu, Linux Mint, and other Debian-based distributions. Choose Option A<\/strong> or Option B<\/strong> below\u2014you only need to complete one.<\/p>\n The apt package manager provides a straightforward installation that integrates with your system’s package management. This method may not always provide the latest version of Certbot.<\/p>\n For Apache:<\/strong><\/p>\n For NGINX:<\/strong><\/p>\n The Certbot developers recommend installation via snap, as it provides automatic updates and always delivers the latest version. This method installs Certbot with support for both Apache and NGINX.<\/p>\n The following instructions apply to Red Hat Enterprise Linux (RHEL), CentOS, Fedora, Rocky Linux, AlmaLinux, and other RHEL-based distributions. Choose Option A<\/strong> or Option B<\/strong> below\u2014you only need to complete one.<\/p>\n This method uses your system’s native package manager. You’ll need to enable the EPEL (Extra Packages for Enterprise Linux) repository first.<\/p>\n For Apache:<\/strong><\/p>\n For NGINX:<\/strong><\/p>\n The Certbot developers recommend installation via snap, as it provides automatic updates and always delivers the latest version. This method installs Certbot with support for both Apache and NGINX.<\/p>\n With Certbot installed, you can now request your SSL certificate. Certbot’s automatic mode will obtain the certificate, configure your web server, and set up automatic renewal\u2014all in a single command.<\/p>\n Run the appropriate command for your web server, replacing the placeholder values with your own:<\/p>\n For Apache:<\/strong><\/p>\n For NGINX:<\/strong><\/p>\n Command Parameters<\/strong><\/p>\n Example Command<\/strong><\/p>\n Here is a complete example for Apache using a Sectigo ACME server:<\/p>\n Tip: <\/strong>For NGINX, simply change –apache to –nginx in the command above. To secure multiple domains with a single certificate, include a separate –domain flag for each domain.<\/p>\n After the command completes successfully, verify that your certificate is installed and working:<\/p>\n Certbot automatically configures a cron job or systemd timer to renew your certificate before it expires. No additional configuration is required for automatic renewal.<\/p>\nWhat You’ll Need<\/h2>\n
\n
Step 1: Install Certbot<\/h2>\n
For Debian\/Ubuntu Systems<\/h3>\n
Option A: Install via apt<\/h4>\n
\n
sudo apt update<\/code><\/p>\n\n
sudo apt install certbot python3-certbot-apache<\/code><\/p>\nsudo apt install certbot python3-certbot-nginx<\/code><\/p>\nOption B: Install via snap (Recommended)<\/h4>\n
\n
sudo snap install core<\/code>
\nsudo snap refresh core<\/code><\/p>\n\n
sudo snap install --classic certbot<\/code><\/p>\n\n
sudo ln -s \/snap\/bin\/certbot \/usr\/bin\/certbot<\/code><\/p>\nFor Red Hat\/CentOS\/Fedora Systems<\/h3>\n
Option A: Install via dnf or yum<\/h4>\n
\n
sudo dnf install epel-release<\/code>
\nOR
\nsudo yum install epel-release<\/code><\/p>\n\n
sudo dnf clean all<\/code>
\nsudo dnf update<\/code>
\nOR
\nsudo yum clean all<\/code>
\nsudo yum update<\/code><\/p>\n\n
sudo dnf install certbot python3-certbot-apache<\/code>
\nOR
\nsudo yum install certbot python-certbot-apache<\/code><\/p>\nsudo dnf install certbot python3-certbot-nginx<\/code>
\nOR
\nsudo yum install certbot python-certbot-nginx<\/code><\/p>\nOption B: Install via snap (Recommended)<\/h4>\n
\n
sudo snap install core<\/code>
\nsudo snap refresh core<\/code><\/p>\n\n
sudo snap install --classic certbot<\/code><\/p>\n\n
sudo ln -s \/snap\/bin\/certbot \/usr\/bin\/certbot<\/code><\/p>\nStep 2: Obtain and Install Your Certificate<\/h2>\n
sudo certbot --apache --non-interactive --agree-tos \\<\/code>
\n\u00a0 --server <acme-directory> \\<\/code>
\n\u00a0 --email <your-email> \\<\/code>
\n\u00a0 --eab-kid <your-eab-kid> \\<\/code>
\n\u00a0 --eab-hmac-key <your-hmac-key> \\<\/code>
\n\u00a0 --domain <your-domain> \\\u00a0 <\/code>
\n\u00a0 --cert-name <your-certificate-name><\/code><\/p>\nsudo certbot --nginx --non-interactive --agree-tos \\<\/code>
\n\u00a0 --server <acme-directory> \\<\/code>
\n\u00a0 --email <your-email> \\<\/code>
\n\u00a0 --eab-kid <your-eab-kid> \\<\/code>
\n\u00a0 --eab-hmac-key <your-hmac-key> \\<\/code>
\n\u00a0 --domain <your-domain> \\\u00a0 <\/code>
\n\u00a0 --cert-name <your-certificate-name><\/code><\/p>\n\n
sudo certbot --apache --non-interactive --agree-tos \\<\/code>
\n\u00a0 --email admin@example.com \\<\/code>
\n\u00a0 --server https:\/\/acme.sectigo.com\/v2\/DV \\<\/code>
\n\u00a0 --eab-kid abc123yourEabKid \\<\/code>
\n\u00a0 --eab-hmac-key xyz789yourHmacKey \\<\/code>
\n\u00a0 --domain example.com \\<\/code>
\n\u00a0 --domain www.example.com \\\u00a0 <\/code>
\n\u00a0 --cert-name my-example-certificate<\/code><\/p>\nStep 3: Verify the Installation<\/h2>\n
\n