How to setup free SSL (HTTPS) on Ubuntu Server using Nginx

Securing your website with HTTPS is essential for trust, SEO, and data protection — and the good news is, you can do it for free.

In this guide, we’ll walk through how to install Nginx, configure your domain, and set up a free SSL certificate using Let’s Encrypt Certbot.

This step-by-step tutorial works perfectly on Ubuntu 20.04, 22.04, and 24.04, helping you get your website running securely in just a few minutes.

STEP 1: UPDATE SYSTEM PACKAGES

sudo apt update && sudo apt upgrade -y

STEP 2: INSTALL NGINX

sudo apt install -y nginx

Start and enable Nginx to run on boot:

sudo systemctl start nginx
sudo systemctl start nginx

Check the status:

systemctl status nginx

You should see "active (running)".

STEP 3: ALLOW HTTP AND HTTPS THROUGH FIREWALL

If UFW (Uncomplicated Firewall) is enabled, run:

sudo ufw allow 'Nginx Full'
sudo ufw delete allow 'Nginx HTTP' # Optional: close plain HTTP only if HTTPS forced
sudo ufw enable
sudo ufw status

STEP 4: VERIFY DOMAIN DNS

Go to your domain registrar (for example Namecheap or Cloudflare) and make sure these records exist:

@ A your_server_ip
www A your_server_ip

Check DNS propagation:
ping example.com

It should show your server IP.

STEP 5: CREATE AN NGINX SERVER BLOCK

Example domain: example.com

Create the web directory:

sudo mkdir -p /var/www/example.com/html
sudo chown -R $USER:$USER /var/www/example.com/html
sudo chmod -R 755 /var/www/example.com

Create a test page:

echo "<h1>Hello from example.com over HTTP!</h1>" | sudo tee /var/www/example.com/html/index.html

Create the server configuration file:

sudo nano /etc/nginx/sites-available/example.com

Paste this configuration:

server {
  listen 80;
  listen [::]:80;
  server_name example.com www.example.com;
  root /var/www/example.com/html;
  index index.html;
  location / {
    try_files $uri $uri/ =404;
  }
}

Or for proxy:

server {
    listen 80;
    listen [::]:80;
    server_name example.com www.example.com;
    # If you haven't run Certbot yet, keep this for HTTP only.
    # Certbot will later edit/add HTTPS blocks.
    location / {
        proxy_pass http://127.0.0.1:3000;
        # Preserve client info & host
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        # Optional: WebSocket / long-lived connections
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
    }
}

Enable the configuration:

sudo ln -s /etc/nginx/sites-available/example.com /etc/nginx/sites-enabled/
sudo nginx -t
sudo systemctl reload nginx

Now open http://example.com in your browser and you should see the test page.

STEP 6: INSTALL CERTBOT (LET’S ENCRYPT CLIENT)

Certbot will automatically obtain and install free SSL certificates.

Install Certbot with the Nginx plugin:

sudo apt install -y certbot python3-certbot-nginx

STEP 7: REQUEST A FREE SSL CERTIFICATE

Run this command:

sudo certbot --nginx -d example.com -d www.example.com

Certbot will do the following:

• Verify domain ownership using HTTP challenge

• Obtain a valid SSL certificate

• Automatically configure Nginx for HTTPS

During the setup:

• Enter your email for expiry notifications

• Agree to the terms

• Choose the redirect option to force all HTTP to HTTPS

STEP 8: VERIFY HTTPS IS WORKING

Visit your site:

https://example.com

You should see a padlock symbol in the browser.

To check certificate details:

sudo certbot certificates

Example output:

Certificate Name: example.com
Domains: example.com www.example.com
Expiry Date: 2025-01-12 03:14:22+00:00 (VALID: 89 days)
Certificate Path: /etc/letsencrypt/live/example.com/fullchain.pem
Private Key Path: /etc/letsencrypt/live/example.com/privkey.pem

STEP 9: ENABLE AUTO RENEWAL (FREE FOREVER)

Certbot installs automatic renewal via systemd or cron.

Test renewal manually:

sudo certbot renew --dry-run

If you see “Congratulations, all renewals succeeded.” then auto-renew is working.
Your SSL will renew automatically every 60 days.

STEP 10: FORCE HTTPS MANUALLY (IF NEEDED)

If you did not choose the redirect option earlier, edit your Nginx configuration:

sudo nano /etc/nginx/sites-available/example.com

Add this block above your HTTPS configuration:

server {
  listen 80;
  listen [::]:80;
  server_name example.com www.example.com;
  return 301 https://$host$request_uri;
}

Reload Nginx:

sudo nginx -t && sudo systemctl reload nginx

Now all HTTP requests are redirected to HTTPS.

SETUP COMPLETE

Your website is now using a free, auto-renewing SSL certificate from Let’s Encrypt.

HTTPS encryption is enabled, renewal is automatic, and the Nginx configuration is optimized for security.

USEFUL COMMANDS

Test Nginx configuration:

sudo nginx -t

Reload configuration without downtime:

sudo systemctl reload nginx

View installed SSL certificates:

sudo certbot certificates

Test renewal process:

sudo certbot renew --dry-run

Check Nginx error log:

sudo tail -f /var/log/nginx/error.log