iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
To secure an Ubuntu Apache site with a free Let’s Encrypt certificate, point your domain at the server, allow inbound TCP port 80, install Certbot, and run sudo certbot --apache -d example.com -d www.example.com. Certbot validates the names, installs the certificate in the matching Apache VirtualHost, enables HTTPS, and reloads Apache. Finish by testing renewal with sudo certbot renew --dry-run.
What you need before requesting a certificate
Let’s Encrypt issues certificates only after it verifies that you control each requested hostname. Prepare these items first:
- A registered domain, such as
example.com. - Public DNS records for every name you will include. The apex name and
wwwmay point to the same Ubuntu server, but each name must resolve correctly. - An Ubuntu server running Apache with the intended site configured in a VirtualHost.
- Inbound TCP port 80 allowed through the server firewall, cloud firewall, router, and any load balancer when using the standard HTTP-01 challenge.
- Internet reachability throughout both certificate issuance and renewal. A site that works only on a private network cannot complete HTTP-01 validation.
- Administrative access through
sudo.
Before running Certbot, check DNS from a network outside the server’s local network. Every hostname in the command must resolve to the public address that actually reaches Apache. If a proxy, load balancer, or CDN handles HTTP traffic, its routing must pass the ACME challenge request to this host.
Choose how Let’s Encrypt will validate your domain
The validation method determines whether port 80 is needed, whether Apache is edited automatically, and whether wildcard names are possible.
#1 Best Overall
- Compact and Efficient Design: The FortiGate 40F is designed for small to mid-sized businesses and enterprise branch offices, featuring a compact, fanless desktop form factor that ensures quiet operation and minimizes space usage.
- Robust Connectivity Options: Equipped with 5 GE RJ45 ports, including 1 WAN port and 4 internal ports, this model provides essential connectivity and flexibility for various network configurations in a small-scale environment.
- High-Performance Security: Offers up to 1 Gbps IPS throughput and 600 Mbps threat protection throughput, using Fortinet’s purpose-built security processor technology to deliver industry-leading performance and protection for SSL encrypted traffic.
- Advanced Threat Protection: Integrated with Fortinet’s AI-powered FortiGuard Labs, the FortiGate 40F offers comprehensive cybersecurity, identifying and mitigating both known and unknown threats to maintain robust security across your network.
- Simplified Management and Deployment: Features a user-friendly management console that provides comprehensive network automation and visibility, coupled with Zero Touch Integration with Fortinet’s Security Fabric for easy deployment.
| Method | Port 80 required on Apache | Wildcard certificates | Apache changed automatically | Typical use |
|---|---|---|---|---|
HTTP-01 with --apache |
Yes; the hostname must be reachable from the Internet | No | Yes. Certbot authenticates, installs the certificate, and reloads Apache | Most single-site and ordinary multi-hostname Apache deployments |
| DNS-01 with a DNS plugin or TXT record | No inbound connection to Apache is required | Yes; DNS-01 is the only Let’s Encrypt challenge type that can issue wildcard certificates | Usually no; DNS plugins validate ownership, while installation is a separate step | Wildcard names or servers that cannot expose port 80 |
certonly --apache |
Yes for Apache-based HTTP-01 validation | No | No. Certbot obtains the files but leaves Apache configuration to you | Sites where TLS is configured manually or another service terminates HTTPS |
HTTP-01 is normally the simplest route because the Apache plugin is both an authenticator and an installer. DNS-01 requires either a supported DNS provider plugin with credentials or a manual TXT-record workflow. Treat DNS API credentials as sensitive: they can often modify an entire DNS zone.
Install Certbot on Ubuntu
Ubuntu’s documented installation uses the Snap package:
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →- Install the classic Certbot snap:
sudo snap install --classic certbot - Make the command available in the conventional system path if it is not already there:
sudo ln -s /snap/bin/certbot /usr/local/bin/certbot - Confirm that the executable responds:
certbot --version
The symlink command can report that the link already exists when Certbot is already on your path. That is harmless; verify the result with command -v certbot and certbot --version.
Issue and install a certificate in Apache
Request all intended hostnames
For a site serving both the bare domain and its www hostname, run:
sudo certbot --apache -d example.com -d www.example.comReplace both names with the real hostnames. Each -d flag adds a name to the same certificate, so include every hostname that users should be able to visit. Do not request a name until its DNS record reaches this server.
Rank #2
- 【Professional Firewall & NAS SERVER】OAKNODE 10gbe Firewall Appliance Mini PC-MGNASN, a powerful professional firewall router pc equipped with a 12th Gen Alder Lake N100 4C/4T up to 3.4GHz TDP only 6W with Intel UHD Graphics which maximizes the performance of the 2.5GbE port & SFP+ port, bring you a smooth secured and encrypted network environment.
- 【Rich I/O to meet your needs】Firewall Appliance MGNASN With HDMI 2.0+DP 1.4+TYPE-C(dp 1.2) Support for 3x4K@60Hz together, Dual DDR4 RAM slot support for up to 1x32GB SO-Dimm laptop DDR5 Ram Maximum 5600Mhz and 1xM.2 NVMe/PCIe 3.0x1 2280 SSD slot +1*SATA 3.0 SSD/HDD slots (install externally), also it support boot from TF card slot and it also support PXE/AWOL/Watchdog/GPIO etc. which is perfect for your firewall appliance、VM、Router、home Server needs.
- 【2xSFP+ 10GbE + 4x2.5GbE】This Firewall Router equipped with 2xIntel 82599ES 10gbe network card and 4*Intel i226-V network card speed maximum up to 2.5GbE(need other device like router, cables etc. also support 2.5Gbe/10gbe)which can bring you more faster and professional network usage(some system not release drivers yet) suggest to install version of below systems: pf-sense plus 23.0X or CE 2.7.X, OPNsense 22.1, OpenWrt, ROS7, ESXI 8 , Proxmox, CentOS etc).
- 【4G LTE Function supported】This model also support 4G LTE function(mini PCIE slot for 4G modem) and SIM card slot which you can use it as a IOT devices for your server.
- 【Quality With Warranty】If you have any questions or requirements(like OS installation/ drives/bios updates etc.) on OAKNODE Firewall mini pc MGNASN, PLEASE feel free to contact us. We offered 12 Months warranty for it and WE'LL REPLY YOUR Questions within 12 hours(during Workdays).
Complete the interactive prompts
Certbot may ask for an email address, acceptance of the Let’s Encrypt terms, and whether HTTP traffic should be redirected to HTTPS. Use an address that is monitored for certificate notices. If you choose the redirect option, Certbot adds an HTTP-to-HTTPS redirect to the affected Apache VirtualHost; if you decline, HTTP remains available and you can create the redirect yourself.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →What the Apache plugin changes
During HTTP-01 validation, Certbot temporarily serves the challenge response at a path under /.well-known/acme-challenge/. The Let’s Encrypt service requests that path over HTTP port 80. After validation, the Apache plugin locates the matching VirtualHost, writes the TLS directives and certificate paths, enables the HTTPS configuration where needed, and reloads Apache. A reload applies the new configuration without unnecessarily stopping existing connections.
Before and after issuance, you can ask Apache to validate its configuration:
sudo apachectl configtestA successful check should report Syntax OK. If it reports an error, correct the configuration before attempting another reload.
Use DNS-01 when port 80 or wildcard names require it
DNS-01 proves control by requiring a TXT record under the requested domain. It does not require an inbound connection to the Apache server, so it is useful when port 80 cannot be exposed or when the web server is behind a network boundary. It is also the only method that supports names such as *.example.com.
Recommended Free Tools
Rank #3
- BUSINESS READY - pfSense+ software updates included for product lifetime. Netgate TAC Lite technical support included. One year hardware warranty included.
- COMPLETE - Pre-loaded with pfSense+ software to get up and running fast. Simply unbox it and start customizing for your secure edge networking needs. Free help with setup from our expert Technical Assistance Center (TAC) available 24/7/365.
- POWERFUL - A dual core ARM Cortex-A53 1.2 GHz delivers near gigabit routing of common home iPerf3 traffic and in excess of 650 Mbps of firewall throughput.
- COMPACT - Low power draw, a compact form factor, and silent operation allow it to run unnoticed when placed on a desktop, wall, or rack.
- FLEXIBLE - Three (3) 1 GbE switched (WAN/LAN/OPT) ports allow you to configure three separate 1 GbE switched ports for upto a gigabit of bi-directional traffic.
Provider plugin workflow
Install the Certbot DNS plugin appropriate for your DNS provider, create credentials with the narrowest permissions available, and configure the plugin according to that provider’s instructions. Then request the certificate with the plugin’s DNS authenticator. The exact package name, command-line option, credential file, and propagation behavior depend on the provider, so do not copy an option from a different DNS service.
Manual TXT-record workflow
With manual DNS validation, Certbot displays a TXT value and pauses while you create it at the DNS provider. Wait for the record to propagate before continuing. Manual issuance can work for occasional certificates, but unattended renewal is difficult unless the DNS provider supports an automated plugin or hook. Remove or rotate credentials that were exposed during setup.
Obtain a certificate without letting Certbot edit Apache
Use certonly when Apache is configured by hand, a reverse proxy owns the public TLS endpoint, or another service terminates HTTPS:
sudo certbot certonly --apache -d example.com -d www.example.comThis command performs validation and obtains the certificate but does not install TLS directives in Apache. Certbot reports the resulting certificate and private-key locations, normally under /etc/letsencrypt/live/. Configure the terminating service to use those files, protect the private key, and reload that service after a successful renewal.
Free tools Windows power users keep installed
One-click scans. No signup required.
If the certificate is served by something other than Apache, a renewal can finish successfully while the public service continues presenting the old certificate. Add a Certbot deploy hook that reloads the actual TLS terminator after renewal. Test that hook independently and again with a dry run.
Rank #4
- 【Processor & OS】Firewall Mini PC with Intel J3710 CPU up to 2.64GHz, 4Cores 4threads 2MB L2 Cache, TDP 6.5w, supports AES-NI. It tested with pf-sens/opn-sense linux ubuntu and other popular open source os. ("DEL" key to enter BIOS)
- 【Interfaces】The firewall pc has 4 * Intel I226 lan ports, 2 * USB3.0 ports, 1 * RS232COM port, 2 * HD port, 1 * DC port. Equipped with VESA mount, you can install the micro pc behind the monitor to save space.
- 【Fanless Design】only 6.5W; fanless heat dissipation design, aluminum alloy shell, efficient and fast heat dissipation, which can withstand temperatures up to 60°C. support 24/7 hours working, no noise.
- 【RAM & Storage】The firewall router equipped with 8G DDR3 RAM, max support 8GB; 128GB mSATA SSD, up to 512GB. Not support HDD. Size:5.27 * 4.98 * 1.43 inches, Weigh:500g, small but powerful.
- 【12 Months Service】You will get a firewall pc and accessories，If you encounter any problems during the use, please contact us through Amazon, we have a professional and efficient team dedicated to serving you.
Understand certificate lifetime and automatic renewal
Let’s Encrypt certificates are valid for 90 days. Ubuntu’s current Certbot setup uses a systemd timer named snap.certbot.renew.timer that attempts renewal twice daily. Certbot renews only certificates that are close enough to expiration, so these frequent attempts do not replace a healthy certificate every time.
Inspect the timer
systemctl status snap.certbot.renew.timer
systemctl list-timers snap.certbot.renew.timerThe timer should be enabled and show a scheduled next run. A timer that is missing, inactive, or failing needs attention before the first certificate approaches expiration.
Run a safe renewal test
sudo certbot renew --dry-runThe dry run exercises the renewal process without replacing the live certificate. It can reveal expired credentials, broken DNS, blocked port 80, an invalid Apache configuration, or a deploy hook that cannot reload the service. Run it after initial setup and after significant DNS, firewall, proxy, VirtualHost, or TLS changes.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallConfirm a real renewal
When a certificate is eligible for renewal, Certbot uses the same authenticator and installer or deploy hook that was saved during issuance. For an Apache-managed certificate, a successful renewal reloads Apache automatically. For a certonly deployment, the service reload is your responsibility.
Verify that HTTPS is actually working
- Open
https://example.comand each other hostname included in the certificate. - Inspect the browser’s certificate details. Confirm that the certificate covers the exact hostname, is currently valid, and chains to a trusted authority.
- Test the HTTP behavior. If you selected Certbot’s redirect option,
http://example.comshould redirect to the corresponding HTTPS URL. If you intentionally kept HTTP, verify that this is documented and that sensitive functions do not accept credentials over plain HTTP. - Check Apache’s enabled sites and the VirtualHost selected for each name. A certificate can be valid while Apache serves it from the wrong hostname or serves a different certificate on another address.
- After a renewal or configuration change, reload Apache and inspect the public certificate again rather than relying only on local files.
For server-side diagnostics, review Apache’s error and access logs and run sudo apachectl configtest. Validation errors often appear before any certificate is created; reload errors occur after Certbot has obtained or modified configuration.
Best Value
- 【CPU Optimized for Firewall Mini PCs】This firewall appliance is powered by Intel Quad-Core Celeron J1900, 64-bit, up to 2.0 GHz, supporting software-based encryption. Energy-efficient and reliable, it runs 24/7 for home or small office networks, handling VPNs, multi-WAN routing, and basic firewall tasks efficiently.
- 【4×Intel i210 Ports】Equipped with four Intel i210 network controllers, each delivering up to 1 GbE for reliable multi-WAN routing, VPN connections, VLAN management, and stable performance in small office or home firewall deployments
- 【Memory & Storage】This Firewall Mini PC comes with 4 GB DDR3L RAM and a 64 GB mSATA SSD, providing reliable performance for basic networking tasks. AMI BIOS with ACPI support ensures stable system operation and energy-efficient 24/7 use
- 【Flexible System Compatibility】Compatible with Windows 10, Linux, and professional firewall systems such as pfSense, OPNsense, and VyOS, ensuring stable network management for home or small office use
- 【After-Sales Support:】This compact, fanless, and silent firewall keeps your network secure. Includes lifetime technical support and a 30-day money-back guarantee!
Troubleshoot common failures
Validation says the domain is unreachable
- Check that every requested DNS name resolves publicly to the correct address. Correct stale A or AAAA records and allow time for DNS changes to propagate.
- Verify TCP port 80 at every layer: Ubuntu’s firewall, a cloud security group, a router, and a load balancer or reverse proxy.
- Make sure Apache is listening on port 80 and that the request reaches the intended VirtualHost. A redirect is normally acceptable, but a proxy must preserve access to the ACME challenge path.
- Ensure the site remains reachable during renewal; a rule that works only during initial issuance can fail later.
Another service already uses port 80
The Apache plugin needs Apache to serve the HTTP-01 challenge. If a different service owns port 80, route the challenge to Apache or stop the conflicting service only during a controlled issuance window. Certbot’s standalone mode is a different approach: it starts a temporary server and therefore also requires port 80 to be free. If neither arrangement is possible, use DNS-01.
Apache reload fails
Run sudo apachectl configtest and read the Apache error log. Common causes include a malformed VirtualHost, a conflicting directive, a missing module, or a manually edited certificate path. Fix the configuration, test it again, and reload Apache with sudo systemctl reload apache2. Do not repeatedly force reloads while the configuration test is failing.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsThe dry run fails after a previously successful setup
Compare what changed since issuance: DNS records, firewall rules, port forwarding, proxy routing, Apache VirtualHosts, DNS API credentials, or a deploy hook. For HTTP-01, test public port 80 and the challenge route. For DNS-01, verify that the plugin can still authenticate and create or remove TXT records. For a manually installed certificate, confirm that the renewal hook reloads the service that actually presents TLS.
The browser still shows an old certificate
Check which service handles HTTPS on the public address. A successful Certbot renewal updates files on the Ubuntu host, but a separate load balancer or proxy may use its own certificate store. Reload the real TLS terminator, verify its configured paths, and inspect the certificate from an external connection.
Quick Recap
Operational checklist for a maintainable setup
- Include every production hostname in the original certificate request, including the apex and
wwwname when both are used. - Keep port 80 reachable if the certificate uses HTTP-01, even when all normal traffic is redirected to HTTPS.
- Check the
snap.certbot.renew.timerafter installation and after operating-system or Snap changes. - Run
sudo certbot renew --dry-runafter changing DNS, firewalls, proxies, VirtualHosts, or renewal hooks. - Protect the private key and any DNS API credential files with restrictive permissions; never place them in a public document directory.
- Record whether Certbot manages Apache directly or whether your team owns the TLS directives and reload hook.
- Monitor certificate expiry and investigate a failed dry run immediately rather than waiting for the 90-day certificate to expire.
Commands at a glance
| Purpose | Command |
|---|---|
| Install Certbot | sudo snap install --classic certbot |
| Expose the Snap command in a standard path | sudo ln -s /snap/bin/certbot /usr/local/bin/certbot |
| Issue and install for Apache | sudo certbot --apache -d example.com -d www.example.com |
| Obtain files without editing Apache | sudo certbot certonly --apache -d example.com -d www.example.com |
| Test Apache syntax | sudo apachectl configtest |
| Test renewal without replacing the live certificate | sudo certbot renew --dry-run |
| Inspect the renewal timer | systemctl status snap.certbot.renew.timer |
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
