Setting Up CertBot for Nginx SSL Certificates

Installing CertBot

CentOS 7 Enstallation

Prerequisites

yum install epel-release  # Install EPEL repository
yum install snapd         # Install snapd package
# Start the systemd unit that manages the main snapd communication socket
systemctl enable --now snapd.socket
# Create symbolic link
ln -s /var/lib/snapd/snap /snap

CertBot Installation

snap install --classic certbot
ln -s /snap/bin/certbot /usr/bin/certbot

CentOS 8 Installation

Prerequisites

# Add EPEL Repository
sudo dnf install https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm
sudo dnf config-manager --set-enabled PowerTools

CertBot Installation

CertBot is available as an RPM package for CentOS 8 systems through the EPEL repository, which should already be enabled on your system.

sudo dnf install certbot python3-certbot-nginx

Obtaining SSL Certificates

Automatic Certificate Installation

This method automatically obtains and installs the certificate, updating your Nginx configuration.

certbot --nginx

During the process, you'll be prompted to enter your email address and agree to the terms of service. You can decline the option to receive promotional emails.

Certificate-Only Acquisition

This method only retrieves the certificate without modifying you're Nginx configuration.

certbot certonly --nginx

Custom Configuration Path

For Nginx installations with non-standard configuration paths:

certbot --nginx --nginx-server-root=/usr/local/nginx/conf

Automating Certificate Renewal

Let's Encrypt certificates have a 90-day validity period. CertBot allows you to renew certificates before they expire, which can be automated.

Manual Renewal

To renew all certificates on the system:

sudo certbot renew

Dry Run Testing

Test renewal without actually updating certificates to verify automasion will work:

sudo certbot renew --dry-run

Checking Certificate Status

To view certificate details and expiration dates:

sudo certbot certificates