{"id":12813,"date":"2025-12-13T14:14:43","date_gmt":"2025-12-13T08:44:43","guid":{"rendered":"https:\/\/www.youstable.com\/blog\/?p=12813"},"modified":"2025-12-24T16:14:28","modified_gmt":"2025-12-24T10:44:28","slug":"configure-lets-encrypt-on-linux","status":"publish","type":"post","link":"https:\/\/www.youstable.com\/blog\/configure-lets-encrypt-on-linux","title":{"rendered":"How to Configure Let&#8217;s Encrypt on Linux Server (Guide 2026)"},"content":{"rendered":"\n<p>To configure Let\u2019s Encrypt on a Linux server in 2026, install Certbot, open ports 80\/443, and run a one-command installer for Apache or Nginx to fetch and apply a free SSL certificate. Verify HTTPS, enable auto\u2011renewal, and harden TLS settings. This guide covers step\u2011by\u2011step commands, wildcard SSL, and troubleshooting.<\/p>\n\n\n\n<p>Securing your website with HTTPS is non\u2011negotiable. In this step\u2011by\u2011step guide, you\u2019ll learn how to configure Let\u2019s Encrypt on Linux server using Certbot\u2014the recommended ACME client\u2014as of 2026. We\u2019ll cover Apache, Nginx, wildcard SSL, auto\u2011renewal, firewall rules, security hardening, and real\u2011world troubleshooting learned from 12+ years managing production servers.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"what-you-need-before-you-start-quick-checklist\"><strong>What You Need Before You Start (Quick Checklist)<\/strong><\/h2>\n\n\n\n<p>Make sure the basics are in place so certificate issuance doesn\u2019t fail mid\u2011way.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Root or sudo access to a Linux server (Ubuntu\/Debian, AlmaLinux\/Rocky\/RHEL, or similar).<\/li>\n\n\n\n<li>A registered domain pointing to your server\u2019s public IP (A\/AAAA records propagated).<\/li>\n\n\n\n<li>Ports 80 (HTTP) and 443 (HTTPS) open in your firewall, security groups, and provider panel.<\/li>\n\n\n\n<li>Web server installed (Apache or Nginx). For standalone issuance, a web server isn\u2019t required during issuance.<\/li>\n\n\n\n<li>Optional: Control of DNS provider for DNS\u201101 challenges (wildcard certificates).<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"install-certbot-recommended-method-for-2026\"><strong>Install Certbot (Recommended Method for 2026)<\/strong><\/h2>\n\n\n\n<p>Let\u2019s Encrypt recommends Certbot with Snap for most distributions. It keeps Certbot updated independent of the OS package manager.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"ubuntu-debian-via-snap\"><strong>Ubuntu\/Debian (via Snap)<\/strong><\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo apt update\nsudo apt install -y snapd\nsudo snap install core\nsudo snap refresh core\nsudo snap install --classic certbot\nsudo ln -s \/snap\/bin\/certbot \/usr\/bin\/certbot  # convenience symlink<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"rhel-rocky-almalinux-via-snap\"><strong>RHEL, Rocky, AlmaLinux (via Snap)<\/strong><\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo dnf install -y epel-release\nsudo dnf install -y snapd\nsudo systemctl enable --now snapd.socket\nsudo ln -s \/var\/lib\/snapd\/snap \/snap\nsudo snap install core\nsudo snap install --classic certbot\nsudo ln -s \/snap\/bin\/certbot \/usr\/bin\/certbot<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"verify-certbot\"><strong>Verify Certbot<\/strong><\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>certbot --version<\/code><\/pre>\n\n\n\n<p>If Snap is not an option, use your distro package or Docker image for Certbot, but expect slower updates.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"open-firewall-ports-80-and-443\"><strong>Open Firewall Ports 80 and 443<\/strong><\/h2>\n\n\n\n<h3 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"ufw-ubuntu-debian\"><strong>UFW (Ubuntu\/Debian)<\/strong><\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo ufw allow \"Nginx Full\"   # or \"Apache Full\"\nsudo ufw status<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"firewalld-rhel-rocky-almalinux\"><strong>firewalld (RHEL\/Rocky\/AlmaLinux)<\/strong><\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo firewall-cmd --permanent --add-service=http\nsudo firewall-cmd --permanent --add-service=https\nsudo firewall-cmd --reload\nsudo firewall-cmd --list-all<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"get-and-install-a-lets-encrypt-certificate\"><strong>Get and Install a Let\u2019s Encrypt Certificate<\/strong><\/h2>\n\n\n\n<p>Use Certbot\u2019s web server plugins for a one\u2011command issuance and configuration. Replace example.com with your domain.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"nginx-http-01-automatic-config\"><strong>Nginx (HTTP\u201101, automatic config)<\/strong><\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo certbot --nginx -d example.com -d www.example.com<\/code><\/pre>\n\n\n\n<p>Certbot edits Nginx server blocks, adds SSL directives, reloads Nginx, and configures HTTP\u2192HTTPS redirection when you choose that option.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"apache-http-01-automatic-config\"><strong>Apache (HTTP\u201101, automatic config)<\/strong><\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo certbot --apache -d example.com -d www.example.com<\/code><\/pre>\n\n\n\n<p>Certbot updates your virtual host files, <a href=\"https:\/\/www.youstable.com\/blog\/how-to-enable-ssl-in-cpanel\/\">enables the SSL module<\/a> if needed, and reloads Apache. Choose to redirect HTTP to HTTPS when prompted.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"webroot-no-web-server-reloads-great-for-ci-cd\"><strong>Webroot (no web server reloads, great for CI\/CD)<\/strong><\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code># Ensure your webroot is correct; files must be publicly served at \/.well-known\/acme-challenge\/\nsudo certbot certonly --webroot -w \/var\/www\/example \\\n  -d example.com -d www.example.com<\/code><\/pre>\n\n\n\n<p>Point webroot to the directory serving your domain. You\u2019ll then add SSL directives manually to your web server\u2019s config using the issued paths.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"standalone-no-running-web-server-during-issuance\"><strong>Standalone (no running web server during issuance)<\/strong><\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code># Stop your web server to free port 80\/443 temporarily\nsudo systemctl stop nginx  # or apache2\/httpd\nsudo certbot certonly --standalone -d example.com\nsudo systemctl start nginx<\/code><\/pre>\n\n\n\n<p>Standalone is perfect for first\u2011time issuance on new hosts or automated scripts where the web server isn\u2019t ready yet.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"wildcard-and-multi-domain-ssl-dns-01-challenge\"><strong>Wildcard and Multi\u2011Domain SSL (DNS\u201101 Challenge)<\/strong><\/h2>\n\n\n\n<p>Wildcard certificates (*.example.com) require DNS\u201101. You can solve it manually by adding TXT records, or automate via DNS plugins (Cloudflare, Route 53, DigitalOcean, etc.).<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"manual-dns-works-with-any-dns-provider\"><strong>Manual DNS (works with any DNS provider)<\/strong><\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo certbot certonly --manual --preferred-challenges dns \\\n  -d example.com -d '*.example.com'<\/code><\/pre>\n\n\n\n<p>Certbot prompts you to create TXT records at _acme-challenge. Wait for <a href=\"https:\/\/www.youstable.com\/blog\/dns-propagation\/\">DNS propagation<\/a> before pressing Enter. Renewals require repeating this unless automated.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"automated-dns-cloudflare-example\"><strong>Automated DNS (Cloudflare example)<\/strong><\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code># Install the plugin (Snap auto-includes many; otherwise use pip)\n# Example with Cloudflare:\nsudo snap set certbot trust-plugin-with-root=ok\nsudo snap install certbot-dns-cloudflare\n\n# Create API credentials file with limited DNS edit scope:\necho \"dns_cloudflare_api_token = &lt;YOUR_TOKEN&gt;\" | sudo tee \/root\/.cloudflare.ini &gt;\/dev\/null\nsudo chmod 600 \/root\/.cloudflare.ini\n\n# Issue wildcard:\nsudo certbot certonly --dns-cloudflare --dns-cloudflare-credentials \/root\/.cloudflare.ini \\\n  -d example.com -d '*.example.com'<\/code><\/pre>\n\n\n\n<p>Use your provider\u2019s corresponding Certbot DNS plugin. This enables fully automated renewals for wildcards.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"add-confirm-web-server-ssl-configuration\"><strong>Add\/Confirm Web Server SSL Configuration<\/strong><\/h2>\n\n\n\n<p>If you used the <a href=\"https:\/\/www.youstable.com\/blog\/install-nginx-on-linux\/\">Nginx or Apache installer,<\/a> most of this is done. For webroot\/standalone, add these snippets with your domain and paths.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"nginx-minimal-secure-snippet-tls-1-2-1-3\"><strong>Nginx minimal secure snippet (TLS 1.2\/1.3)<\/strong><\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>server {\n  listen 443 ssl http2;\n  server_name example.com www.example.com;\n\n  ssl_certificate     \/etc\/letsencrypt\/live\/example.com\/fullchain.pem;\n  ssl_certificate_key \/etc\/letsencrypt\/live\/example.com\/privkey.pem;\n\n  ssl_protocols TLSv1.2 TLSv1.3;\n  ssl_prefer_server_ciphers off;\n  ssl_session_cache shared:SSL:10m;\n  add_header Strict-Transport-Security \"max-age=31536000; includeSubDomains\" always;\n\n  root \/var\/www\/example;\n  index index.html index.php;\n}\n\nserver {\n  listen 80;\n  server_name example.com www.example.com;\n  return 301 https:\/\/$host$request_uri;\n}<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"apache-minimal-secure-snippet\"><strong>Apache minimal secure snippet<\/strong><\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;VirtualHost *:443&gt;\n  ServerName example.com\n  ServerAlias www.example.com\n  DocumentRoot \/var\/www\/example\n\n  SSLEngine on\n  SSLCertificateFile \/etc\/letsencrypt\/live\/example.com\/fullchain.pem\n  SSLCertificateKeyFile \/etc\/letsencrypt\/live\/example.com\/privkey.pem\n\n  Header always set Strict-Transport-Security \"max-age=31536000; includeSubDomains\"\n  Protocols h2 http\/1.1\n&lt;\/VirtualHost&gt;\n\n&lt;VirtualHost *:80&gt;\n  ServerName example.com\n  ServerAlias www.example.com\n  Redirect permanent \/ https:\/\/example.com\/\n&lt;\/VirtualHost&gt;<\/code><\/pre>\n\n\n\n<p>Reload your server after changes: <code>sudo systemctl reload nginx<\/code> or <code>sudo systemctl reload apache2\/httpd<\/code>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"auto-renewal-and-health-checks\"><strong>Auto\u2011Renewal and Health Checks<\/strong><\/h2>\n\n\n\n<p>Snap installs a systemd timer for Certbot that checks twice daily and renews when 30 days remain. Confirm timers and dry\u2011run renewals.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># Confirm timer\nsystemctl list-timers | grep certbot\n\n# Dry-run test\nsudo certbot renew --dry-run<\/code><\/pre>\n\n\n\n<p>The web server is reloaded automatically by installer hooks. For custom setups, add a deploy hook:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo certbot renew --deploy-hook \"systemctl reload nginx\"<\/code><\/pre>\n\n\n\n<p>Monitor expiry via:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo openssl x509 -enddate -noout -in \/etc\/letsencrypt\/live\/example.com\/cert.pem<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"verification-and-testing\"><strong>Verification and Testing<\/strong><\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Browser test: Visit https:\/\/example.com and check the padlock.<\/li>\n\n\n\n<li>CLI test: <code>curl -I https:\/\/example.com<\/code> should return HTTP\/2 200 with a valid certificate chain.<\/li>\n\n\n\n<li>Deep test: Run your domain on SSL Labs Server Test for grade A or A+.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"troubleshooting-common-issues-2026\"><strong>Troubleshooting Common Issues (2026)<\/strong><\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Challenge failed (HTTP\u201101): Ensure DNS A\/AAAA points to this server. Confirm port 80 is open and not blocked by a proxy\/WAF. Disable maintenance redirects for <code>\/.well-known\/acme-challenge\/<\/code>.<\/li>\n\n\n\n<li>IPv6 mismatch: Your AAAA record must point to the same server serving HTTP\u201101. Otherwise, remove or correct it.<\/li>\n\n\n\n<li>Cloudflare\/CDN: For HTTP\u201101, temporarily set DNS to \u201cDNS only\u201d (grey cloud) or use the DNS\u201101 method instead.<\/li>\n\n\n\n<li>Rate limits: Avoid repeated requests. Use the Let\u2019s Encrypt staging endpoint (<code>--dry-run<\/code> or <code>--test-cert<\/code>) during testing.<\/li>\n\n\n\n<li>File permissions: Private keys in <code>\/etc\/letsencrypt\/live\/<\/code> should be root-owned. Don\u2019t change to world\u2011readable.<\/li>\n\n\n\n<li>Mixed content: Update site URLs, scripts, and <a href=\"https:\/\/www.youstable.com\/blog\/redirect-http-to-https\/\">images to HTTPS<\/a> to prevent padlock warnings.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"best-practices-for-production\"><strong>Best Practices for Production<\/strong><\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Enforce HTTPS and enable HSTS after confirming all assets work over HTTPS.<\/li>\n\n\n\n<li>Keep Certbot updated (Snap refreshes automatically). Review renewal logs in <code>\/var\/log\/letsencrypt\/<\/code>.<\/li>\n\n\n\n<li>Use DNS\u201101 for wildcards and autoscale environments behind load balancers.<\/li>\n\n\n\n<li>Store infrastructure\u2011as\u2011code: version your Nginx\/Apache configs and renewal hooks.<\/li>\n\n\n\n<li>Back up <code>\/etc\/letsencrypt\/<\/code> and your web server config. Never expose private keys publicly.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"when-to-consider-a-paid-ssl-instead\"><strong>When to Consider a Paid SSL Instead<\/strong><\/h2>\n\n\n\n<p>Let\u2019s Encrypt provides domain\u2011validated SSL, perfect for most websites and apps. Consider a paid OV\/EV certificate if you need organization validation, private trust chains, or strict vendor requirements (some legacy environments, embedded\/IoT, or compliance frameworks). If you host with YouStable, our team can help you choose the right SSL and deploy it end\u2011to\u2011end.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"why-host-with-youstable\"><strong>Why Host with YouStable<\/strong><\/h2>\n\n\n\n<p>On YouStable\u2019s Linux VPS and Dedicated Servers, Let\u2019s Encrypt is seamless: one\u2011click provisioning on supported stacks, optimized firewalls, HTTP\/2\/3 enabled, and 24\/7 experts to troubleshoot renewals, DNS\u201101 automation, or reverse proxy edge cases. Focus on growth while we keep your <a href=\"https:\/\/www.youstable.com\/blog\/install-and-renew-ssl-certificates\/\">SSL fast, secure<\/a>, and up\u2011to\u2011date.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"faqs-configure-lets-encrypt-on-linux-2026\"><strong>FAQs: Configure Let\u2019s Encrypt on Linux (2026)<\/strong><\/h2>\n\n\n\t\t<section\t\thelp class=\"sc_fs_faq sc_card    \"\n\t\t\t\t>\n\t\t\t\t<h3 id=\"is-lets-encrypt-really-free-and-secure\">Is Let\u2019s Encrypt really free and secure?<\/h3>\t\t\t\t<div>\n\t\t\t\t\t\t<div class=\"sc_fs_faq__content\">\n\t\t\t\t\n\n<p>Yes. Let\u2019s Encrypt is a free, automated, and open certificate authority trusted by all <a href=\"https:\/\/www.youstable.com\/blog\/how-to-clear-cache-in-browser\/\">major browsers<\/a>. It issues domain\u2011validated certificates using the ACME protocol with robust security controls. The certificates are as cryptographically strong as paid DV certificates.<\/p>\n\n\t\t\t<\/div>\n\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section\t\thelp class=\"sc_fs_faq sc_card    \"\n\t\t\t\t>\n\t\t\t\t<h3 id=\"how-do-i-auto-renew-lets-encrypt-certificates\">How do I auto\u2011renew Let\u2019s Encrypt certificates?<\/h3>\t\t\t\t<div>\n\t\t\t\t\t\t<div class=\"sc_fs_faq__content\">\n\t\t\t\t\n\n<p>When installed via Snap, Certbot sets a systemd timer to renew twice daily and reload your web server. Verify with <code>systemctl list-timers | grep certbot<\/code> and test <code>sudo certbot renew --dry-run<\/code>. For custom setups, add a deploy hook to reload Nginx\/Apache after renewal.<\/p>\n\n\t\t\t<\/div>\n\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section\t\thelp class=\"sc_fs_faq sc_card    \"\n\t\t\t\t>\n\t\t\t\t<h3 id=\"whats-the-difference-between-http-01-and-dns-01-challenges\">What\u2019s the difference between HTTP\u201101 and DNS\u201101 challenges?<\/h3>\t\t\t\t<div>\n\t\t\t\t\t\t<div class=\"sc_fs_faq__content\">\n\t\t\t\t\n\n<p>HTTP\u201101 proves control by serving a token over HTTP at your domain\u2014simple and automatic for single hosts. DNS\u201101 proves control by adding a TXT record\u2014required for wildcards, multi\u2011region, or when HTTP is blocked. DNS\u201101 can be fully automated using provider plugins.<\/p>\n\n\t\t\t<\/div>\n\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section\t\thelp class=\"sc_fs_faq sc_card    \"\n\t\t\t\t>\n\t\t\t\t<h3 id=\"how-do-i-get-a-wildcard-ssl-certificate\">How do I get a wildcard SSL certificate?<\/h3>\t\t\t\t<div>\n\t\t\t\t\t\t<div class=\"sc_fs_faq__content\">\n\t\t\t\t\n\n<p>Use the DNS\u201101 challenge: <code>certbot certonly --manual --preferred-challenges dns -d example.com -d '*.example.com'<\/code>, or automate with a DNS plugin (e.g., Cloudflare, Route 53). Point your DNS API token to Certbot and renewals run hands\u2011free.<\/p>\n\n\t\t\t<\/div>\n\t\t<\/div>\n\t\t<\/section>\n\t\t\n<script type=\"application\/ld+json\">\n\t{\n\t\t\"@context\": \"https:\/\/schema.org\",\n\t\t\"@type\": \"FAQPage\",\n\t\t\"mainEntity\": [\n\t\t\t\t\t{\n\t\t\t\t\"@type\": \"Question\",\n\t\t\t\t\"name\": \"Is Let\u2019s Encrypt really free and secure?\",\n\t\t\t\t\"acceptedAnswer\": {\n\t\t\t\t\t\"@type\": \"Answer\",\n\t\t\t\t\t\"text\": \"<p>Yes. Let\u2019s Encrypt is a free, automated, and open certificate authority trusted by all <a>major browsers<\/a>. It issues domain\u2011validated certificates using the ACME protocol with robust security controls. The certificates are as cryptographically strong as paid DV certificates.<\/p>\"\n\t\t\t\t\t\t\t\t\t}\n\t\t\t}\n\t\t\t,\t\t\t\t{\n\t\t\t\t\"@type\": \"Question\",\n\t\t\t\t\"name\": \"How do I auto\u2011renew Let\u2019s Encrypt certificates?\",\n\t\t\t\t\"acceptedAnswer\": {\n\t\t\t\t\t\"@type\": \"Answer\",\n\t\t\t\t\t\"text\": \"<p>When installed via Snap, Certbot sets a systemd timer to renew twice daily and reload your web server. Verify with systemctl list-timers | grep certbot and test sudo certbot renew --dry-run. For custom setups, add a deploy hook to reload Nginx\/Apache after renewal.<\/p>\"\n\t\t\t\t\t\t\t\t\t}\n\t\t\t}\n\t\t\t,\t\t\t\t{\n\t\t\t\t\"@type\": \"Question\",\n\t\t\t\t\"name\": \"What\u2019s the difference between HTTP\u201101 and DNS\u201101 challenges?\",\n\t\t\t\t\"acceptedAnswer\": {\n\t\t\t\t\t\"@type\": \"Answer\",\n\t\t\t\t\t\"text\": \"<p>HTTP\u201101 proves control by serving a token over HTTP at your domain\u2014simple and automatic for single hosts. DNS\u201101 proves control by adding a TXT record\u2014required for wildcards, multi\u2011region, or when HTTP is blocked. DNS\u201101 can be fully automated using provider plugins.<\/p>\"\n\t\t\t\t\t\t\t\t\t}\n\t\t\t}\n\t\t\t,\t\t\t\t{\n\t\t\t\t\"@type\": \"Question\",\n\t\t\t\t\"name\": \"How do I get a wildcard SSL certificate?\",\n\t\t\t\t\"acceptedAnswer\": {\n\t\t\t\t\t\"@type\": \"Answer\",\n\t\t\t\t\t\"text\": \"<p>Use the DNS\u201101 challenge: certbot certonly --manual --preferred-challenges dns -d example.com -d '*.example.com', or automate with a DNS plugin (e.g., Cloudflare, Route 53). Point your DNS API token to Certbot and renewals run hands\u2011free.<\/p>\"\n\t\t\t\t\t\t\t\t\t}\n\t\t\t}\n\t\t\t\t\t\t]\n\t}\n<\/script>\n\n\n\n<h2 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"why-does-my-http-01-challenge-fail-even-though-dns-looks-correct\"><strong>Why does my HTTP\u201101 challenge fail even though DNS looks correct?<\/strong><\/h2>\n\n\n\n<p>Common causes include port 80 blocked by a firewall, AAAA (IPv6) pointing elsewhere, CDN proxies interfering, or rewrites redirecting ACME paths. Ensure <code>\/.well-known\/acme-challenge\/<\/code> is served without auth\/redirects and that both A and AAAA records target your issuing server.<\/p>\n\n\n\n<p>With these steps, you can confidently configure Let\u2019s Encrypt on any <a href=\"https:\/\/www.youstable.com\/blog\/install-mongodb-on-linux\/\">Linux server<\/a> and maintain strong, automated HTTPS in 2026 and beyond. If you\u2019d like expert\u2011led setup and monitoring, YouStable\u2019s engineers can handle it for you.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>To configure Let\u2019s Encrypt on a Linux server in 2026, install Certbot, open ports 80\/443, and run a one-command installer [&hellip;]<\/p>\n","protected":false},"author":13,"featured_media":12980,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"inline_featured_image":false,"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"iawp_total_views":3,"footnotes":""},"categories":[350],"tags":[2145,2146,2141],"class_list":["post-12813","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-knowledgebase","tag-configure-lets-encrypt-on-linux","tag-how-to-configure-lets-encrypt-on-linux","tag-linux-server"],"acf":[],"featured_image_src":"https:\/\/www.youstable.com\/blog\/wp-content\/uploads\/2025\/12\/How-to-Configure-Lets-Encrypt-on-Linux-Server.jpg","author_info":{"display_name":"Prahlad Prajapati","author_link":"https:\/\/www.youstable.com\/blog\/author\/prahladblog"},"_links":{"self":[{"href":"https:\/\/www.youstable.com\/blog\/wp-json\/wp\/v2\/posts\/12813","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.youstable.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.youstable.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.youstable.com\/blog\/wp-json\/wp\/v2\/users\/13"}],"replies":[{"embeddable":true,"href":"https:\/\/www.youstable.com\/blog\/wp-json\/wp\/v2\/comments?post=12813"}],"version-history":[{"count":2,"href":"https:\/\/www.youstable.com\/blog\/wp-json\/wp\/v2\/posts\/12813\/revisions"}],"predecessor-version":[{"id":12965,"href":"https:\/\/www.youstable.com\/blog\/wp-json\/wp\/v2\/posts\/12813\/revisions\/12965"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.youstable.com\/blog\/wp-json\/wp\/v2\/media\/12980"}],"wp:attachment":[{"href":"https:\/\/www.youstable.com\/blog\/wp-json\/wp\/v2\/media?parent=12813"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.youstable.com\/blog\/wp-json\/wp\/v2\/categories?post=12813"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.youstable.com\/blog\/wp-json\/wp\/v2\/tags?post=12813"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}