Overview

A TLS certificate encrypts traffic between your visitors and your Pod and enables HTTPS. This article shows how to issue a free certificate from Let's Encrypt with Certbot and renew it automatically.

Before you begin

• A domain (or subdomain) with a DNS A/AAAA record pointing to your Pod's IP.
• Root or sudo access, and a web server such as Nginx or Apache already serving the site on port 80.
• Ports 80 and 443 open in your firewall.

Steps

1. Install Certbot and its web-server plugin:

```bash sudo apt install certbot python3-certbot-nginx

or, for Apache:

sudo apt install certbot python3-certbot-apache ```

1. Issue a certificate and let Certbot configure HTTPS automatically:

```bash sudo certbot --nginx -d example.com -d www.example.com

or

sudo certbot --apache -d example.com -d www.example.com ```

1. When prompted, choose to redirect HTTP to HTTPS so visitors always use the secure version.

2. Verify automatic renewal is scheduled. Certbot installs a systemd timer:

bash systemctl list-timers | grep certbot sudo certbot renew --dry-run

1. Reload your web server after renewal — Certbot handles this via a deploy hook, but you can test manually:

bash sudo nginx -t && sudo systemctl reload nginx

Troubleshooting

• Problem: The challenge fails with a connection error. Solution: Confirm DNS points to the Pod, port 80 is reachable, and no firewall or CDN is blocking the validation request.
• Problem: Mixed-content warnings. Solution: Update hard-coded http:// links in your site to https:// or protocol-relative URLs.
• Problem: Certificate not renewing. Solution: Run sudo certbot renew --dry-run and fix any reported errors; certificates expire after 90 days.

Related articles

• [Understanding the GDPR and your data]
• [DNS changes are not propagating]
• [Security best practices for your Pod]