Overview

Let's Encrypt issues free, trusted TLS certificates that enable HTTPS on your site. Certbot automates issuance and renewal and works with Apache, Nginx and standalone web servers. This article shows how to get a certificate on an ALYPOD CPU Pod and set up automatic renewal.

Before you begin

• A domain or subdomain with a DNS record pointing to your Pod's public IP.
• Apache or Nginx installed, with the site already configured on port 80.
• Ports 80 (and optionally 443) reachable from the internet through the ALYPOD firewall.

Steps

1. Install Certbot and the web-server plugin:

```bash

Debian / Ubuntu

sudo apt update sudo apt install -y certbot python3-certbot-nginx

or python3-certbot-apache

RHEL / AlmaLinux / Rocky

sudo dnf install -y certbot python3-certbot-nginx ```

1. Obtain and install the certificate. Certbot edits your web server config and reloads it:

```bash

Nginx

sudo certbot --nginx -d example.com -d www.example.com

Apache

sudo certbot --apache -d example.com -d www.example.com ```

1. When prompted, choose whether to redirect HTTP to HTTPS (recommended). Provide an email for expiry notices and agree to the terms.

2. Verify HTTPS works:

bash curl -I https://example.com

1. Confirm that renewal is scheduled. Certbot installs a systemd timer or cron job:

bash systemctl list-timers | grep certbot sudo certbot renew --dry-run

1. If you use an external reverse proxy or no web server, use the standalone or webroot method instead:

bash sudo certbot certonly --standalone -d example.com sudo certbot certonly --webroot -w /var/www/example.com/html -d example.com

Troubleshooting

• Problem: "Challenge failed" / domain not reachable. Solution: Ensure DNS resolves to the Pod and nothing blocks port 80; the HTTP-01 challenge needs it open.
• Problem: Renewal fails silently. Solution: Check sudo certbot renew --dry-run and /var/log/letsencrypt/letsencrypt.log.
• Problem: Rate limit hit after repeated attempts. Solution: Let's Encrypt limits duplicate certificates per domain; wait or use the staging endpoint with --staging.

Related articles

• [Installing the Apache web server]
• [Installing the Nginx web server]
• [Securing WordPress]