TLS certificates let browsers verify they are talking to the correct domain and encrypt traffic. Let’s Encrypt provides free certificates, and Certbot automates issuance and renewal.
DNS must already point to the server before HTTP validation can succeed.
Certificate renewal usually runs through a system timer. Always test renewal after setup.
Further Learning
“Certbot nginx Ubuntu” — install flow
“Let’s Encrypt HTTP challenge” — validation model
“certbot renew dry run” — renewal testing
TLS with Certbot
That little padlock in the address bar (HTTPS) needs a TLS certificate to work. Certbot is a free tool that gets you one automatically (from Let’s Encrypt) and keeps it renewed — no manual paperwork required.
That’s it. Certbot talks to Let’s Encrypt, proves you control the domain, gets a certificate, and even configures Nginx to use it — including setting up the HTTP→HTTPS redirect automatically.
TIP
Your domain’s DNS must already point at your server before running this — Certbot needs to reach your server through the real domain to prove you own it.
Certificates expire — make sure renewal works
Certificates need periodic renewal (usually every ~90 days for Let’s Encrypt). Certbot sets up automatic renewal, but you should verify it actually works:
sudo certbot renew --dry-run
This simulates a renewal without actually changing anything — a safe way to confirm it’ll work when the real renewal time comes.
In one sentence
Certbot automatically gets you a free TLS certificate (for the HTTPS padlock) from Let’s Encrypt and configures your server to use and renew it — just make sure DNS is pointed at your server first, and test renewal with --dry-run.
Want to go deeper?
Switch to Expert mode above for how the domain validation process works under the hood.