Free HTTPS for Any Site: Let’s Encrypt + Certbot, Set and Forget

HTTPS used to mean paying a certificate authority every year and renewing by hand. Now it’s free and automatic: Let’s Encrypt issues the certificate, Certbot installs and renews it, and after a one-time setup you never think about it again.

For years, HTTPS was gated behind paid certificates and annual manual renewals. Let’s Encrypt and Certbot removed both the cost and the toil, which is why encrypted connections are now the default across the web — and why there’s no reason for any site to run on plain HTTP.

Let’s Encrypt: the free certificate authority

Let’s Encrypt is a nonprofit certificate authority that issues SSL/TLS certificates for free, so any site can serve HTTPS. What matters in practice:

• Free, domain-validated certificates — no cost, available to sites of any size.
• Automated issuance — designed to be requested and renewed by software, not a manual purchase.
• Wildcard certificates — secure a domain and all its subdomains with one certificate.
• 90-day validity — deliberately short, which pushes everyone toward automated renewal (below).

The short lifetime worries people new to it, but it’s the point: short-lived certificates limit the damage of a leaked key and force the renewal to be automatic, which is more reliable than a yearly reminder.

Certbot: the tool that does the work

Certbot, from the Electronic Frontier Foundation, is the open-source client that talks to Let’s Encrypt for you. It obtains the certificate, installs it into your web server config, and sets up automatic renewal — for Apache, Nginx and most stacks. On a typical Linux server:

# Install Certbot (example: Debian/Ubuntu with Nginx)
sudo apt install certbot python3-certbot-nginx

# Obtain + install a certificate and configure HTTPS in one step
sudo certbot --nginx -d example.com -d www.example.com

# Certbot installs a systemd timer / cron job; confirm auto-renewal works:
sudo certbot renew --dry-run
Code language: Bash (bash)

Many managed hosts and control panels ship Certbot (or their own Let’s Encrypt integration) built in, so enabling HTTPS can be a single toggle — no shell required.

A 90-day certificate isn’t a chore — it’s what makes renewal automatic, and automatic is what makes it reliable.

Set it up once, then forget it

The whole point is that HTTPS stops being a recurring task:

1. Install Certbot (or enable your host’s Let’s Encrypt integration).
2. Run it once to obtain and install the certificate.
3. Confirm auto-renewal with certbot renew --dry-run — after that, Certbot’s timer renews the certificate well before each 90-day expiry, automatically.

Then verify the result. Load your site over https://, confirm the padlock, and check that HTTP redirects to HTTPS — the same things a modern web-protocol check looks for. If a check fails (mixed content, HSTS, a stale redirect), the fix-the-protocol-check guide walks through each gap.

Set HTTPS up once and it maintains itself — the failure mode isn’t renewal, it’s forgetting to set up auto-renewal.

The short version

Free HTTPS is two tools: Let’s Encrypt, a free automated certificate authority that issues 90-day SSL/TLS certificates, and Certbot (EFF), the client that obtains, installs, and auto-renews them on your server. Install Certbot, run it once (certbot --nginx -d yourdomain), and confirm renewal with certbot renew --dry-run — its timer then keeps the certificate valid indefinitely. Many hosts bundle this as a one-click option. The short 90-day validity is deliberate and harmless because renewal is automatic; verify with a padlock check and an HTTP→HTTPS redirect test.

Frequently Asked Questions

Is Let’s Encrypt really free?

Yes, completely. Let’s Encrypt is a nonprofit certificate authority (backed by the Internet Security Research Group) that issues domain-validated SSL/TLS certificates at no cost, so any site can run HTTPS. There’s no paid tier for the certificate itself.

Why do Let’s Encrypt certificates last only 90 days?

By design. Short-lived certificates limit the damage if a private key is ever compromised and force renewal to be automated rather than a yearly manual task. With Certbot’s auto-renewal, the 90-day cycle is invisible to you.

What does Certbot actually do?

Certbot is the client that automates everything: it requests the certificate from Let’s Encrypt, installs it into your web server (Apache, Nginx and others), configures HTTPS, and sets up a timer to renew the certificate automatically before it expires.

Do I need command-line access to use it?

Not always. On a server you run Certbot from the shell, but many managed hosts and control panels include a built-in Let’s Encrypt / Certbot integration, so enabling HTTPS is a single toggle with no terminal involved.

How do I know HTTPS is working after setup?

Load your site over https:// and check for the padlock, confirm that plain http:// redirects to HTTPS, and run it through a protocol/SSL check. Also run certbot renew --dry-run once to confirm automatic renewal is configured — that’s the step people forget.