How do I get a free Let's Encrypt SSL certificate for Nginx with Certbot and make sure it renews?

Prerequisites: the domain's A (and AAAA if used) record points to the server, ports 80 and 443 are open in the firewall, and an Nginx server block with the matching server_name exists.

Install (snap, recommended by the Certbot project)

sudo snap install --classic certbot
sudo ln -s /snap/bin/certbot /usr/bin/certbot
sudo certbot --nginx -d example.com -d www.example.com

Certbot edits the server block, adds the certificate paths and an HTTP to HTTPS redirect. Choose to redirect when asked.

Renewal. Certificates last 90 days. The package installs a systemd timer (or cron job) that runs twice daily. Verify:

systemctl list-timers | grep certbot
sudo certbot renew --dry-run

A successful dry run means real renewal will work. Certbot only renews certificates within about 30 days of expiry.

Reload after renewal so Nginx uses the new file. The nginx plugin handles it; for the certonly mode add a hook:

sudo certbot renew --deploy-hook "systemctl reload nginx"

Common problems

• "Timeout during connect" or "Invalid response": port 80 blocked, wrong DNS, or the domain behind a CDN proxy returning something else.
• Rate limits: issuing duplicate certificates and repeated failed validations are both capped (see the Let's Encrypt rate-limit page for current numbers); test with --staging.
• Wildcard (*.example.com) needs DNS-01 validation with a DNS plugin or manual TXT records, not HTTP-01.
• Several sites on one server: run Certbot per domain, or list all names in one certificate.

Check expiry anytime: sudo certbot certificates, or use the DNS and SSL header checker from the outside.