Skip to content
// LINUX | October 1, 2026 | 5 min read

Install Nginx on Ubuntu Server with free SSL in 5 steps

How to install Nginx on Ubuntu Server with HTTPS Install Nginx on Ubuntu Server or Debian and add a free SSL certificate in about 15 minutes.

Install Nginx on Ubuntu Server with free SSL in 5 steps
M
Mustafa Aslan Hostner Team

How to install Nginx on Ubuntu Server with HTTPS

Install Nginx on Ubuntu Server or Debian and add a free SSL certificate in about 15 minutes. At the end, your site runs on HTTPS with a certificate that renews by itself.

This guide starts where Secure Ubuntu Server and Debian in 5 steps ends: you have your own user with sudo rights, and UFW is on.

Before you start

  • A server with Ubuntu Server or Debian
  • A user with sudo rights, and UFW turned on
  • A domain name, and access to its DNS settings at your registrar
  • About 15 minutes

In this guide, the domain is example.com. Replace it with your own domain everywhere.

Step 1: Install Nginx

Nginx is a fast and light web server. Install it, and check that it runs:

terminal
~ $ sudo apt update && sudo apt install nginx -y
~ $ systemctl status nginx

You see active (running). Press q to leave the status screen.

Step 2: Open the firewall

Allow web traffic through UFW. The Nginx Full profile opens port 80 (HTTP) and port 443 (HTTPS):

terminal
~ $ sudo ufw allow 'Nginx Full'
~ $ sudo ufw status

The status now shows Nginx Full ALLOW Anywhere, next to OpenSSH.

Step 3: Point your domain to your server

Log in at your domain registrar and add two A records:

TypeNameValue
Aexample.com (or @)your-server-ip
Awwwyour-server-ip

Check it from your server or your own computer:

terminal
~ $ dig +short example.com

You see the IP address of your server. DNS changes can take a while, from a few minutes up to a few hours. Wait until this works before step 5, because Let’s Encrypt checks your domain.

Step 4: Add your site

Make a folder for your site, with a simple test page:

terminal
~ $ sudo mkdir -p /var/www/example.com
~ $ echo '<h1>It works</h1>' | sudo tee /var/www/example.com/index.html

Make a config file for your site:

terminal
~ $ sudo nano /etc/nginx/sites-available/example.com

Paste this server block:

nginx
server {
    listen 80;
    listen [::]:80;
    server_name example.com www.example.com;

    root /var/www/example.com;
    index index.html;

    location / {
        try_files $uri $uri/ =404;
    }
}

Save with Ctrl+O, Enter, and close with Ctrl+X. Then link the config, test it, and reload Nginx:

terminal
~ $ cd /etc/nginx/sites-enabled
~ $ sudo ln -s ../sites-available/example.com .
~ $ sudo nginx -t && sudo systemctl reload nginx

nginx -t shows syntax is ok and test is successful. Open http://example.com in your browser: you see “It works”.

Step 5: Turn on HTTPS with Let’s Encrypt

Let’s Encrypt gives free SSL certificates. Certbot gets the certificate and changes your Nginx config for you:

terminal
~ $ sudo apt install certbot python3-certbot-nginx
~ $ sudo certbot --nginx -d example.com -d www.example.com

Certbot asks for your email address, for renewal notices, and asks you to accept the terms. When it is done, open https://example.com. You see the lock icon in your browser.

Certbot also sends all HTTP traffic to HTTPS. Visitors who type http:// land on the secure version.

Bonus: Test auto-renewal

Let’s Encrypt certificates last 90 days. Certbot renews them for you, with a timer that runs twice a day. Test it once:

terminal
~ $ sudo certbot renew --dry-run

If the dry run succeeds, renewal works. You can check the timer with systemctl list-timers | grep certbot.

Troubleshooting

ProblemLikely causeFix
Browser shows the default “Welcome to nginx” pageYour site config is not linked, or the default site winsCheck the link in /etc/nginx/sites-enabled/. Remove the default with sudo rm /etc/nginx/sites-enabled/default and reload Nginx
nginx -t gives an errorTypo in the server block, often a missing ;Read the line number in the error, fix it, and test again
Certbot fails with a DNS or challenge errorDNS still points elsewhere, or port 80 is closedCheck dig +short example.com and sudo ufw status
Site loads, but HTTPS shows a warningThe certificate covers only one nameRun Certbot again with both -d example.com -d www.example.com
Locked out of SSHFirewall or SSH settingUse the KVM console in your client area

FAQ

Yes. All commands in this guide work on current versions of Ubuntu Server and Debian.

Yes. Let’s Encrypt is a non-profit certificate authority. Browsers trust its certificates in the same way as paid ones.

Certbot renews it for you before the 90 days are over. Test it once with sudo certbot renew --dry-run.

Yes. Repeat step 3 to 5 for each domain, with its own folder and server block.

Both work well. Nginx uses less memory and handles many visitors at once, which makes it a common choice for new servers.

Quick checklist

  • Nginx installed and running
  • UFW allows Nginx Full
  • A records for example.com and www point to your server
  • Server block linked, nginx -t passes
  • HTTPS works, with the lock icon in your browser
  • certbot renew --dry-run succeeds

Need a server for your site? Dedicated servers from €49.99 a month, with root access and a KVM console.

M

Mustafa Aslan

The Hostner team writes about servers, Linux, security, and everything that comes with running your own infrastructure. No fluff — just things that are actually useful.

// RELATED ARTICLES