Install Let's Encrypt SSL with Certbot (Nginx) on Debian 12

Step 1 – Install Certbot + Nginx plugin

apt update && apt upgrade -y
apt install -y certbot python3-certbot-nginx

Step 2 – Obtain certificate

certbot --nginx -d example.com -d www.example.com

Certbot modifies Nginx config and optionally redirects HTTP to HTTPS.

Step 3 – Test renewal

certbot renew --dry-run

Step 4 – Auto-renewal cron

0 3 * * * certbot renew --quiet --deploy-hook "systemctl reload nginx"

Step 5 – Check expiry

certbot certificates
openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -dates