Example: Certbot with NGINX using HTTP-01 Domain Validation

Linux / NGINX — This guide shows how to obtain and install a certificate with Certbot using HTTP-01 validation and your GeoCerts ACME Directory URL.

GeoCerts recommends the DigiCert ACME Client for new deployments. Use this page if you already rely on Certbot. For the DAC walkthrough on the same stack, see NGINX with HTTP-01 (Linux).

Acronyms used on this guide

Prerequisites

Before you begin, make sure you have:

• An ACME Directory URL with its EAB Key ID and EAB HMAC Key—sandbox or production (sandbox is fine for experimentation).
• NGINX installed and running with a server block for the domain you are securing.
• Certbot installed with the NGINX plugin (python3-certbot-nginx on Debian/Ubuntu).
• The domain’s A record points at this host and port 80 is publicly reachable from multiple regions worldwide under MPIC requirements.
• Root or sudo access to the server.

Step 1: Install Certbot NGINX Plugin

# Install Certbot NGINX plugin (Debian/Ubuntu)
sudo apt install python3-certbot-nginx

Step 2: Configure NGINX for HTTP-01 Validation

Certbot can configure NGINX for HTTP-01 validation automatically, but your site must already have a working HTTP server block—for example:

# Example HTTP server block for HTTP-01 (replace yourdomain.com)
server {
    listen 80;
    server_name yourdomain.com www.yourdomain.com;

    location / {
        root /var/www/html;
        index index.html;
    }
}

Step 3: Run Certbot with NGINX Plugin

Map your CertCommand credentials to Certbot’s EAB flags and ACME server URL:

# Request and install certificate via GeoCerts ACME Directory URL (replace placeholders)
sudo certbot --nginx \
    --server "https://one.digicert.com/mpki/api/v1/acme/v2/directory" \
    --eab-kid "YOUR_EAB_KEY_ID" \
    --eab-hmac-key "YOUR_EAB_HMAC_KEY" \
    -d "yourdomain.com" \
    -d "www.yourdomain.com"

Replace YOUR_EAB_KEY_ID, YOUR_EAB_HMAC_KEY, and yourdomain.com with your actual values. Use your sandbox directory URL in --server when experimenting (not billed); use your production URL when you are ready for billable certificates. If you omit --server, Certbot defaults to Let’s Encrypt—not GeoCerts/DigiCert.

Sample terminal output:

Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator nginx, Installer nginx
Registering without email!

Obtaining a new certificate
Performing the following challenges:
http-01 challenge for yourdomain.com
Waiting for verification...
Cleaning up challenges
Deploying Certificate to VirtualHost /etc/nginx/sites-enabled/yourdomain.com

Successfully received certificate.
Certificate saved at:
  /etc/letsencrypt/live/yourdomain.com/fullchain.pem
Key saved at:
  /etc/letsencrypt/live/yourdomain.com/privkey.pem
This certificate expires on YYYY-MM-DD.
Certbot has configured automatic renewal.

After a successful run, confirm the new order in CertCommand under Certificates > Orders (order ID, domain, status, and expiration).

Step 4: Verify NGINX Configuration

Certbot typically:

1. Obtains the certificate
2. Configures NGINX to use it
3. Sets up HTTP-to-HTTPS redirects
4. Registers automatic renewal (Certbot’s default is roughly 30 days before expiration)

Verify and reload NGINX:

# Verify NGINX configuration, then reload
sudo nginx -t
sudo systemctl reload nginx

Step 5: Test HTTPS Access

Visit your domain with https:// and confirm the certificate loads without errors. The issuer should be DigiCert, GeoTrust, or Thawte.

Automatic Renewal

Certbot installs a systemd timer that attempts renewal before certificates expire:

# Confirm Certbot automatic renewal timer is active
sudo systemctl status certbot.timer

Troubleshooting

Common issues:

1. Port 80 blocked — HTTP-01 requires public reachability on port 80 from multiple regions (MPIC).
2. NGINX configuration errors — Run sudo nginx -t before and after Certbot changes.
3. Wrong ACME server — Confirm --server points at your DigiCert directory URL, not Let’s Encrypt.
4. EAB credentials — Key ID and HMAC must match the ACME Directory URL in CertCommand. Lost credentials cannot be recovered; create a new URL.

For EAB, DCV, and installation diagnosis patterns (applicable across clients), see Verify and Diagnose ACME Requests. For unexpected new orders on renewal, see Troubleshooting — Unexpected new orders.

Related topics

• Alternative ACME Clients — Hub and Win-ACME example
• NGINX with HTTP-01 (Linux) — DAC production walkthrough
• Create an ACME Directory URL — EAB credential mapping across clients
• Certbot documentation — Opens on another site (certbot.eff.org)

← Back to Alternative ACME Clients