Let’s Encrypt certificates without exposing port 80 and 443, trough DNS record

Instructions on SSH end

Replace yourdomain.org with your actual domain.

• sudo -s
• apt install -y certbot
• certbot --manual --preferred-challenges dns certonly --elliptic-curve secp384r1 -d yourdomain.org

Follow the console instruction and give GoDaddy or whatever you use your TXT record with the provided data.

Hit enter.

Certificates are stored here

• Certificate is saved at: /etc/letsencrypt/live/yourdomain.org/fullchain.pem
• Key is saved at: /etc/letsencrypt/live/yourdomain.org/privkey.pem

Cert paths

• CERT: /etc/letsencrypt/live/yourdomain.org//cert.pem
• CHAIN: /etc/letsencrypt/live/yourdomain.org//chain.pem
• FULLCHAIN: /etc/letsencrypt/live/yourdomain.org//fullchain.pem
• PRIVKey: /etc/letsencrypt/live/yourdomain.org//privkey.pem

Add cron job for renewable process and restart Nginx

• crontab -e
• #@weekly /usr/bin/certbot renew > /dev/null 2>&1
• @weekly /usr/bin/certbot renew --renew-hook 'systemctl restart nginx.service' > /dev/null 2>&1

Adjust Renewable procedure - only one single time needed

• nano /etc/letsencrypt/renewal/yourdomain.org.conf
• authenticator = standalone

Start timers and verify the status to ensure its running

• systemctl enable certbot.timer
• systemctl restart certbot.timer
• systemctl status certbot.timer

Logs

• /var/log/letsencrypt/letsencrypt.log

Delete old certificates if not needed anymore

• certbot delete

Close ufw ports

You can remove Port 80, 443 is usually needed anyway for e.g. Nextcloud or whatever you use.