Make HTTPS a maintained service

For a real server, ensure the hostname resolves to the correct destination and the web service responds. The HTTP-01 challenge needs the challenge path reachable on port 80. DNS-01 can support other arrangements and wildcard names, but requires safely managed DNS access.

Choose the web server and operating system on the official Certbot instructions page. Install through the documented method for that combination. Avoid mixing package and snap installations or assuming the OmbraHost website has already installed a certificate on a remote server.

The Nginx example below runs on a system with Certbot’s matching Nginx integration installed. Replace the documentation domain with names you control. Review the generated configuration and validate Nginx before applying additional edits.

sudo certbot --nginx -d example.com -d www.example.com
sudo nginx -t

Check the certificate list, scheduled renewal mechanism and challenge reachability. A dry run exercises renewal with the test environment. DNS credentials, proxy changes or a closed port can break a renewal that previously worked.

sudo certbot certificates
sudo certbot renew --dry-run
# Inspect the timer used by your installation method:
systemctl list-timers --all

Test the public hostname from outside the server, inspect expiry and keep an alert before the deadline. If a proxy uses an origin certificate, inspect that connection separately from its visitor-facing certificate. Make sure application redirects and cookies use the intended secure origin.