How do I obtain a certificate with Certbot’s webroot method?
The webroot method places ACME challenge files under an existing HTTP document root. It is suitable when the domain already reaches the intended website and the challenge path can be served publicly. The certonly command obtains certificate files but does not automatically configure the site to use them.
Before you start
- Control of the domain and authority to request its certificate.
- Correct public DNS and reachable TCP port 80.
- The real document root for the requested hostname.
Instructions
1. Check the existing HTTP route
Confirm that the intended hostname reaches the correct webroot and that access rules permit the ACME challenge path. With multiple frontends, the challenge must be available wherever validation can arrive.
curl --head --connect-timeout 5 --max-time 15 http://app.example.com/Performs an initial HTTP routing check; it does not itself prove the challenge path is valid.
2. Request the certificate for that webroot
Replace the path and domain with verified values. Follow the account and agreement prompts appropriate to the certificate owner; do not request a certificate for a domain you do not control.
sudo certbot certonly --webroot -w /var/www/app/public -d app.example.comWrites challenge and certificate state for this requested domain without automatic web-server installation.
3. Configure the intended TLS site
Use the resulting certificate paths in the approved virtual-host change, validate that server configuration, and reload through its existing service manager. Then verify the live certificate and the renewal schedule.
Check the result
- Certbot reports successful issuance for the intended domain and a subsequent HTTPS test confirms the correct live certificate.
Troubleshooting
- Challenge file returns 404
- Recheck the actual webroot, redirects and proxy routing for the challenge URL. Guessing another document root can write files into an unrelated site.
Official references
Use the documentation for your installed version when a flag, service name or platform feature differs.