Generating a Let's Encrypt SSL Certificate with Certbot (DNS Challenge)

This guide explains how to manually obtain an SSL/TLS certificate from Let's Encrypt using Certbot with a DNS challenge.

Prerequisites

• A domain name (e.g., grafana.seamlessfintech.com)
• Access to your domain's DNS settings
• Certbot installed on your system
• Email address for notifications

Command to Generate the Certificate

Run the following command:

certbot certonly --manual --preferred-challenges=dns \
  --email [email protected] \
  --server https://acme-v02.api.letsencrypt.org/directory \
  --agree-tos -d "grafana.seamlessfintech.com"

Explanation of Command Flags:

• certonly: Obtain a certificate without automatically configuring it.
• --manual: Enables manual authentication.
• --preferred-challenges=dns: Uses a DNS challenge instead of HTTP.
• --email [email protected]: Specifies an email for renewal notifications.
• --server https://acme-v02.api.letsencrypt.org/directory: Uses the Let's Encrypt production server.
• --agree-tos: Accepts Let's Encrypt's Terms of Service.
• -d "grafana.seamlessfintech.com": Specifies the domain for the SSL certificate.

DNS Challenge Verification

After running the command, Certbot will prompt you to create a TXT record in your domain’s DNS settings. Follow these steps:

1. Copy the provided TXT record value from the Certbot output.
2. Open your DNS provider’s management console.
3. Create a new TXT record for _acme-challenge.grafana.seamlessfintech.com with the provided value.
4. Wait for the DNS changes to propagate (this may take a few minutes).
5. Press Enter in Certbot to continue.

Certificate Location

Once verification is successful, Certbot will generate the SSL certificate files, typically stored in:

• /etc/letsencrypt/live/grafana.seamlessfintech.com/fullchain.pem (Certificate)
• /etc/letsencrypt/live/grafana.seamlessfintech.com/privkey.pem (Private Key)

Next Steps

• Configure your web server (e.g., Nginx, Apache) to use the obtained SSL certificate.
• Set up automatic renewal with certbot renew or a cron job.

For more information, visit the Certbot documentation (opens in a new tab).