Add subdomain with Certbot and Nginx

How to add a new Subdomain using Certbot and Nginx.

Overview

This Tutorial covers:

  • Adding a new subdomain using Certbot and Nginx.

Prerequisites

  • VPS running Ubuntu 24.04 (or similar)
  • Docker + Portainer already installed
  • Your domain configures via Nginx reverse proxy
  • Access to your VPS as root

I'll be using "sub.your-domain.com" as the example domain name through the guide, make sure to replace it with your own sub and domain name each time.

Create DNS record

In your domain DNS panel add: (I'm using easyhost.be)


TypeNameValue
Avault[your-vps-ip]

Verify working DNS

You can verify that DNS is working with:

bash
1
dig sub.your-domain.com

or

bash
1
nslookup sub.your-domain.com

You should se your server's IP address.

Create an Nginx Configuration

bash
1
sudo nano /etc/nginx/sites-available/sub.your-domain

Add:

nginx
1
server {
2
listen 80;
3
server_name newsubdomain.arcky-tech.be;
4
5
location / {
6
proxy_pass http://127.0.0.1:3096;
7
proxy_http_version 1.1;
8
9
proxy_set_header Host $host;
10
proxy_set_header X-Real-IP $remote_addr;
11
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
12
proxy_set_header X-Forwarded-Proto $scheme;
13
}
14
}

Replace 3096 with the port you want to use.


Save (press ctrl + 0, then enter, then ctrl + x)

Enable the Site

run:

bash
1
sudo ln -s /etc/nginx/sites-available/sub.your-domain /etc/nginx/sites-enabled/

Then text Nginx:

text
1
sudo nginx -t

Result:

text
1
syntax is ok
2
test is successful

Then reload:

bash
1
sudo systemctl reload nginx

Get the SSL certificate with Certbot

Run:

bash
1
sudo certbot --nginx -d sub.your-domain.com

Certbot should:

  1. Verify that you control sub.your-domain.com
  2. Request the Let's Encrypt certificate
  3. Modify your Nginx configuration
  4. Enable HTTPS
  5. Optionally redirect HTTP to HTTPS

You'll typically get a prompt asking whether you'd like HTTP traffic redirected to HTTPS. I'd generally choose the redirect option.

Check that HTTPS works

Open (in your browser):

text
1
https://sub.your-domain.com

You should now have the HTTPS connection.


You can also check the certificate:

bash
1
sudo certbot certificate

Make sure automatic renewal works

Let's Encrypt certificates expire after 90 days, but Certbot normally installs an automatic renewal mechanism. Check:

bash
1
sudo systemctl status certbot.timer

You can also test the renewal process without actually renewing the certificate:

bash
1
sudo certbot renew --dry-run

If that succeeds, you're basically done.