Hosting a website with Nginx and a free SSL certificate (Let's Encrypt)

Before you start, your domain must point at the VPS's IP with an A record (how to do it). Without that, the certificate cannot be issued. In the examples, the domain is mydomain.com.

1. Install Nginx and open the ports

apt install -y nginx
ufw allow 'Nginx Full'

Open the VPS's IP in your browser and you will see Nginx's welcome page.

2. Your website

mkdir -p /var/www/mydomain
echo '<h1>It works!</h1>' > /var/www/mydomain/index.html

Create /etc/nginx/sites-available/mydomain:

server {
    listen 80;
    server_name mydomain.com www.mydomain.com;
    root /var/www/mydomain;
    index index.html;

    location / {
        try_files $uri $uri/ =404;
    }
}

ln -s /etc/nginx/sites-available/mydomain /etc/nginx/sites-enabled/
nginx -t && systemctl reload nginx

nginx -t checks for errors before applying anything.

3. The SSL certificate

apt install -y certbot python3-certbot-nginx
certbot --nginx -d mydomain.com -d www.mydomain.com

It asks for an email (to warn you if something fails) and for you to accept the terms. Certbot configures Nginx by itself, including the HTTP-to-HTTPS redirect.

4. Automatic renewal

Certificates last 90 days and certbot renews them automatically. Check renewal will work:

certbot renew --dry-run

If something fails

Certbot cannot validate the domain: check with nslookup mydomain.com that it points to your IP and that port 80 is open.
Cloudflare: it also works with the orange cloud; if issuing gives trouble, set the cloud to grey, issue the certificate and switch it back to orange.
502 errors: if Nginx proxies to an application (Node, PHP...), that application is not running or listens on another port.