Let's Encrypt is a free certificate authority that allows website owners to obtain SSL/TLS certificates to secure their websites using HTTPS.

Certificates issued by Let's Encrypt are valid for a limited period and must be renewed regularly to maintain secure connections. Certbot, a popular Let's Encrypt client, can automate this process.

However, you may occasionally encounter errors when attempting to renew a certificate, particularly when the process requires access to a network port that is already in use.

In this tutorial, we'll investigate the following error and explore how to resolve it on a Linux server.

1. Identify the Certificate Renewal Error

Suppose you're attempting to renew a Let's Encrypt certificate using Certbot:

$ sudo certbot renew -d your.website.com

You may encounter an error similar to the following:

Failed to renew certificate your.website.com with error:
Could not bind TCP port 80 because it is already in use by
another process on this system (such as a web server).
Please stop the program in question and then try again.

This error indicates that Certbot attempted to bind to TCP port 80, but another process was already using that port.

Why does this happen?

One possible explanation is that Certbot is using the standalone authentication method, which starts a temporary web server to respond to Let's Encrypt's validation requests.

If Nginx, Apache HTTP Server, or another application is already listening on port 80, Certbot's standalone server cannot bind to that port.

However, this does not necessarily mean that your web server is misconfigured. The problem may simply be that the selected Certbot authentication method conflicts with the service already listening on port 80.

Let's investigate.

2. Check Which Process Is Using Port 80

Before stopping any services, identify the process listening on TCP port 80.

Run:

$ sudo ss -ltnp 'sport = :80'

Example output:

State  Recv-Q Send-Q Local Address:Port Peer Address:Port Process
LISTEN 0      511    0.0.0.0:80        0.0.0.0:*     users:(("nginx",pid=1234,fd=6))

In this example, Nginx is listening on port 80.

If Apache is running instead, you may see an Apache-related process.

You can also check which web server services are active:

$ sudo systemctl status nginx

For Apache on Ubuntu or Debian:

$ sudo systemctl status apache2

These commands help you identify the active services before deciding how to proceed.

3. Restart Nginx or Apache if Necessary

If your web server is experiencing an unrelated problem, restarting it may be appropriate. However, restarting Nginx or Apache does not resolve a port conflict caused by Certbot's standalone method. The web server will usually continue listening on port 80 after it restarts.

If you have a legitimate reason to restart Nginx, first validate its configuration:

$ sudo nginx -t

Then restart the service:

$ sudo systemctl restart nginx

Verify that it is running:

$ sudo systemctl status nginx

Example output:

● nginx.service - A high performance web server and a reverse proxy server
     Loaded: loaded (/lib/systemd/system/nginx.service; enabled)
     Active: active (running)

For Apache on Ubuntu or Debian, the corresponding commands are:

$ sudo apache2ctl configtest

$ sudo systemctl restart apache2

$ sudo systemctl status apache2

Important: Do not stop or restart production web servers unnecessarily. A restart can interrupt active connections, and stopping a service may make your website temporarily unavailable.

If the only issue is Certbot's standalone authentication method competing for port 80, use one of the following approaches instead.

4. Fix the Certbot Renewal Method

There are several ways to resolve this problem. The appropriate solution depends on how Certbot obtained the certificate and how your web server is configured.

Option A: Use the Nginx or Apache Plugin

If your website already uses Nginx or Apache, the corresponding Certbot plugin can often handle validation without requiring you to stop the web server.

For Nginx:

$ sudo certbot --nginx -d your.website.com

For Apache:

$ sudo certbot --apache -d your.website.com

These commands request or configure a certificate using the relevant web server plugin. They are not simply substitutes for every existing renewal command; review your current certificate configuration before changing the authentication method.

If your existing certificate is managed through a different authenticator, switching plugins may require additional configuration.

Option B: Use the Webroot Authentication Method

Another option is Certbot's webroot method.

With this approach, Certbot places a temporary validation file in a directory served by your existing web server. Let's Encrypt retrieves that file over HTTP to verify domain ownership.

For example:

$ sudo certbot certonly --webroot -w /var/www/html -d your.website.com

Replace /var/www/html with the actual document root configured for your domain.

Your web server must serve the ACME challenge files correctly, and the domain must resolve to the server performing validation.

This method allows Nginx or Apache to continue running while Certbot performs HTTP-01 validation.

Option C: Temporarily Stop the Web Server

If you specifically need to use standalone authentication, you can temporarily stop the service occupying port 80.

For Nginx:

$ sudo systemctl stop nginx

Then request certificate renewal:

$ sudo certbot renew

After the renewal attempt, restart Nginx:

$ sudo systemctl start nginx

Verify its status:

$ sudo systemctl status nginx

Warning: Stopping the web server interrupts HTTP and potentially HTTPS service, depending on your configuration. Use this approach only when a maintenance interruption is acceptable.

Also, certbot renew attempts to renew eligible certificates that are due for renewal; it does not necessarily force a renewal of every certificate.

For unattended renewals, configure appropriate pre- and post-renewal hooks or use a supported web server or webroot authenticator rather than relying on manually stopping services.

5. Verify the Certificate Renewal

After addressing the underlying issue, verify that Certbot can renew the certificate.

First, inspect the certificates managed by Certbot:

$ sudo certbot certificates

This displays information such as certificate names, domains, expiration dates, and certificate file paths.

Next, test the renewal process without actually renewing certificates:

$ sudo certbot renew --dry-run

A successful dry run indicates that Certbot can complete the simulated renewal process using the configured renewal methods.

Once you've confirmed that the configuration works, Certbot can continue renewing eligible certificates according to its normal renewal schedule.

You can also inspect the Certbot systemd timer, if your installation uses one:

$ sudo systemctl status certbot.timer

To see when it is scheduled to run:

$ sudo systemctl list-timers certbot.timer

Timer availability and naming may vary depending on how Certbot was installed.

Let's Encrypt makes it straightforward to obtain free SSL/TLS certificates, but renewal errors can occur when Certbot's validation method conflicts with an existing web server.

If you encounter the error:

Could not bind TCP port 80 because it is already in use

Start by identifying which process is listening on port 80. Then inspect the certificate's renewal configuration and choose an appropriate solution.

For servers running Nginx or Apache, using the corresponding Certbot plugin or webroot authentication method can often eliminate the need to stop the web server.

If standalone authentication is required, temporarily stopping the service may be appropriate, provided you account for the interruption.

Finally, verify your configuration with certbot renew --dry-run and ensure that automatic renewal is configured correctly.

Keep your certificates renewed, your HTTPS connections secure, and your Linux infrastructure running smoothly.