# How to manage Lets Encrypt for Nextcloud snap **URL:** \ **Category:** đź“‘ How to\ **Tags:** snap, wiki, letsencrypt, dns\ **Created:** [January 27, 2025, 1:35pm UTC](https://help.nextcloud.com/t/how-to-manage-lets-encrypt-for-nextcloud-snap/216069 "2025-01-27T13:35:04Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![scubamuc](https://help.nextcloud.com/user_avatar/help.nextcloud.com/scubamuc/32/63165_2.png) [@scubamuc](https://help.nextcloud.com/u/scubamuc)\ **Post date:** [January 27, 2025, 1:35pm UTC](https://help.nextcloud.com/t/how-to-manage-lets-encrypt-for-nextcloud-snap/216069/1 "2025-01-27T13:35:04Z")
# Managing Lets Encrypt for Nextcloud snap Nextcloud snap includes a service for automated HTTPS encryption using Lets Encrypt, self-signed certificates, or custom certificates. Lets Encrypt requires port **80** and port **443**. Enable HTTPS via Lets Encrypt. HTTP will redirect to HTTPS. Non-custom certificates will automatically be kept up-to-date. See `nextcloud.enable-https -h` for more information. Note that this requires `sudo` or root privileges. Run `nextcloud.enable-https -h` for more information: - issue command in host shell ```auto sudo nextcloud.enable-https -h ``` ![grafik](https://github.com/nextcloud-snap/nextcloud-snap/assets/54933878/59bee2ab-92fe-479d-a97f-6d192d1d8419) ## Enable Lets Encrypt in Nextcloud snap: - issue command in host shell ```auto sudo nextcloud.enable-https lets-encrypt ``` > ### TIP > > Read the resulting response carefully and ensure the requirements are met. > > ![grafik](https://github.com/user-attachments/assets/01d50359-fa8c-40fa-8033-547bfd652457) > > - [domain name and DNS](https://github.com/nextcloud-snap/nextcloud-snap/wiki/Installation-requirements#domain-name-and-dns) > - [network requirements](https://github.com/nextcloud-snap/nextcloud-snap/wiki/Installation-requirements#network) Enter valid email address and domain/subdomain. If you need to setup multiple domains then separate the domains/subdomains with a space. > #### IMPORTANT > > Let’s Encrypt will expect that Nextcloud is exposed on ports **80** and **443**. If you change ports and _don’t_ put Nextcloud behind a [reverse proxy](https://github.com/nextcloud-snap/nextcloud-snap/wiki/Putting-the-snap-behind-a-reverse-proxy) such that ports 80 and 443 are sent to Nextcloud for that domain name, Let’s Encrypt will be **unable** to **verify ownership** of your domain and will not grant certificates. > > Self-signed certificate is easier to setup than Let’s Encrypt certificates, but will **cause warnings in browsers** and due to being very basic **won’t work with some applications**. ## Lets Encrypt failed after entering incorrect data. If you’ve tried to encrypt your Nextcloud snap with Lets Encrypt and something went wrong after entering incorrect data, you’ll need to correct that data. You may run into a `... permission error` because only root may overwrite the data. Simply switch user to root `sudo -i` and try entering the correct data as root `# nextcloud.enable-https lets-encrypt`. If that doesn’t work, you’ll need to [start from scratch](https://help.nextcloud.com/t/how-to-manage-lets-encrypt-for-nextcloud-snap/216069#p-649491-change-lets-encrypt-domain-lets-encrypt-from-scratch-8). ## Disable Lets Encrypt in Nextcloud snap ```auto sudo nextcloud.disable-https lets-encrypt ``` ## Disable renew service in Nextcloud snap Due to a snapd [issue](https://forum.snapcraft.io/t/cant-mask-or-disable-snap-services-why-etc-systemd-instead-of-lib-systemd/33385) it may be necessary to disable the renewal-service manually. ```auto sudo snap stop --disable nextcloud.renew-certs ``` ## Check renew service in Nextcloud snap Renew service `renew-certs.service` is automated in Nextcloud-snap. Check renewal by issuing: ```auto sudo journalctl -u snap.nextcloud.renew-certs.service ``` ## Self signed certificate in Nextcloud snap > #### IMPORTANT > > Generate and use a limited self-signed certificate. This is easier to setup than Let’s Encrypt certificates, but will **cause warnings in browsers** and due to being very basic **won’t work with some applications**. Enable self signed certificate: ```auto sudo nextcloud.enable-https self-signed ``` ## Change Lets Encrypt domain – Lets Encrypt from scratch 1. Disable Lets Encrypt 2. Remove all current Certificates 3. Get new Certificates - **disable HTTPS** (this just removes a symlink, it doesn’t remove any certificates): ```auto sudo nextcloud.disable-https ``` - **remove all/any certificates** that are there (this includes self-signed certs, Let’s Encrypt certificates, everything). Make sure you get this command right, you don’t want to delete anything else in the current/ directory: ```auto sudo rm -rf /var/snap/nextcloud/current/certs ``` - add required empty directories: ```auto sudo mkdir -p /var/snap/nextcloud/current/certs/certbot ``` - pretend you’re **enabling HTTPS** for the first time, using only the domains you need to encrypt (If you need to setup multiple domains then separate the domains/subdomains with a space): ```auto sudo nextcloud.enable-https lets-encrypt ``` > ### NOTE > > You may run into a `... permission error` because only root may overwrite the data. > > Switch to root by issuing; `sudo -i` and try entering the correct data as root `# nextcloud.enable-https lets-encrypt`. ## Lets Encrypt Log View Lets Encrypt log in Netxtcloud snap: ```auto sudo cat /var/snap/nextcloud/current/certs/certbot/logs/letsencrypt.log ``` * * * Resources: - [Managing encryption](https://github.com/nextcloud-snap/nextcloud-snap/wiki/Managing-HTTP-encryption-(HTTPS)) - [Requirements](https://github.com/nextcloud-snap/nextcloud-snap/wiki/Installation-requirements) - [managing encryption](https://github.com/nextcloud-snap/nextcloud-snap/wiki/Managing-HTTP-encryption-(HTTPS)) - [configure Nextcloud snap](https://github.com/nextcloud-snap/nextcloud-snap/wiki/configure-Nextcloud-snap#https-encryption-with-lets-encrypt) ---
**Author:** ![wwe](https://help.nextcloud.com/user_avatar/help.nextcloud.com/wwe/32/72963_2.png) [@wwe](https://help.nextcloud.com/u/wwe)\ **Post date:** [February 1, 2025, 8:47am UTC](https://help.nextcloud.com/t/how-to-manage-lets-encrypt-for-nextcloud-snap/216069/2 "2025-02-01T08:47:37Z")