Obtain a certificate using webroot mode so a currently running web server (e.g. nginx or Apache) keeps serving traffic uninterrupted during the http-01 challenge, by dropping a challenge file into its document root.

Documented steps

1. Install Certbot per https://certbot.eff.org/instructions.
2. Confirm your running web server serves static files (including hidden directories like /.well-known/) from a known document root, e.g. /var/www/html or /usr/share/nginx/html.
3. Run: sudo certbot certonly --webroot -w /var/www/html -d example.com -d www.example.com
4. For multiple domains with different document roots on one certificate, repeat -w before the -d flags it should apply to: certbot certonly --webroot -w /var/www/example -d www.example.com -d example.com -w /var/www/other -d other.example.net -d another.other.example.net
5. Certbot writes a temporary file under ${webroot-path}/.well-known/acme-challenge/ and Let's Encrypt's validation servers fetch it over plain HTTP on port 80 to confirm control of the domain.
6. If your web server config specially handles or blocks dotfiles/hidden paths, adjust it so requests to /.well-known/acme-challenge/ are served normally.
7. Because webroot doesn't install the cert, manually configure your web server to use the files under /etc/letsencrypt/live/example.com/, or combine authenticator+installer plugins (e.g. certbot run -a webroot -i apache -w /var/www/html -d example.com).
8. Official docs: https://eff-certbot.readthedocs.io/en/stable/using.html