How to Setup Nginx with Let's Encrypt Cert?

A step-by-step guide to implementing Let’s Encrypt TLS certificate in Nginx.

Securing site with a TLS certificate is essential. There are two main reasons:

Lately, Google announced that site without https:// would be marked as “No Secure” in chrome browser.

So yes, Say YES to HTTPS.

If you are running a blog, personal site, non-membership, the non-financial transactional site then you may go for Let’s Encrypt certificate.

Let’s Encrypt offer a FREE certificate.

However, if you are accepting a financial transaction, then you may want to go for a commercial certificate.

Let’s implement TLS in Nginx…

I assume you already have Nginx installed and running if not refer to this installation guide.

There are multiple ways to get this done.

Let’s Encrypt using Certbot

One of the easiest and recommended ways to install it.

Certbot offers a drop-down menu where you can select the webserver and OS to get the instruction.

I’ve selected Nginx and Ubuntu as you can see below.

And, I’ll be executing the below on the Nginx server to install the certbot plugin.

# apt-get install software-properties-common  # add-apt-repository ppa:certbot/certbot  # apt-get update  # apt-get install python-certbot-nginx

Once all ok, it’s time to use a certbot plugin to install a certificate in Nginx.

You can use the below command which will take care of modifying the necessary file to configure the certificate.

# certbot --nginx

It will check the CN (common name) in the existing Nginx configuration file, and it not found then it will prompt you to enter.

Ex:

[email protected]:/etc/nginx/sites-available# certbot --nginx  Saving debug log to /var/log/letsencrypt/letsencrypt.log  Plugins selected: Authenticator nginx, Installer nginx  Starting new HTTPS connection (1): acme-v01.api.letsencrypt.org  No names were found in your configuration files. Please enter in your domain  name(s) (comma and/or space separated)  (Enter 'c' to cancel): bloggerflare.com  Obtaining a new certificate  Performing the following challenges:  http-01 challenge for bloggerflare.com  Waiting for verification...  Cleaning up challenges  Deployed Certificate to VirtualHost /etc/nginx/sites-enabled/default for bloggerflare.com  Please choose whether or not to redirect HTTP traffic to HTTPS, removing HTTP access.  -------------------------------------------------------------------------------  1: No redirect - Make no further changes to the webserver configuration.  2: Redirect - Make all requests redirect to secure HTTPS access. Choose this for  new sites, or if you're confident your site works on HTTPS. You can undo this  change by editing your web server's configuration.  -------------------------------------------------------------------------------  Select the appropriate number [1-2] then [enter] (press 'c' to cancel): 2  Redirecting all traffic on port 80 to ssl in /etc/nginx/sites-enabled/default  -------------------------------------------------------------------------------  Congratulations! You have successfully enabled https://bloggerflare.com  You should test your configuration at:  https://www.ssllabs.com/ssltest/analyze.html?d=bloggerflare.com  -------------------------------------------------------------------------------  IMPORTANT NOTES:   - Congratulations! Your certificate and chain have been saved at:     /etc/letsencrypt/live/bloggerflare.com/fullchain.pem     Your key file has been saved at:     /etc/letsencrypt/live/bloggerflare.com/privkey.pem     Your cert will expire on 2018-05-27. To obtain a new or tweaked     version of this certificate in the future, simply run certbot again     with the "certonly" option. To non-interactively renew *all* of     your certificates, run "certbot renew"   - If you like Certbot, please consider supporting our work by:     Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate     Donating to EFF:                    https://eff.org/donate-le  [email protected]:/etc/nginx/sites-available#

Certbot automation is smart!

As you can see it has taken care of all the necessary configuration to make my Nginx ready to serve over https.

However, if you don’t want Certbot to modify the configuration for you, then you can just request the below command.

# certbot --nginx certonly

The above command will not perform any modification instead just provide you the certificate so you can configure the way you want.

But what if you can’t or don’t want to use Certbot?

Manual Procedure

There are many ways to get the cert issued by Let’s Encrypt, but one of the recommended is from SSL for Free online tool.

Provide your URL and proceed with the verification method. Once verified, you will get the certificate, private key, and CA.

Download them, and transfer to Nginx server. Let’s keep them under ssl folder (create if doesn’t exist) of Nginx installation path

[email protected]:/etc/nginx/ssl# ls -ltr  -rw-r--r-- 1 root root 1704 Feb 26 10:04 private.key  -rw-r--r-- 1 root root 1647 Feb 26 10:04 ca_bundle.crt  -rw-r--r-- 1 root root 3478 Feb 26 10:57 certificate.crt  [email protected]:/etc/nginx/ssl# 

Before proceeding with the configuration modification, you need to concatenate certificate.crt and ca_bundle.crt into a single file. Let’s name it tlscert.crt

cat certificate.crt ca_bundle.crt >> tlscert.crt
server {  listen 443;  ssl on;  ssl_certificate /etc/nginx/ssl/tlscert.crt;  ssl_certificate_key /etc/nginx/ssl/private.key;  }
service nginx restart

Try to access the respective domain over HTTPS

So here you go, it’s a success!

An alternative to Let’s Encrypt, you can also use ZeroSSL which is explained here about the implementation.

Next, you may want to test your site for SSL/TLS vulnerability and fix them if found.