A step-by-step guide to implementing Let’s Encrypt TLS certificate in Nginx.
Securing site with a TLS certificate is essential. There are two main reasons:
- Secure data transmission between a user’s device to SSL/TLS offloading device
- Improve Google search ranking
Lately, Google announced that site without https:// would be marked as “No Secure” in chrome browser.
So yes, Say YES to HTTPS.
If you are running a blog, personal site, non-membership, the non-financial transactional site then you may go for Let’s Encrypt certificate.
Let’s Encrypt offer a FREE certificate.
However, if you are accepting a financial transaction, then you may want to go for a commercial certificate.
Let’s implement TLS in Nginx…
I assume you already have Nginx installed and running if not refer to this installation guide.
There are multiple ways to get this done.
Let’s Encrypt using Certbot
One of the easiest and recommended ways to install it.
Certbot offers a drop-down menu where you can select the webserver and OS to get the instruction.
I’ve selected Nginx and Ubuntu as you can see below.
And, I’ll be executing the below on the Nginx server to install the certbot plugin.
# apt-get install software-properties-common # add-apt-repository ppa:certbot/certbot # apt-get update # apt-get install python-certbot-nginx
Once all ok, it’s time to use a certbot plugin to install a certificate in Nginx.
You can use the below command which will take care of modifying the necessary file to configure the certificate.
# certbot --nginx
It will check the CN (common name) in the existing Nginx configuration file, and it not found then it will prompt you to enter.
Ex:
root@instance-1:/etc/nginx/sites-available# certbot --nginx Saving debug log to /var/log/letsencrypt/letsencrypt.log Plugins selected: Authenticator nginx, Installer nginx Starting new HTTPS connection (1): acme-v01.api.letsencrypt.org No names were found in your configuration files. Please enter in your domain name(s) (comma and/or space separated) (Enter 'c' to cancel): bloggerflare.com Obtaining a new certificate Performing the following challenges: http-01 challenge for bloggerflare.com Waiting for verification... Cleaning up challenges Deployed Certificate to VirtualHost /etc/nginx/sites-enabled/default for bloggerflare.com Please choose whether or not to redirect HTTP traffic to HTTPS, removing HTTP access. ------------------------------------------------------------------------------- 1: No redirect - Make no further changes to the webserver configuration. 2: Redirect - Make all requests redirect to secure HTTPS access. Choose this for new sites, or if you're confident your site works on HTTPS. You can undo this change by editing your web server's configuration. ------------------------------------------------------------------------------- Select the appropriate number [1-2] then [enter] (press 'c' to cancel): 2 Redirecting all traffic on port 80 to ssl in /etc/nginx/sites-enabled/default ------------------------------------------------------------------------------- Congratulations! You have successfully enabled https://bloggerflare.com You should test your configuration at: https://www.ssllabs.com/ssltest/analyze.html?d=bloggerflare.com ------------------------------------------------------------------------------- IMPORTANT NOTES: - Congratulations! Your certificate and chain have been saved at: /etc/letsencrypt/live/bloggerflare.com/fullchain.pem Your key file has been saved at: /etc/letsencrypt/live/bloggerflare.com/privkey.pem Your cert will expire on 2018-05-27. To obtain a new or tweaked version of this certificate in the future, simply run certbot again with the "certonly" option. To non-interactively renew *all* of your certificates, run "certbot renew" - If you like Certbot, please consider supporting our work by: Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate Donating to EFF: https://eff.org/donate-le root@instance-1:/etc/nginx/sites-available#
Certbot automation is smart!
As you can see it has taken care of all the necessary configuration to make my Nginx ready to serve over https.
However, if you don’t want Certbot to modify the configuration for you, then you can just request the below command.
# certbot --nginx certonly
The above command will not perform any modification instead just provide you the certificate so you can configure the way you want.
But what if you can’t or don’t want to use Certbot?
Manual Procedure
There are many ways to get the cert issued by Let’s Encrypt, but one of the recommended is from SSL for Free online tool.
Provide your URL and proceed with the verification method. Once verified, you will get the certificate, private key, and CA.
Download them, and transfer to Nginx server. Let’s keep them under ssl folder (create if doesn’t exist) of Nginx installation path
root@instance-2:/etc/nginx/ssl# ls -ltr -rw-r--r-- 1 root root 1704 Feb 26 10:04 private.key -rw-r--r-- 1 root root 1647 Feb 26 10:04 ca_bundle.crt -rw-r--r-- 1 root root 3478 Feb 26 10:57 certificate.crt root@instance-2:/etc/nginx/ssl#
Before proceeding with the configuration modification, you need to concatenate certificate.crt and ca_bundle.crt into a single file. Let’s name it tlscert.crt
cat certificate.crt ca_bundle.crt >> tlscert.crt
- Go to
sites-availablefolder and add the following in respective site configuration file
server { listen 443; ssl on; ssl_certificate /etc/nginx/ssl/tlscert.crt; ssl_certificate_key /etc/nginx/ssl/private.key; }
- Restart Nginx
service nginx restart
Try to access the respective domain over HTTPS
So here you go, it’s a success!
An alternative to Let’s Encrypt, you can also use ZeroSSL which is explained here about the implementation.
Next, you may want to test your site for SSL/TLS vulnerability and fix them if found.