• Get application security done the right way! Detect, Protect, Monitor, Accelerate, and more…
  • A step-by-step guide to implementing Let’s Encrypt TLS certificate in Nginx.

    Securing site with a TLS certificate is essential. There are two main reasons:

    • Secure data transmission between a user’s device to SSL/TLS offloading device
    • Improve Google search ranking

    Lately, Google announced that site without https:// would be marked as “No Secure” in chrome browser.

    So yes, Say YES to HTTPS.

    If you are running a blog, personal site, non-membership, the non-financial transactional site then you may go for Let’s Encrypt certificate.

    Let’s Encrypt offer a FREE certificate.

    However, if you are accepting a financial transaction, then you may want to go for a commercial certificate.

    Let’s implement TLS in Nginx…

    I assume you already have Nginx installed and running if not refer to this installation guide.

    There are multiple ways to get this done.

    Let’s Encrypt using Certbot

    One of the easiest and recommended ways to install it.

    Certbot offers a drop-down menu where you can select the webserver and OS to get the instruction.

    I’ve selected Nginx and Ubuntu as you can see below.

    And, I’ll be executing the below on the Nginx server to install the certbot plugin.

    # apt-get install software-properties-common
    # add-apt-repository ppa:certbot/certbot
    # apt-get update
    # apt-get install python-certbot-nginx

    Once all ok, it’s time to use a certbot plugin to install a certificate in Nginx.

    You can use the below command which will take care of modifying the necessary file to configure the certificate.

    # certbot --nginx

    It will check the CN (common name) in the existing Nginx configuration file, and it not found then it will prompt you to enter.

    Ex:

    [email protected]:/etc/nginx/sites-available# certbot --nginx
    Saving debug log to /var/log/letsencrypt/letsencrypt.log
    Plugins selected: Authenticator nginx, Installer nginx
    Starting new HTTPS connection (1): acme-v01.api.letsencrypt.org
    No names were found in your configuration files. Please enter in your domain
    name(s) (comma and/or space separated)  (Enter 'c' to cancel): bloggerflare.com
    Obtaining a new certificate
    Performing the following challenges:
    http-01 challenge for bloggerflare.com
    Waiting for verification...
    Cleaning up challenges
    Deployed Certificate to VirtualHost /etc/nginx/sites-enabled/default for bloggerflare.com
    Please choose whether or not to redirect HTTP traffic to HTTPS, removing HTTP access.
    -------------------------------------------------------------------------------
    1: No redirect - Make no further changes to the webserver configuration.
    2: Redirect - Make all requests redirect to secure HTTPS access. Choose this for
    new sites, or if you're confident your site works on HTTPS. You can undo this
    change by editing your web server's configuration.
    -------------------------------------------------------------------------------
    Select the appropriate number [1-2] then [enter] (press 'c' to cancel): 2
    Redirecting all traffic on port 80 to ssl in /etc/nginx/sites-enabled/default
    -------------------------------------------------------------------------------
    Congratulations! You have successfully enabled https://bloggerflare.com
    You should test your configuration at:
    https://www.ssllabs.com/ssltest/analyze.html?d=bloggerflare.com
    -------------------------------------------------------------------------------
    IMPORTANT NOTES:
     - Congratulations! Your certificate and chain have been saved at:
       /etc/letsencrypt/live/bloggerflare.com/fullchain.pem
       Your key file has been saved at:
       /etc/letsencrypt/live/bloggerflare.com/privkey.pem
       Your cert will expire on 2018-05-27. To obtain a new or tweaked
       version of this certificate in the future, simply run certbot again
       with the "certonly" option. To non-interactively renew *all* of
       your certificates, run "certbot renew"
     - If you like Certbot, please consider supporting our work by:
       Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
       Donating to EFF:                    https://eff.org/donate-le
    [email protected]:/etc/nginx/sites-available#

    Certbot automation is smart!

    As you can see it has taken care of all the necessary configuration to make my Nginx ready to serve over https.

    However, if you don’t want Certbot to modify the configuration for you, then you can just request the below command.

    # certbot --nginx certonly

    The above command will not perform any modification instead just provide you the certificate so you can configure the way you want.

    But what if you can’t or don’t want to use Certbot?

    Manual Procedure

    There are many ways to get the cert issued by Let’s Encrypt, but one of the recommended is from SSL for Free online tool.

    Provide your URL and proceed with the verification method. Once verified, you will get the certificate, private key, and CA.

    Download them, and transfer to Nginx server. Let’s keep them under ssl folder (create if doesn’t exist) of Nginx installation path

    [email protected]:/etc/nginx/ssl# ls -ltr
    -rw-r--r-- 1 root root 1704 Feb 26 10:04 private.key
    -rw-r--r-- 1 root root 1647 Feb 26 10:04 ca_bundle.crt
    -rw-r--r-- 1 root root 3478 Feb 26 10:57 certificate.crt
    [email protected]:/etc/nginx/ssl# 

    Before proceeding with the configuration modification, you need to concatenate certificate.crt and ca_bundle.crt into a single file. Let’s name it tlscert.crt

    cat certificate.crt ca_bundle.crt >> tlscert.crt
    • Go to sites-available folder and add the following in respective site configuration file
    server {
    listen 443;
    ssl on;
    ssl_certificate /etc/nginx/ssl/tlscert.crt;
    ssl_certificate_key /etc/nginx/ssl/private.key;
    }
    • Restart Nginx
    service nginx restart

    Try to access the respective domain over HTTPS

    So here you go, it’s a success!

    An alternative to Let’s Encrypt, you can also use ZeroSSL which is explained here about the implementation.

    Next, you may want to test your site for SSL/TLS vulnerability and fix them if found.