Using Free SSL/TLS Certificates from Let’s Encrypt with NGINX

KENNETH

7년 ago

Also see our blog post from nginx.conf 2015, in which Peter Eckersley and Yan Zhu of the Electronic Frontier Foundation introduce the then-new Let’s Encrypt certificate authority.

It’s now a well-known fact that SSL encrypting of your website leads to higher search rankings and better security for your users. However, there are a number of barriers that have prevented website owners from adopting SSL. Two of the biggest barriers have been the cost and the manual processes involved in getting a certificate. But now, with Let’s Encrypt, this is no longer a concern. Let’s Encrypt makes SSL encryption freely available to everyone.

Let’s Encrypt is a free, automated, and open certificate authority. Yes, that’s right: SSL/TLS certificates for free. Certificates issued by Let’s Encrypt are trusted by most browsers today, including older browsers, such as Internet Explorer on Windows XP SP3. In addition, Let’s Encrypt is fully automated for both issuing and renewing certificates.

In this blog post, we’ll cover how to use the Let’s Encrypt client to generate RSA certificates and autonomously configure NGINX to use the newly issued certificates.

How Let’s Encrypt Works

Before issuing a certificate, Let’s Encrypt first validates ownership of your domain. The Let’s Encrypt client, running on your host, creates a temporary file (a token) with the required information in it. The Let’s Encrypt validation server then makes an HTTP request to retrieve the file and validates the token, which verifies that the DNS record for your domain resolves to the server running the Let’s Encrypt client.

Prerequisites

Before starting with Let’s Encrypt, you’ll need a few prerequisites:

Have NGINX or NGINX Plus installed.
Own or control a registered domain name for the certificate. If you don’t have a registered domain name, you can use a domain name registrar, such as GoDaddy, dnsexit, etc.
Create a DNS record that points your domain name to your server’s public IP address.

Now you can easily set up Let’s Encrypt with NGINX and NGINX Plus.

Note: In this blog post, we’re running Let’s Encrypt with open source NGINX on Ubuntu 16.04 Xenial.

1. Download the Let’s Encrypt Client

First, download the Let’s Encrypt client, certbot:

Add the certbot repository:
$ add-apt-repository ppa:certbot/certbot
Now install certbot:
$ apt-get update $ apt-get install python-certbot-nginx

The Let’s Encrypt client is now ready to use.

2. Set up NGINX

Certbot can automatically configure SSL with NGINX by finding the correct server block in the NGINX configuration. Certbot will look for the server_name directive in the server block that matches the domain name you’re requesting a certificate for. We’ll be using www.example.com as the domain in this tutorial.

Assuming you’re starting with a fresh NGINX install, create a configuration file named www.example.com.conf in the /etc/nginx/conf.d directory
```
$ nano /etc/nginx/conf.d/www.example.com.conf
```

Enter your domain name in the server_name directive in a server block

server {

        listen 80 default_server;

        listen [::]:80 default_server;

        server_name example.com www.example.com;

}

Save the file, verify the syntax of your configuration edits, and restart NGINX
```
$ nginx -t && nginx -s reload
```

3. Obtain the SSL certificate

Certbot has various plugins to generate SSL certificates. The NGINX Plugin will take care of re-configuring NGINX and reloading the configuration whenever necessary. To generate SSL certificates with the NGINX plugin, run the following command:

$ sudo certbot --nginx -d example.com -d www.example.com

Once the process has completed successfully, certbot will prompt you to configure your HTTPS settings, which includes entering your email address and agreeing to the terms of service of Let’s Encrypt. Once that’s completed, NGINX will reload with the new settings. Certbot will output a message stating that the SSL certificate generation is successful, along with the location of the certificate on your server.

Congratulations! You have successfully enabled https://example.com and https://www.example.com 
-----------------------------------------------------------------------------------------------------------------------------

IMPORTANT NOTES: 
Congratulations! Your certificate and chain have been saved at:

/etc/letsencrypt/live/example.com/fullchain.pem

Your key file has been saved at:

/etc/letsencrypt/live/example.com//privkey.pem

Your cert will expire on 2017-12-12.

Note: Let’s Encrypt certificates expire after 90 days. In this example, the certificate will expire on 2017-12-12. In the next section, we’ll talk about how to auto-renew certificates automatically.

Open up the NGINX configuration and take note of all the modifications. That way, you’ll know how to configure NGINX manually with SSL/TLS termination in the future.

server {

	listen 80 default_server;

	listen [::]:80 default_server;
	root /var/www/html;

	server_name  example.com www.example.com;
      listen 443 ssl; # managed by Certbot
# RSA certificate
ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem; # managed by Certbot

ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem; # managed by Certbot
include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    if ($scheme != "https") {

        return 301 https://$host$request_uri;

    } # managed by Certbot
    # Redirect non-https traffic to https

    # if ($scheme != "https") {

    #     return 301 https://$host$request_uri;

    # } # managed by Certbot
}

4. Automatic Renewal of Let’s Encrypt Certificates

Let’s Encrypt certificates expire in 90 days. It is encouraged to automatically renew your certificates when they expire. We’ll set up a cron job to do this.

We start by opening a file called crontab

$ crontab -e

and we enter the certbot command we wish to run daily. In this blog post, we run the command every day at noon. The command will check to see if the certificate on the server is expired and renew it if it is.

0 12 * * * /usr/bin/certbot renew --quiet

Close the cron tab, and now all installed certificates will be automatically renewed and reloaded. --quiet tells certbot not to output information.

Summary

We’ve installed the Let’s Encrypt agent to generate SSL certificates for a registered domain name. We’ve configured NGINX to use SSL certificates, and we’ve set up automatic certificate renewals. Now, you can set up Let’s Encrypt with NGINX, and have a simple, secure website up and running within minutes.

The post Using Free SSL/TLS Certificates from Let’s Encrypt with NGINX appeared first on NGINX.

Source: Using Free SSL/TLS Certificates from Let’s Encrypt with NGINX