• Home
  • Linux
  • Ubuntu
  • Debian
  • CentOS
  • Linux Commands
  • About Us
  • Donate
TecNStuff
Menu
  • Home
  • Linux
  • Ubuntu
  • Debian
  • CentOS
  • Linux Commands
  • About Us
  • Donate

Secure Nginx with Let’s Encrypt on Debian 9

Written by Admin, Updated On May 7, 2019
certbot, debian, let's encrypt, nginx, ssl
Secure Nginx with Let's Encrypt on Debian 9

Let’s Encrypt is a free Certificate Authority (CA). It provides a simple way to obtain, install and renew free TLS/SSL certificates. This guide will help you to obtain and install free SSL certificate and Secure Nginx with Let’s Encrypt on Debian 9 server.

Prerequisites#

  • Logged in to Debian server with a non-root user with sudo privileges.
  • Your domain name should pointing to your server IP address.
  • Nginx must installed and configured, as shown in this tutorial.
  • Have a Nginx server block for your domain, as shown in this tutorial.

Install Let’s Encrypt on Debian#

In this tutorial given steps to use Certbot tool to obtain a free SSL certificate for Nginx on Debian 9. Today, certificates issued by Let’s Encrypt are trusted by almost all browsers.

Install Certbot Client#

Using Certbot client package, you can easily obtain, install and renew Let’s Encrypt SSL certificates. It’s useful for configuring web servers to use the SSL certificates. The certbot package is included in the default Debian repositories.

First, we will update the packages list:

sudo apt update

Now install Certbot client by executing following command:

sudo apt install python-certbot-nginx

You can verify that certbot is installed successfully or not by typing:

certbot --version

Adjust Firewall#

If on server UFW firewall enabled then you need to adjust firewall to allow HHTPS traffic.

You can see the current setting by typing:

sudo ufw status
Output
Status: active
To Action From
-- ------ ----
OpenSSH ALLOW Anywhere
Nginx HTTP ALLOW Anywhere
OpenSSH (v6) ALLOW Anywhere (v6)
Nginx HTTP (v6) ALLOW Anywhere (v6)

To let in HTTPS traffic, you need to allow the Nginx Full profile and delete the redundant Nginx HTTP profile allowance:

sudo ufw allow 'Nginx Full'
sudo ufw delete allow 'Nginx HTTP'

sudo ufw delete allow ‘Nginx HTTP’

Now status should look like as below:

Output
Status: active
To Action From
-- ------ ----
OpenSSH ALLOW Anywhere
Nginx Full ALLOW Anywhere
OpenSSH (v6) ALLOW Anywhere (v6)
Nginx Full (v6) ALLOW Anywhere (v6)

Obtaining an SSL Certificate#

There are many ways to obtain SSL certificates through plugins. Here, we will use certbot client to obtain a SSL certificate:

sudo certbot --nginx -d example.com -d www.example.com

Using above command, we are requesting for example.com and www.example.com domains. If you are installing certificate first time then it will ask you enter email address and agree terms and conditions. Entered email address will be used for sending email alerts related to SSL renewal and expiration.

Next, If validation got successful it will ask you to configure HTTPS settings:

Please choose whether or not to redirect HTTP traffic to HTTPS, removing HTTP access.
-------------------------------------------------------------------------------
1: No redirect - Make no further changes to the webserver configuration.
2: Redirect - Make all requests redirect to secure HTTPS access. Choose this for
new sites, or if you're confident your site works on HTTPS. You can undo this
change by editing your web server's configuration.
-------------------------------------------------------------------------------
Select the appropriate number [1-2] then [enter] (press 'c' to cancel):

Select your choice and hit Enter to go ahead. Your nginx server block will be updated based on your selected option and will reload Nginx to take new settings effect.

Finally, your domain is secure with Let’s Encrypt SSL certificate. You can verify by visiting your site with HTTPS protocol.

Auto Renew Let’s Encrypt SSL certificate#

Let’s Encrypt SSL certificates have short-life period of 90 days so you need to renew it before it expire. You can renew SSL certificate before it get expired by typing:

sudo certbot renew

You can setup automatic process to auto renew Let’s Encrypt SSL certificates by adding a cronjob. Run following command to open crontab:

sudo crontab -e

Next, append the below line at end of file. It will run the command twice a day and renews if the certificate is about to expire.

0 */12 * * * root test -x /usr/bin/certbot -a ! -d /run/systemd/system && perl -e 'sleep int(rand(43200))' && certbot -q renew

Save and close the file.

You also can verify certbot auto-renewal process by typing:

sudo certbot renew --dry-run

Conclusion#

You have learned how to install certbot client, obtain Let’s Encrypt SSL certificate and configured to Nginx to use the certificates. At last, you have set up a cronjob for automatic certificate renewal.

If you want to know more about how to use Certbot, their documentation is a good starting point.

If our content helps you, please consider buying us a coffee

Thank you for your support.

Share On
Share on Facebook
Share on Twitter
Share on Reddit
Share on Tumblr
 Previous Article How to Set Up Nginx Server Blocks on Debian 9
Next Article   How to Install phpMyAdmin with Apache on CentOS 7

Related Posts

  • How to Change Hostname Debian 11

    How to Change Hostname on Debian 11

    February 3, 2023
  • How to Install Nginx on Ubuntu 22.04

    How to Install Nginx on Ubuntu 22.04

    January 28, 2023
  • How to Install Python 3.11 on Debian 11

    How to Install Python on Debian 11

    January 25, 2023

Leave a Reply Cancel reply

DigitalOcean Referral Badge

Popular Posts

  • How to Install SSH Keys on Ubuntu 22.04
    How to Set up SSH Keys on Ubuntu 22.04 January 7, 2023
  • How to Install Mongodb on Debian 11
    How to Install MongoDB on Debian 11 Linux January 11, 2023
  • How to Install Puppet Agent on Ubuntu 22.04
    How to Install Puppet Agent on Ubuntu 22.04 January 22, 2023
  • How to Install Jenkins on Debian 11
    How to Install Jenkins on Debian 11 January 5, 2023
  • How to Change-Hostname Ubuntu 22.04
    How to Change Hostname on Ubuntu 22.04 January 19, 2023
© 2020 TecNStuff All rights reserved. This website is using and storing cookies on your browser. By using this website you agree our Privacy Policy.  Follow us -  Twitter | Facebook