Let's Encrypt issues free 90-day certificates with automatic renewal. Here is how to set it up on Nginx.
Installing Certbot
apt install certbot python3-certbot-nginx certbot --nginx -d yourdomain.com -d www.yourdomain.com
Certbot configures Nginx and adds HTTPS for you.
Configuring Nginx by hand
server {
listen 443 ssl http2;
server_name yourdomain.com;
ssl_certificate /etc/letsencrypt/live/yourdomain.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/yourdomain.com/privkey.pem;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
add_header Strict-Transport-Security "max-age=31536000" always;
ssl_stapling on;
ssl_stapling_verify on;
}
server {
listen 80;
server_name yourdomain.com www.yourdomain.com;
return 301 https://yourdomain.com$request_uri;
}
Auto-renewal
Certbot installs a systemd timer automatically. Check it:
systemctl status certbot.timer certbot renew --dry-run # test the renewal
Alternative: acme.sh
curl https://get.acme.sh | sh acme.sh --issue -d yourdomain.com --nginx acme.sh --install-cert -d yourdomain.com --key-file /etc/ssl/yourdomain.key --fullchain-file /etc/ssl/yourdomain.crt --reloadcmd "systemctl reload nginx"
Need a hand? Order SSL setup.