Let's Encrypt SSL: Installing on Nginx with Auto-Renewal

Let's Encrypt issues free 90-day certificates with automatic renewal. Here is how to set it up on Nginx.

Installing Certbot

apt install certbot python3-certbot-nginx
certbot --nginx -d yourdomain.com -d www.yourdomain.com

Certbot configures Nginx and adds HTTPS for you.

Configuring Nginx by hand

server {
    listen 443 ssl http2;
    server_name yourdomain.com;

    ssl_certificate /etc/letsencrypt/live/yourdomain.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/yourdomain.com/privkey.pem;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;

    add_header Strict-Transport-Security "max-age=31536000" always;
    ssl_stapling on;
    ssl_stapling_verify on;
}

server {
    listen 80;
    server_name yourdomain.com www.yourdomain.com;
    return 301 https://yourdomain.com$request_uri;
}

Auto-renewal

Certbot installs a systemd timer automatically. Check it:

systemctl status certbot.timer
certbot renew --dry-run  # test the renewal

Alternative: acme.sh

curl https://get.acme.sh | sh
acme.sh --issue -d yourdomain.com --nginx
acme.sh --install-cert -d yourdomain.com   --key-file /etc/ssl/yourdomain.key   --fullchain-file /etc/ssl/yourdomain.crt   --reloadcmd "systemctl reload nginx"

Need a hand? Order SSL setup.