Start HTTPS with Let's Encrypt

作者 LinFeng 發佈於 135 字 1 分鐘閱讀

Reference document:

You can configure it step by step.

  1. install certbot

    1
2
3
4
5
6

    apt-get update
apt-get install software-properties-common
add-apt-repository universe
add-apt-repository ppa:certbot/certbot
apt-get update
apt-get install certbot

  2. generate SSL/TLS certificate file

    1

    certbot certonly --webroot -w /var/www/html -d example.com --email [email protected]

  3. then you can find the file in /etc/letsencrypt/live/example.com/

  4. modify nginx config

     1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

    # Session
ssl_session_cache shared:SSL:32m;
ssl_session_timeout 1d;

# HSTS
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;  

# Forward Secrecy 
ssl_protocols TLSv1.3 TLSv1.2 TLSv1.1 TLSv1;
ssl_prefer_server_ciphers on;
ssl_ciphers ECDH+AESGCM:ECDH+AES256:ECDH+AES128:DHE+AES128:!ADH:!AECDH:!MD5;

  5. then modify host config file and reload nginx

  6. now you can visit your website with https

  7. when ths certificate file is expired, you can execute certbot renew for update

  8. in addition, you can visit https://www.ssllabs.com/ssltest/ to test your website SSL/TLS config