Install and manage SSL certificates for encrypted connections.
apt install certbot -y
# For Nginx
apt install python3-certbot-nginx -y
certbot --nginx -d yourdomain.com -d www.yourdomain.com
# For Apache
apt install python3-certbot-apache -y
certbot --apache -d yourdomain.com -d www.yourdomain.com
apt install certbot -y
# For Nginx
apt install python3-certbot-nginx -y
certbot --nginx -d yourdomain.com -d www.yourdomain.com
# For Apache
apt install python3-certbot-apache -y
certbot --apache -d yourdomain.com -d www.yourdomain.com
Certbot automatically adds a renewal cron job. Verify it:
certbot renew --dry-run
certbot renew --dry-run
certbot certonly --manual --preferred-challenges dns \
-d "*.yourdomain.com" -d "yourdomain.com"
certbot certonly --manual --preferred-challenges dns \
-d "*.yourdomain.com" -d "yourdomain.com"
server {
listen 443 ssl http2;
server_name yourdomain.com;
ssl_certificate /etc/letsencrypt/live/yourdomain.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/yourdomain.com/privkey.pem;
# Modern SSL configuration
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
ssl_prefer_server_ciphers off;
# HSTS
add_header Strict-Transport-Security "max-age=63072000" always;
# OCSP Stapling
ssl_stapling on;
ssl_stapling_verify on;
}
# Redirect HTTP to HTTPS
server {
listen 80;
server_name yourdomain.com;
return 301 https://$server_name$request_uri;
}
server {
listen 443 ssl http2;
server_name yourdomain.com;
ssl_certificate /etc/letsencrypt/live/yourdomain.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/yourdomain.com/privkey.pem;
# Modern SSL configuration
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
ssl_prefer_server_ciphers off;
# HSTS
add_header Strict-Transport-Security "max-age=63072000" always;
# OCSP Stapling
ssl_stapling on;
ssl_stapling_verify on;
}
# Redirect HTTP to HTTPS
server {
listen 80;
server_name yourdomain.com;
return 301 https://$server_name$request_uri;
}
Use these tools to verify your SSL configuration:
openssl s_client -connect yourdomain.com:443echo | openssl s_client -connect yourdomain.com:443 2>/dev/null | openssl x509 -text