They’ve really improved the procedure for certificates! Thought I’d give a short example, but it’s always annoying to find incomplete instructions, so.
Let’s Encrypt with Nginx on Ubuntu 16.04
Install Nginx
apt install -y nginx
Install Certbot
apt-add-repository -y ppa:certbot/certbot
apt update
apt install -y python-certbot-nginx
Configure Nginx
openssl dhparam -out /etc/nginx/dhparam.pem 4096
rm /etc/nginx/sites-enabled/default
Add following to /etc/nginx/conf.d/chat.nubits.com.conf
server {
server_name chat.nubits.com;
listen 80;
listen [::]:80;
}
server {
server_name chat.nubits.com;
listen 443 ssl http2;
listen [::]:443 ssl http2;
ssl_dhparam /etc/nginx/dhparam.pem;
ssl_ciphers EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH;
ssl_ecdh_curve secp384r1; # Requires nginx >= 1.1.0
ssl_protocols TLSv1.2;
ssl_prefer_server_ciphers on;
ssl_session_cache shared:SSL:10m;
ssl_session_tickets off; # Requires nginx >= 1.5.9
ssl_stapling on; # Requires nginx >= 1.3.7
ssl_stapling_verify on; # Requires nginx >= 1.3.7
#add_header Strict-Transport-Security "max-age=63072000; includeSubdomains; preload";
add_header X-Content-Type-Options nosniff;
#add_header X-Frame-Options DENY;
resolver 8.8.8.8 8.8.4.4 valid=300s;
resolver_timeout 5s;
}
Check Nginx configuration
nginx -t
Start Nginx
systemctl enable nginx
systemctl start nginx
Acquire TLS certificate
certbot -n --nginx --agree-tos --no-eff-email --rsa-key-size 4096 --redirect --email team@nubits.com -d chat.nubits.com
Enable automatic renewal
crontab -e
Enter following at bottom.
15 3 * * * /usr/bin/certbot renew --quiet
