Enable SSL in NGINX Server

1. Abstract

This article presents a practical guide to enabling SSL/TLS encryption on Nginx using Certbot, a Let's Encrypt client. It covers system preparation, certificate acquisition, Nginx configuration, and security enhancements. This procedure ensures HTTPS availability with automatic renewal, improving site security and compliance.

2. Introduction

Secure Socket Layer (SSL) and its successor Transport Layer Security (TLS) are cryptographic protocols designed to secure communication over the internet. Enabling HTTPS (Hypertext Transfer Protocol Secure) is crucial for data protection and user trust.

Let's Encrypt is a free, automated, and open certificate authority that enables HTTPS for websites. Certbot is the official client used to request and renew these certificates. When used with Nginx, Certbot can automatically configure SSL settings.

3. System Requirements

To use Certbot with Nginx, the following prerequisites must be satisfied:

A Linux-based OS (Ubuntu, Debian, CentOS, etc.)
A registered domain name (e.g., example.com)
DNS A record pointing to your server IP
Root or sudo access to the server
Nginx installed and running

4. Installing Certbot and Nginx Plugin

1. On Ubuntu/Debian:

Ubuntu / Debian

sudo apt update
sudo apt install certbot python3-certbot-nginx

2. On CentOS/RHEL:

CentOS / RHEL

sudo yum install epel-release
sudo yum install certbot python3-certbot-nginx

5. Obtaining SSL Certificates

Option A: Automatic Configuration

Certbot can automatically detect and configure Nginx server blocks:

Run Certbot with Nginx plugin

sudo certbot --nginx

You will be prompted to:

Enter your domain name(s)
Choose whether to redirect HTTP to HTTPS
Agree to the Let's Encrypt terms of service

Certbot will issue the certificate, update your Nginx configuration, and reload Nginx automatically.

Option B: Manual Certificate Only (no auto-config)

This method provides more granular control over your Nginx configuration:

Manual certificate acquisition

sudo certbot certonly --nginx -d example.com -d www.example.com

6. Configuring Nginx for SSL

If Certbot didn’t automatically configure Nginx for you, manually update your server block:

/etc/nginx/sites-available/example.com

server {
    listen 443 ssl;
    server_name example.com www.example.com;

    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;

    root /var/www/html;
    index index.html index.htm;

    location / {
        try_files $uri $uri/ =404;
    }
}

# Redirect HTTP to HTTPS
server {
    listen 80;
    server_name example.com www.example.com;
    return 301 https://$host$request_uri;
}

Test and reload Nginx:

Reload Nginx

sudo nginx -t
sudo systemctl reload nginx

7. Renewing Certificates

Let's Encrypt certificates expire every 90 days. Certbot includes a built-in renewal system.

Test Auto-renewal:

Dry run renewal test

sudo certbot renew --dry-run

Set Up Cron or Systemd Timer (usually automatic):

Crontab renewal entry

sudo crontab -e
# Add the following entry:
0 2 * * * /usr/bin/certbot renew --quiet

8. Security Enhancements

For stronger SSL security, consider adding the following directives to your server block:

Enable HSTS (HTTP Strict Transport Security):

HSTS header

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

Enable OCSP Stapling:

OCSP stapling

ssl_stapling on;
ssl_stapling_verify on;

Generate and Use Diffie-Hellman Parameters:

Generate DH parameters

sudo openssl dhparam -out /etc/ssl/certs/dhparam.pem 4096

Then reference the generated file in Nginx:

Nginx ssl_dhparam directive

ssl_dhparam /etc/ssl/certs/dhparam.pem;

9. Conclusion

Enabling SSL/TLS on Nginx using Certbot is a straightforward and secure method to ensure encrypted communication on the web. The integration between Certbot and Nginx simplifies certificate issuance and renewal. By following best practices such as automatic renewal, strong ciphers, and modern security headers, administrators can protect their infrastructure and users from common web-based attacks.