In this article, we want to teach you How To Secure Nginx with Let’s Encrypt on Ubuntu 20.04.
Let’s Encrypt is a Certificate Authority (CA) that provides an easy way to obtain and install free TLS/SSL certificates, thereby enabling encrypted HTTPS on web servers.
How To Secure Nginx with Let’s Encrypt on Ubuntu 20.04
Before you start to secure your Nginx, you need some requirements.
You need to log in to your server as a non-root user with sudo privileges and set up a basic firewall. To do this you can follow our article the Initial Server Setup with Ubuntu 20.04.
Also, you need to have Nginx installed on your server and set up its server block. For this, you can check How To Install Nginx on Ubuntu 20.04.
And you need to have a fully registered domain name that points to your server IP address.
Now follow the steps below to Secure Nginx with Let’s Encrypt.
Install Certbot on Ubuntu 20.04
Here you need to install certbot and its Nginx plugin with the following command:
sudo apt install certbot python3-certbot-nginx
Then, you should check the Nginx configuration file on Ubuntu 20.04 and check that the server name points to your domain name. Open the file with your favorite text editor, here we use vi:
sudo vi /etc/nginx/sites-available/example.com
Remember to replace your domain name in the commands.
Find the server_name line and it should look like this:
... server_name example.com www.example.com; ...
When you are done, save and close the file.
Verify your Nginx configuration edits on Ubuntu 20.04 with the following command:
sudo nginx -t
In your output you will see:
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful
Then, reload Nginx to apply the new changes:
sudo systemctl reload nginx
At this point, you should allow HTTPS through the firewall to secure your Nginx on Ubuntu 20.04. First, check your firewall status with the following command:
sudo ufw status
In your output you will see:
To Action From
-- ------ ----
Nginx HTTP ALLOW Anywhere
OpenSSH ALLOW Anywhere
Nginx HTTP (v6) ALLOW Anywhere (v6)
OpenSSH (v6) ALLOW Anywhere (v6)
You should allow Nginx Full through the firewall and delete the Nginx HTTP with the following commands on Ubuntu 20.04:
$ sudo ufw allow 'Nginx Full' $ sudo ufw delete allow 'Nginx HTTP'
Now you can start to run certbot and get your SSL certificate.
Get an SSL certificate with Let’s Encrypt on Ubuntu 20.04
Certbot provides different ways to get SSL certificates through plugins. The Nginx plugin will take care of reconfiguring Nginx and reloading the config whenever necessary on Ubuntu 20.04. To use this plugin, run the following command:
sudo certbot --nginx -d example.com
The above command will use for a single domain if you have multiple domains you can use the following command:
sudo certbot --nginx -d example.com -d www.example.com
You will be asked some questions. The first is to enter your email address and agree to the terms of service. Then, you will be asked Would you be willing to share your email address with the Electronic Frontier Foundation. Answer it by your choice. Also, certbot will ask you how you’d like to configure your HTTPS settings. Select your choice and hit enter.
in your output you will see:
Output IMPORTANT NOTES: - Congratulations! Your certificate and chain have been saved at: /etc/letsencrypt/live/example.com/fullchain.pem Your key file has been saved at: /etc/letsencrypt/live/example.com/privkey.pem Your cert will expire on 2022-03-08. To obtain a new or tweaked version of this certificate in the future, simply run certbot again with the "certonly" option. To non-interactively renew *all* of your certificates, run "certbot renew" - Your account credentials have been saved in your Certbot configuration directory at /etc/letsencrypt. You should make a secure backup of this folder now. This configuration directory will also contain certificates and private keys obtained by Certbot so making regular backups of this folder is ideal. - If you like Certbot, please consider supporting our work by: Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate Donating to EFF: https://eff.org/donate-le
sudo systemctl status certbot.timer
Output certbot.timer - Run certbot twice daily Loaded: loaded (/lib/systemd/system/certbot.timer; enabled; vendor preset> Active: active (waiting) since Wed 2021-12-08 13:25:17 CET; 28min ago Trigger: Thu 2021-12-09 06:43:40 CET; 16h left Triggers: ● certbot.service
sudo certbot renew --dry-run