Let's Encrypt is a free, automated, and open certificate authority developed by the Internet Security Research Group (ISRG) that provides free SSL certificates.

Prerequisites

Before you proceed, make sure that you have met the following prerequisites:

  • You have a domain name pointing to your public IP. We'll use example.com.
  • You have Nginx installed on your  server.
  • Your firewall is configured to accept connections on ports 80 and 443.

Installing Certbot

$ sudo wget -P /usr/local/bin https://dl.eff.org/certbot-auto
$ sudo chmod +x /usr/local/bin/certbot-auto

Generate a new set of 4096 bit DH (Diffie–Hellman) parameters by typing the following command:

$ sudo openssl dhparam -out /etc/ssl/certs/dhparam.pem 4096

Obtaining a Let's Encrypt SSL certificate

The following commands will create the directory and make it writable for the Nginx server.

$ sudo mkdir -p /var/lib/letsencrypt/.well-known
$ sudo chgrp nginx /var/lib/letsencrypt
$ sudo chmod g+s /var/lib/letsencrypt

To avoid duplicating code, create the following two snippets which will be included in all Nginx server block files:

$ sudo mkdir /etc/nginx/snippets

/etc/nginx/snippets/letsencrypt.conf

location ^~ /.well-known/acme-challenge/ {
  allow all;
  root /var/lib/letsencrypt/;
  default_type "text/plain";
  try_files $uri =404;
}

/etc/nginx/snippets/ssl.conf

ssl_dhparam /etc/ssl/certs/dhparam.pem;
ssl_session_timeout 1d;
ssl_session_cache shared:SSL:10m;
ssl_session_tickets off;

ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
ssl_prefer_server_ciphers off;

ssl_stapling on;
ssl_stapling_verify on;
resolver 8.8.8.8 8.8.4.4 valid=300s;
resolver_timeout 30s;

add_header Strict-Transport-Security "max-age=63072000" always;
add_header X-Frame-Options SAMEORIGIN;
add_header X-Content-Type-Options nosniff;

Once the snippets are created, open the domain server block and include the letsencrypt.conf snippet, as shown below:

/etc/nginx/conf.d/example.com.conf

server {
  listen 80;
  server_name example.com www.example.com;

  include snippets/letsencrypt.conf;
}

Reload the Nginx configuration for changes to take effect:

$ sudo systemctl reload nginx

Run the certbot tool with the webroot plugin to obtain the SSL certificate files for your domain:

$ sudo /usr/local/bin/certbot-auto certonly --agree-tos --email admin@example.com --webroot -w /var/lib/letsencrypt/ -d example.com -d www.example.com

/etc/nginx/conf.d/example.com.conf

server {
listen
80;
server_name www.example.com example.com;

include snippets/letsencrypt.conf;
return 301 https://$host$request_uri;
}

server {
listen 443 ssl http2;
server_name www.example.com;

ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
ssl_trusted_certificate /etc/letsencrypt/live/example.com/chain.pem;
include snippets/ssl.conf;
include snippets/letsencrypt.conf;

return 301 https://example.com$request_uri;
}

server {
listen 443 ssl http2;
server_name example.com;

ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
ssl_trusted_certificate /etc/letsencrypt/live/example.com/chain.pem;
include snippets/ssl.conf;
include snippets/letsencrypt.conf;

# . . . other code
}

Finally, reload the Nginx service for changes to take effect:

$ sudo systemctl reload nginx

Auto-renewing Let's Encrypt SSL certificate

Let's Encrypt's certificates are valid for 90 days. To automatically renew the certificates before they expire, create a cronjob that will run twice a day and automatically renew any certificate 30 days before expiration.

$ sudo crontab -e

Paste the following line:

0 */12 * * * root test -x /usr/local/bin/certbot-auto -a \! -d /run/systemd/system && perl -e 'sleep int(rand(3600))' && /usr/local/bin/certbot-auto -q renew --renew-hook "systemctl reload nginx"

$ sudo ./certbot-auto renew --dry-run

Conclusion

If there are no errors, it means that the test renewal process was successful.

To learn more about Certbot, visit their documentation page.