sudo apt install certbot python3-certbot-nginx<\/code>\n\n\n\nCertbot is now ready for use, but we need to verify some Nginx configurations before it automatically configures SSL for Nginx.<\/p>\n\n\n\n
2.\u00a0Confirming Nginx\u2019s Configuration<\/h3>\n\n\n\n
For Certbot to be able to automatically configure SSL, it needs to be able to locate the correct server block in Nginx configuration. This works by searching for a ‘server_name’ directive that corresponds to the domain for which you are requesting a certificate.<\/p>\n\n\n\n
You should already have a server block for the domain at \/etc\/nginx\/sites-available\/example.com with the server_name directive set appropriately if followed the Nginx installation tutorial.<\/p>\n\n\n\n
In nano or any text editor, open the configuration file for the domain:<\/p>\n\n\n\nsudo nano \/etc\/nginx\/sites-available\/example.com<\/code>\n\n\n\nCheck to see if there is a server_name line already present. The format should be as follows:<\/p>\n\n\n\nserver_name example.com www.example.com; ...<\/code>\n\n\n\nContinue to the next step if it does.<\/p>\n\n\n\n
Update it if it doesn’t. Verify the syntax of its configuration edits after saving the file, quitting the editor:<\/p>\n\n\n\nsudo nginx \u2013t<\/code>\n\n\n\nIf users experience any error, reopen the server block file to evaluate any typos. Remove errors and keep the right syntax. Then, reload Nginx to deploy the new configuration through the following command.<\/p>\n\n\n\nsudo systemctl reload nginx<\/code>\n\n\n\nCertbot easily find and update the correct server block<\/p>\n\n\n\n
Next, allow HTTPS traffic to update the firewall settings.<\/p>\n\n\n\n
3.\u00a0Allowing HTTPS Through the Firewall<\/h3>\n\n\n\n
Next, users will have to adjust settings to allow HTTPS traffic. Before that, ensure the ufw firewall is enabled. It is recommended as the major prerequisite for a hassle-free installation process. When Nginx is installed, it automatically registers a few profiles with ufw.<\/p>\n\n\n\n
Check out the current setting by entering the following command in the terminal.<\/p>\n\n\n\nsudo ufw status<\/code>\n\n\n\nHere are the output users get while allowing HTTP traffic to the web server.<\/p>\n\n\n\n
Output<\/p>\n\n\n\n
Status: active<\/p>\n\n\n\n
To Action From<\/p>\n\n\n\n
— —— —-<\/p>\n\n\n\n
OpenSSH ALLOW Anywhere <\/p>\n\n\n\n
Nginx HTTP ALLOW Anywhere <\/p>\n\n\n\n
OpenSSH (v6) ALLOW Anywhere (v6) <\/p>\n\n\n\n
Nginx HTTP (v6) ALLOW Anywhere (v6)<\/p>\n\n\n\n
In order to allow HTTPS traffic, allow the Nginx Full profile and delete the redundant Nginx HTTP profile:<\/p>\n\n\n\nsudo ufw allow 'Nginx Full'<\/code>\n\n\n\nsudo ufw delete allow 'Nginx HTTP'<\/code>\n\n\n\nEnter this command to get final status.<\/p>\n\n\n\n
sudo ufw status<\/p>\n\n\n\n
The final output.<\/p>\n\n\n\n
Status: active<\/p>\n\n\n\n
To Action From<\/p>\n\n\n\n
— —— —-<\/p>\n\n\n\n
OpenSSH ALLOW Anywhere<\/p>\n\n\n\n
Nginx Full ALLOW Anywhere<\/p>\n\n\n\n
OpenSSH (v6) ALLOW Anywhere (v6)<\/p>\n\n\n\n
Nginx Full (v6) ALLOW Anywhere (v6)<\/p>\n\n\n\n
Next, fetch SSL certificates by running Certbot.<\/p>\n\n\n\n
4.\u00a0Get an SSL Certificate<\/h3>\n\n\n\n
Certbot has several plugins from which users can obtain SSL certificates. Nginx plugin helps in reconfiguring Nginx and reloading the config when required. Enter the following command to enable the plugin.<\/p>\n\n\n\nsudo certbot --nginx -d example.com -d www.example.com<\/code>\n\n\n\nBy using -d, we specify the domain names for which the certificate should be valid when we run certbot with the –nginx plugin.<\/p>\n\n\n\n
Your first time using certbot will require you to enter your email address and agree to the terms of service. Certbot will then communicate with the Let’s Encrypt server, and run a challenge to verify that you control the domain you’re requesting a certificate for.<\/p>\n\n\n\n
You’ll be prompted to configure your HTTPS settings if that’s successful.<\/p>\n\n\n\n
Output<\/strong><\/p>\n\n\n\nPlease choose whether or not to redirect HTTP traffic to HTTPS, removing HTTP access.<\/p>\n\n\n\n
– – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – –<\/p>\n\n\n\n
1: No redirect – Make no further changes to the webserver configuration.<\/p>\n\n\n\n
2: Redirect – Make all requests redirect to secure HTTPS access. Choose this for<\/p>\n\n\n\n
new sites, or if you’re confident your site works on HTTPS. You can undo this<\/p>\n\n\n\n
change by editing your web server’s configuration.<\/p>\n\n\n\n
– – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – –<\/p>\n\n\n\n
Select the appropriate number [1-2] then [enter] (press ‘c’ to cancel):<\/p>\n\n\n\n
Hit ENTER after selecting your choice. Latest configurations will get updated and Nginx will reload with new settings.<\/p>\n\n\n\n
Select your choice then hit ENTER. The configuration will be updated, and Nginx will reload to pick up the new settings. Then, Certbot gives a closure message showing the installation process successful.<\/p>\n\n\n\n
Output<\/strong><\/p>\n\n\n\nIMPORTANT NOTES:<\/strong><\/p>\n\n\n\n – Congratulations! Your certificate and chain have been saved at:<\/p>\n\n\n\n \/etc\/letsencrypt\/live\/example.com\/fullchain.pem<\/code>\n\n\n\n Your key file has been saved at:<\/p>\n\n\n\n \/etc\/letsencrypt\/live\/example.com\/privkey.pem<\/code>\n\n\n\n Your cert will expire on 2020-08-18. To obtain a new or tweaked<\/p>\n\n\n\n
version of this certificate in the future, simply run certbot again<\/p>\n\n\n\n
with the “certonly” option. To non-interactively renew *all* of<\/p>\n\n\n\n
your certificates, run “certbot renew”<\/p>\n\n\n\n
– If you like Certbot, please consider supporting our work by:<\/p>\n\n\n\n
Donating to ISRG \/ Let’s Encrypt: https:\/\/letsencrypt.org\/donate<\/p>\n\n\n\n
\u00a0\u00a0 Donating to EFF:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0https:\/\/eff.org\/donate-le<\/p>\n\n\n\n
Great, your certificates are downloaded and loaded. Reload the website using https:\/\/ and check the browser’s security indicator. Ensure websites have the lock icon. But your job is not done yet. Let\u2019s Encrypt certificates are valid till 90 days only. Hence, completing the renewal process is mandatory.<\/p>\n\n\n\n
5.\u00a0Auto Renewal of Certificates<\/h3>\n\n\n\n
<\/a>Certbot encourages users to automate their certificate renewal process. Use certbot to do a dry run of the renewal process.<\/p>\n\n\n\nsudo certbot renew --dry-run<\/code>\n\n\n\nAll you need to do is check for errors. Whenever necessary, Certbot will renew your certificates and reload Nginx. Let’s Encrypt will send you an email warning users when their certificate expires if the automated renewal process ever fails.<\/p>\n\n\n\n
\n
Key Takeaways<\/div>\n
\n
In this guide, readers successfully learnt to set up the Let’s Encrypt certbot client, acquiring SSL certificates for their domain, adjusted Nginx settings to utilize these certificates, and arranged for automatic certificate renewals. For further information, kindly connect with our technical engineers.<\/p>\n<\/div><\/div><\/p>\n","protected":false},"excerpt":{"rendered":"
Let\u2019s Encrypt is a (Certificate Authority) providing SSL\/TLS certificates. These certificates provide a secure encryption between the data and the browser. Certbot is a software client that automates the tasks of obtaining certificates and configuring web servers to use them. Currently, the process is fully automated on Apache and Nginx web servers. In this guide, […]<\/p>\n","protected":false},"author":35,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[41],"tags":[848,621],"class_list":["post-15073","post","type-post","status-publish","format-standard","placeholder-for-hentry","category-howtos","tag-nginx","tag-ubuntu"],"yoast_head":"\n
How to Secure Nginx with Let's Encrypt on Ubuntu 20.04?<\/title>\n<meta name=\"description\" content=\"Safeguarding Nginx nameserver with this guide and easy steps. Secure CentOS7 compliant servers with SSL certificates.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.milesweb.co.uk\/hosting-faqs\/how-to-secure-nginx-with-lets-encrypt-on-ubuntu-20-04\/\" \/>\n<meta property=\"og:locale\" content=\"en_GB\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"How to Secure Nginx with Let's Encrypt on Ubuntu 20.04?\" \/>\n<meta property=\"og:description\" content=\"Safeguarding Nginx nameserver with this guide and easy steps. Secure CentOS7 compliant servers with SSL certificates.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.milesweb.co.uk\/hosting-faqs\/how-to-secure-nginx-with-lets-encrypt-on-ubuntu-20-04\/\" \/>\n<meta property=\"og:site_name\" content=\"Web Hosting FAQs by MilesWeb\" \/>\n<meta property=\"article:published_time\" content=\"2023-09-21T08:32:42+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2023-09-21T08:32:43+00:00\" \/>\n<meta name=\"author\" content=\"Jackson Lane\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Jackson Lane\" \/>\n\t<meta name=\"twitter:label2\" content=\"Estimated reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.milesweb.co.uk\/hosting-faqs\/how-to-secure-nginx-with-lets-encrypt-on-ubuntu-20-04\/\",\"url\":\"https:\/\/www.milesweb.co.uk\/hosting-faqs\/how-to-secure-nginx-with-lets-encrypt-on-ubuntu-20-04\/\",\"name\":\"How to Secure Nginx with Let's Encrypt on Ubuntu 20.04?\",\"isPartOf\":{\"@id\":\"https:\/\/www.milesweb.co.uk\/hosting-faqs\/#website\"},\"datePublished\":\"2023-09-21T08:32:42+00:00\",\"dateModified\":\"2023-09-21T08:32:43+00:00\",\"author\":{\"@id\":\"https:\/\/www.milesweb.co.uk\/hosting-faqs\/#\/schema\/person\/1f580bdff0fa81720fae0fd0c3919758\"},\"description\":\"Safeguarding Nginx nameserver with this guide and easy steps. Secure CentOS7 compliant servers with SSL certificates.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.milesweb.co.uk\/hosting-faqs\/how-to-secure-nginx-with-lets-encrypt-on-ubuntu-20-04\/#breadcrumb\"},\"inLanguage\":\"en-GB\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.milesweb.co.uk\/hosting-faqs\/how-to-secure-nginx-with-lets-encrypt-on-ubuntu-20-04\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.milesweb.co.uk\/hosting-faqs\/how-to-secure-nginx-with-lets-encrypt-on-ubuntu-20-04\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.milesweb.co.uk\/hosting-faqs\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"How to Secure Nginx with Let’s Encrypt on Ubuntu 20.04?\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.milesweb.co.uk\/hosting-faqs\/#website\",\"url\":\"https:\/\/www.milesweb.co.uk\/hosting-faqs\/\",\"name\":\"Web Hosting FAQs by MilesWeb\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.milesweb.co.uk\/hosting-faqs\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-GB\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.milesweb.co.uk\/hosting-faqs\/#\/schema\/person\/1f580bdff0fa81720fae0fd0c3919758\",\"name\":\"Jackson Lane\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-GB\",\"@id\":\"https:\/\/www.milesweb.co.uk\/hosting-faqs\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/dd43b6ec8f85bdee32ceaac59c48807f?s=96&d=blank&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/dd43b6ec8f85bdee32ceaac59c48807f?s=96&d=blank&r=g\",\"caption\":\"Jackson Lane\"},\"description\":\"I am an experienced Marketing Manager at MilesWeb UK, a leading web hosting company in the UK. With extensive knowledge in web hosting, WordPress, digital marketing, and web development, I'm committed to helping businesses succeed online. His expertise and enthusiasm for the digital world make him a valuable asset in the constantly changing field of online marketing.\",\"url\":\"https:\/\/www.milesweb.co.uk\/hosting-faqs\/author\/jackson-lane\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"How to Secure Nginx with Let's Encrypt on Ubuntu 20.04?","description":"Safeguarding Nginx nameserver with this guide and easy steps. Secure CentOS7 compliant servers with SSL certificates.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.milesweb.co.uk\/hosting-faqs\/how-to-secure-nginx-with-lets-encrypt-on-ubuntu-20-04\/","og_locale":"en_GB","og_type":"article","og_title":"How to Secure Nginx with Let's Encrypt on Ubuntu 20.04?","og_description":"Safeguarding Nginx nameserver with this guide and easy steps. Secure CentOS7 compliant servers with SSL certificates.","og_url":"https:\/\/www.milesweb.co.uk\/hosting-faqs\/how-to-secure-nginx-with-lets-encrypt-on-ubuntu-20-04\/","og_site_name":"Web Hosting FAQs by MilesWeb","article_published_time":"2023-09-21T08:32:42+00:00","article_modified_time":"2023-09-21T08:32:43+00:00","author":"Jackson Lane","twitter_misc":{"Written by":"Jackson Lane","Estimated reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.milesweb.co.uk\/hosting-faqs\/how-to-secure-nginx-with-lets-encrypt-on-ubuntu-20-04\/","url":"https:\/\/www.milesweb.co.uk\/hosting-faqs\/how-to-secure-nginx-with-lets-encrypt-on-ubuntu-20-04\/","name":"How to Secure Nginx with Let's Encrypt on Ubuntu 20.04?","isPartOf":{"@id":"https:\/\/www.milesweb.co.uk\/hosting-faqs\/#website"},"datePublished":"2023-09-21T08:32:42+00:00","dateModified":"2023-09-21T08:32:43+00:00","author":{"@id":"https:\/\/www.milesweb.co.uk\/hosting-faqs\/#\/schema\/person\/1f580bdff0fa81720fae0fd0c3919758"},"description":"Safeguarding Nginx nameserver with this guide and easy steps. Secure CentOS7 compliant servers with SSL certificates.","breadcrumb":{"@id":"https:\/\/www.milesweb.co.uk\/hosting-faqs\/how-to-secure-nginx-with-lets-encrypt-on-ubuntu-20-04\/#breadcrumb"},"inLanguage":"en-GB","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.milesweb.co.uk\/hosting-faqs\/how-to-secure-nginx-with-lets-encrypt-on-ubuntu-20-04\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.milesweb.co.uk\/hosting-faqs\/how-to-secure-nginx-with-lets-encrypt-on-ubuntu-20-04\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.milesweb.co.uk\/hosting-faqs\/"},{"@type":"ListItem","position":2,"name":"How to Secure Nginx with Let’s Encrypt on Ubuntu 20.04?"}]},{"@type":"WebSite","@id":"https:\/\/www.milesweb.co.uk\/hosting-faqs\/#website","url":"https:\/\/www.milesweb.co.uk\/hosting-faqs\/","name":"Web Hosting FAQs by MilesWeb","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.milesweb.co.uk\/hosting-faqs\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-GB"},{"@type":"Person","@id":"https:\/\/www.milesweb.co.uk\/hosting-faqs\/#\/schema\/person\/1f580bdff0fa81720fae0fd0c3919758","name":"Jackson Lane","image":{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/www.milesweb.co.uk\/hosting-faqs\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/dd43b6ec8f85bdee32ceaac59c48807f?s=96&d=blank&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/dd43b6ec8f85bdee32ceaac59c48807f?s=96&d=blank&r=g","caption":"Jackson Lane"},"description":"I am an experienced Marketing Manager at MilesWeb UK, a leading web hosting company in the UK. With extensive knowledge in web hosting, WordPress, digital marketing, and web development, I'm committed to helping businesses succeed online. His expertise and enthusiasm for the digital world make him a valuable asset in the constantly changing field of online marketing.","url":"https:\/\/www.milesweb.co.uk\/hosting-faqs\/author\/jackson-lane\/"}]}},"views":0,"_links":{"self":[{"href":"https:\/\/www.milesweb.co.uk\/hosting-faqs\/wp-json\/wp\/v2\/posts\/15073","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.milesweb.co.uk\/hosting-faqs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.milesweb.co.uk\/hosting-faqs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.milesweb.co.uk\/hosting-faqs\/wp-json\/wp\/v2\/users\/35"}],"replies":[{"embeddable":true,"href":"https:\/\/www.milesweb.co.uk\/hosting-faqs\/wp-json\/wp\/v2\/comments?post=15073"}],"version-history":[{"count":3,"href":"https:\/\/www.milesweb.co.uk\/hosting-faqs\/wp-json\/wp\/v2\/posts\/15073\/revisions"}],"predecessor-version":[{"id":15076,"href":"https:\/\/www.milesweb.co.uk\/hosting-faqs\/wp-json\/wp\/v2\/posts\/15073\/revisions\/15076"}],"wp:attachment":[{"href":"https:\/\/www.milesweb.co.uk\/hosting-faqs\/wp-json\/wp\/v2\/media?parent=15073"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.milesweb.co.uk\/hosting-faqs\/wp-json\/wp\/v2\/categories?post=15073"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.milesweb.co.uk\/hosting-faqs\/wp-json\/wp\/v2\/tags?post=15073"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}