Configuring LetsEncrypt for your web server is now a standard practice for any website operator. This guide outlines the core configurations to deploy a secure certificate using Certbot.
Prerequisites and Initial Setup
Before beginning the configuration, ensure your VPS has a DNS record pointing to it. You will need administrator rights and a HTTP daemon like Nginx. The Let's Encrypt client package must be set up via your OS repository. For example, on Ubuntu, run: `sudo apt install certbot` or `sudo yum install certbot`.
Obtaining the Certificate
The simplest method is to use the webroot plugin. For Nginx, the `--apache` or `--nginx` plugin can check here directly modify your virtual host. Run: `sudo certbot --apache -d example.com -d www.example.com`. This triggers the verification process. If you prefer a non-intrusive method, use: `sudo certbot certonly --webroot -w /var/www/html -d example.com`. This deposits a validation file in your document root.
Web Server Configuration Adjustments
After receiving the certificate, you must update your virtual host to use the correct paths. For Nginx, the usual directives are:
- ssl_certificate: `/etc/letsencrypt/live/example.com/fullchain.pem`
- ssl_certificate_key: `/etc/letsencrypt/live/example.com/privkey.pem`
Ensure you turn on HTTPS forwarding from HTTP to HTTPS. A permanent redirect is recommended. For Nginx, add a `return 301 https://$host$request_uri;` or use `RewriteEngine On` with `RewriteRule`.
Automated Renewal and Verification
Let's Encrypt certificates last 90 days. The client configures a cron job to update them automatically. To test the renewal process, run: `sudo certbot renew --dry-run`. Monitor your system logs for issues. If the renewal encounters a problem, troubleshoot for port 80 issues.
Security Hardening (Optional but Recommended)
To enhance security, implement STS headers by adding `add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;` in your server block. Also, turn off outdated TLS versions and prefer secure protocols. A solid configuration protects your visitors from vulnerabilities.
By adhering to these instructions, your web server will be protected with a cost-effective Let's Encrypt certificate, guaranteeing privacy for every session.