TLS/SSL with Let's Encrypt

Get a Certificate with Certbot

sudo apt install -y certbot python3-certbot-nginx
sudo certbot --nginx -d example.com -d www.example.com

Certbot detects your server block, obtains a certificate from Let's Encrypt, configures HTTPS, and sets up auto-renewal. Test renewal:

sudo certbot renew --dry-run

Manual TLS Config (for self-signed or custom CAs)

server {
    listen 443 ssl;
    server_name example.com;

    ssl_certificate     /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
    root /var/www/example;
}

Modern TLS Settings

ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers HIGH:!aNULL:!MD5;
ssl_prefer_server_ciphers on;
# or just rely on the distro defaults in nginx.conf - often enough

Redirect HTTP to HTTPS and HSTS

server {
    listen 80;
    server_name example.com;
    return 301 https://$host$request_uri;
}

# inside the 443 block after you are sure HTTPS works:
add_header Strict-Transport-Security "max-age=31536000";

HTTP/2

With TLS configured, enable multiplexing: listen 443 ssl http2; (Nginx 1.25 uses the http2 directive).

Key Points

• Certbot automates issuance, wiring and renewal - use it.
• Serve only modern TLS; redirect port 80 to 443.
• Enable HSTS only after HTTPS fully works, or you lock users out.