DocCraft

English

中文

English

中文

Appearance

🔒 SSL/TLS Configuration ​

Why Do You Need HTTPS? ​

HTTP is like a postcard — the mail carrier (network middleman) can see the contents. HTTPS is like a sealed envelope — only the recipient can open it. Modern browsers display a "Not Secure" warning for websites that don't use HTTPS.

Using Let's Encrypt Free Certificates ​

bash
# Install certbot
sudo apt install -y certbot python3-certbot-nginx

# Automatically obtain certificate and configure Nginx
sudo certbot --nginx -d example.com -d www.example.com
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Requesting a certificate for example.com and www.example.com
Successfully received certificate.
Certificate is saved at: /etc/letsencrypt/live/example.com/fullchain.pem
Key is saved at:         /etc/letsencrypt/live/example.com/privkey.pem

# Set up auto-renewal (Let's Encrypt certificates expire after 90 days)
sudo certbot renew --dry-run
Congratulations, all simulated renewals succeeded

# Ensure auto-renewal cron job exists
sudo systemctl list-timers | grep certbot

Manual HTTPS Configuration ​

nginx
server {
    listen 443 ssl http2;
    server_name example.com;

    # Certificate paths
    ssl_certificate     /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

    # Security settings
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
    ssl_prefer_server_ciphers on;

    # Enable HSTS (tells browsers to only use HTTPS for this site)
    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains" always;

    # OCSP Stapling (speeds up certificate verification)
    ssl_stapling on;
    ssl_stapling_verify on;

    location / {
        root /var/www/html;
    }
}

# HTTP to HTTPS redirect
server {
    listen 80;
    server_name example.com;
    return 301 https://$host$request_uri;
}

⚠️ Note: ⚠️ HSTS warning: once HSTS is enabled, the browser will force HTTPS for the max-age period. If your certificate has issues, users won't be able to access your site via HTTP. Beginners should start with a small max-age (e.g., 300 seconds) for testing.

Related Posts