5 ms·

How to secure your website with Nginx and Let's Encrypt

48 points by shir0kamii 9y ago

chrisparton1991 9y ago
This is a nice, concise guide. I use LetsEncrypt for one of my sites running on a DigitalOcean box, they have some excellent documentation there as well. An alternative to LetsEncrypt is to sign up for Cloudflare's free tier. You get free SSL (using their shared certificate) and a bunch of other goodies. I have a couple of sites hosted on GitHub Pages using Cloudflare, so I have SSL and hosting at zero cost. Hard to beat that price!
- dasil003 9y ago
  The problem with that is that the connection from CloudFlare to your server is unencrypted. Ideally you will still have SSL implemented on your own server/network even when using a CDN provides it for the public facing domain.
  - chrisparton1991 9y ago
    Yep, agreed. I only use Cloudflare's SSL for a couple of static landing page websites. For things like that, I think Cloudflare is perfect. For anything else, I use LetsEncrypt.
  - johnny_reilly 9y ago
    > The problem with that is that the connection from CloudFlare to your server is unencrypted. Not necessarily - GitHub pages serves up HTTPS so you can be HTTPS all the way down the line
  - tatersolid 9y ago
    Cloudflare will issue you a cert from their internal CA so the POP-origin connection can be secured. But then you have to install and renew that cert on your origin. Turtles all the way down.
krono 9y ago
Automated with Docker, https://github.com/jwilder/nginx-proxy https://github.com/jwilder/nginx-proxy and https://github.com/JrCs/docker-letsencrypt-nginx-proxy-companion https://github.com/JrCs/docker-letsencrypt-nginx-proxy-compa...
eridius 9y ago
If you're looking to get a simple server up and running that supports Let's Encrypt, it's a lot easier to use Caddy¹ than it is to set up Nginx with LE. Out of the box Caddy will automatically secure all your sites with LE (and automatically redirect http to https), and it also makes a lot of other common configurations much simpler than Nginx does. Of course, there are still plenty of reasons to use Nginx, so documentation like this is great. But speaking as someone who had Nginx with LE set up and migrated over to Caddy some months ago, it's a lot simpler to manage my server (and especially set up new virtual hosts) now. ¹https://caddyserver.com https://caddyserver.com
- Xeoncross 9y ago
  The hard-sell when I first looked at caddy scared me away. "Non-commercial use only" isn't the kind of server I want to have as a default. Update: Looks like you can skip the marketing site and use the https://github.com/mholt/caddy#install https://github.com/mholt/caddy#install version for commercial projects (Apache 2.0).
  - mholt 9y ago
    > "Non-commercial use only" isn't the kind of server I want to have as a default. You mean, for free. (I'm not sure why businesses would expect that their critical software be free?) We sell commercial licenses of the binaries that of course allow commercial use. Or you can, as you said, build from source if you prefer to do that. The source code is Apache-licensed.
- DKnoll 9y ago
  What about Caddy made it easier? It's very simple to set up a basic Nginx site and run certbot... like 'under 5 minutes' simple.
  - eridius 9y ago
    Caddy does it all without needing an external dependency or crontab or custom configuration to handle the HTTP challenge. Caddy config files also just end up being simpler in general. When I moved from Nginx to Caddy my vhost files ended up at least 50% smaller, if not more, and with a lot less repetition. Note that when you create a new vhost in Caddy it automatically gets LE support. No need to update your crontab to pass the new domain to certbot.
Xeoncross 9y ago
It's even easier to just have certbot install and configure everything for you. https://certbot.eff.org/all-instructions/#ubuntu-16-10-yakkety-nginx https://certbot.eff.org/all-instructions/#ubuntu-16-10-yakke...
- rconti 9y ago
  Neat, thanks. This is exactly the workaround I was looking for but didn't search hard enough to find.
caio1982 9y ago
If you want the easy way but you are not using certbot you are doing it (quite possibly, you know, given the requirements, but your milage my vary anyway so oh wait this is becoming a disclaimer or what) wrong.
rconti 9y ago
Sounds like they're working on a new http challenge plugin for nginx that should solve this webroot hack/workaround for the fact that the existing nginx plugin for certbot only works over tls-sni-01 which has been disabled by the letsencrypt folks. I anxiously await it as it's easier to deal with the nginx plugin when you've already got nginx running for other reasons, rather than having to disable your existing webserver. Not thrilled about having to temporarily allow http, but c'est la vie. I wonder why we can't just have an https-based known-file challenge that works exactly like the http one, but over https, and just accepts whatever cert you throw at it initially.
- schoen 9y ago
  > I wonder why we can't just have an https-based known-file challenge that works exactly like the http one, but over https, and just accepts whatever cert you throw at it initially. This method was called HTTPS-01 and was initially discussed at the IETF ACME WG. My recollection is that it was rejected for a reason similar to why TLS-SNI-01 has just been disabled: many hosting providers' practices would designate one customer as the default HTTPS virtual host for all incoming HTTPS requests. Therefore, that customer would be in a position to get a certificate for any other customer on that infrastructure. This problem was easier to notice for HTTPS-01 than the corresponding problem with TLS-SNI-01 (which is that you can upload invalid certificates for names that aren't hosted on the infrastructure at all, and thereby get some shared hosting environments to believe that they're third-party certificates for your own sites that you've imported from elsewhere, while they're actually ACME challenge certificates for a different customer on the same infrastructure).
  - rconti 9y ago
    Thanks, that makes sense.
- JeanMarcS 9y ago
  You mean I spent last weekend learning how to update my DNS with nsupdate to replace the nginx sni broken challenge for nothing :-D ? Well, not for nothing as I now know better.
naggie 9y ago
I automated this and other standard nginx configurations with ansible for ubuntu 16.04. Here's the role: https://github.com/naggie/nginx-https-base https://github.com/naggie/nginx-https-base It uses webroot + certbot for zero downtime deployment, and provides neater error pages. Also gets an A+ on https://www.ssllabs.com/ssltest/ https://www.ssllabs.com/ssltest/ . Hopefully it's useful to someone.
agnivade 9y ago
Why not `certbot renew` for renewing certs and pace the cron job every 7 days or so ?
- shir0kamii 9y ago
  I didn't look into that command but will be looking soon, thanks for the tip!

48 points by shir0kamii 9y ago

chrisparton1991 9y ago

This is a nice, concise guide. I use LetsEncrypt for one of my sites running on a DigitalOcean box, they have some excellent documentation there as well. An alternative to LetsEncrypt is to sign up for Cloudflare's free tier. You get free SSL (using their shared certificate) and a bunch of other goodies. I have a couple of sites hosted on GitHub Pages using Cloudflare, so I have SSL and hosting at zero cost. Hard to beat that price!

dasil003 9y ago
The problem with that is that the connection from CloudFlare to your server is unencrypted. Ideally you will still have SSL implemented on your own server/network even when using a CDN provides it for the public facing domain.
- chrisparton1991 9y ago
  Yep, agreed. I only use Cloudflare's SSL for a couple of static landing page websites. For things like that, I think Cloudflare is perfect. For anything else, I use LetsEncrypt.
- johnny_reilly 9y ago
  > The problem with that is that the connection from CloudFlare to your server is unencrypted. Not necessarily - GitHub pages serves up HTTPS so you can be HTTPS all the way down the line
- tatersolid 9y ago
  Cloudflare will issue you a cert from their internal CA so the POP-origin connection can be secured. But then you have to install and renew that cert on your origin. Turtles all the way down.

krono 9y ago

Automated with Docker, https://github.com/jwilder/nginx-proxy https://github.com/jwilder/nginx-proxy and https://github.com/JrCs/docker-letsencrypt-nginx-proxy-companion https://github.com/JrCs/docker-letsencrypt-nginx-proxy-compa...

eridius 9y ago

If you're looking to get a simple server up and running that supports Let's Encrypt, it's a lot easier to use Caddy¹ than it is to set up Nginx with LE. Out of the box Caddy will automatically secure all your sites with LE (and automatically redirect http to https), and it also makes a lot of other common configurations much simpler than Nginx does. Of course, there are still plenty of reasons to use Nginx, so documentation like this is great. But speaking as someone who had Nginx with LE set up and migrated over to Caddy some months ago, it's a lot simpler to manage my server (and especially set up new virtual hosts) now. ¹https://caddyserver.com https://caddyserver.com

Xeoncross 9y ago
The hard-sell when I first looked at caddy scared me away. "Non-commercial use only" isn't the kind of server I want to have as a default. Update: Looks like you can skip the marketing site and use the https://github.com/mholt/caddy#install https://github.com/mholt/caddy#install version for commercial projects (Apache 2.0).
- mholt 9y ago
  > "Non-commercial use only" isn't the kind of server I want to have as a default. You mean, for free. (I'm not sure why businesses would expect that their critical software be free?) We sell commercial licenses of the binaries that of course allow commercial use. Or you can, as you said, build from source if you prefer to do that. The source code is Apache-licensed.
DKnoll 9y ago
What about Caddy made it easier? It's very simple to set up a basic Nginx site and run certbot... like 'under 5 minutes' simple.
- eridius 9y ago
  Caddy does it all without needing an external dependency or crontab or custom configuration to handle the HTTP challenge. Caddy config files also just end up being simpler in general. When I moved from Nginx to Caddy my vhost files ended up at least 50% smaller, if not more, and with a lot less repetition. Note that when you create a new vhost in Caddy it automatically gets LE support. No need to update your crontab to pass the new domain to certbot.

Xeoncross 9y ago

It's even easier to just have certbot install and configure everything for you. https://certbot.eff.org/all-instructions/#ubuntu-16-10-yakkety-nginx https://certbot.eff.org/all-instructions/#ubuntu-16-10-yakke...

rconti 9y ago
Neat, thanks. This is exactly the workaround I was looking for but didn't search hard enough to find.

caio1982 9y ago

If you want the easy way but you are not using certbot you are doing it (quite possibly, you know, given the requirements, but your milage my vary anyway so oh wait this is becoming a disclaimer or what) wrong.

rconti 9y ago

Sounds like they're working on a new http challenge plugin for nginx that should solve this webroot hack/workaround for the fact that the existing nginx plugin for certbot only works over tls-sni-01 which has been disabled by the letsencrypt folks. I anxiously await it as it's easier to deal with the nginx plugin when you've already got nginx running for other reasons, rather than having to disable your existing webserver. Not thrilled about having to temporarily allow http, but c'est la vie. I wonder why we can't just have an https-based known-file challenge that works exactly like the http one, but over https, and just accepts whatever cert you throw at it initially.

schoen 9y ago
> I wonder why we can't just have an https-based known-file challenge that works exactly like the http one, but over https, and just accepts whatever cert you throw at it initially. This method was called HTTPS-01 and was initially discussed at the IETF ACME WG. My recollection is that it was rejected for a reason similar to why TLS-SNI-01 has just been disabled: many hosting providers' practices would designate one customer as the default HTTPS virtual host for all incoming HTTPS requests. Therefore, that customer would be in a position to get a certificate for any other customer on that infrastructure. This problem was easier to notice for HTTPS-01 than the corresponding problem with TLS-SNI-01 (which is that you can upload invalid certificates for names that aren't hosted on the infrastructure at all, and thereby get some shared hosting environments to believe that they're third-party certificates for your own sites that you've imported from elsewhere, while they're actually ACME challenge certificates for a different customer on the same infrastructure).
- rconti 9y ago
  Thanks, that makes sense.
JeanMarcS 9y ago
You mean I spent last weekend learning how to update my DNS with nsupdate to replace the nginx sni broken challenge for nothing :-D ? Well, not for nothing as I now know better.

naggie 9y ago

I automated this and other standard nginx configurations with ansible for ubuntu 16.04. Here's the role: https://github.com/naggie/nginx-https-base https://github.com/naggie/nginx-https-base It uses webroot + certbot for zero downtime deployment, and provides neater error pages. Also gets an A+ on https://www.ssllabs.com/ssltest/ https://www.ssllabs.com/ssltest/ . Hopefully it's useful to someone.

agnivade 9y ago

Why not `certbot renew` for renewing certs and pace the cron job every 7 days or so ?

shir0kamii 9y ago
I didn't look into that command but will be looking soon, thanks for the tip!