How to Secure Nginx with Let’s Encrypt on Debian 12, 11 or 10

Securing your Nginx server with Let’s Encrypt on Debian ensures robust encryption and enhanced security for your web applications. This straightforward process can significantly improve your website’s trustworthiness and performance.

• Free SSL/TLS Certificates: Let’s Encrypt provides free, automated, and open certificates, saving costs without compromising security.
• Automation: Easily automate certificate issuance and renewal with Certbot, reducing administrative overhead.
• Improved SEO: HTTPS is favored by search engines, potentially boosting your site’s ranking.
• Enhanced Security: Protect sensitive data with strong encryption, ensuring a secure connection between your server and clients.
• Trust and Credibility: Gain users’ trust with the HTTPS padlock icon, demonstrating a commitment to security.
• Compliance: Meet industry standards and regulatory requirements for data protection.

By securing your Nginx server with Let’s Encrypt on Debian, you can provide a secure browsing experience for your users while reaping the benefits of improved SEO and user trust.

Let’s dive into the steps required to set up and configure Let’s Encrypt on your Debian-based server.

Update Debian Package Repositories Before Certbot for Nginx Installation

Before installing Certbot, it’s crucial to ensure that the package repositories and the existing packages on your Debian system are updated. Keeping the system updated ensures you install the latest version of Certbot and dependencies.

Execute the following commands to update the package repositories and upgrade the existing packages:

sudo apt update
sudo apt upgrade

Install Certbot Nginx Plugin

Now that your Debian system is up to date, the next step is to install Certbot along with its Nginx plugin. The Nginx plugin is essential as it enables Certbot to interact with Nginx, automating the obtaining and renewing of certificates and configuring Nginx to use them.

Run the following command to install both Certbot and the Nginx plugin:

sudo apt install certbot python3-certbot-nginx

Certbot Configuration and SSL Certificate Generation

After successfully installing Certbot and its Nginx plugin, the next step involves running Certbot to generate and install an SSL certificate for your domain. To instruct Certbot that we’re using Nginx, we use the --nginx option. The command to run Certbot also includes various other options that contribute to a more secure setup.

The --agree-tos option tells Certbot that you agree to the terms of service of Let’s Encrypt. The --redirect option instructs Certbot to set up a permanent 301 redirect from HTTP to HTTPS, ensuring that all traffic to your site is encrypted. The --hsts option adds a Strict-Transport-Security header, enforcing secure connections to your server. Lastly, the --staple-ocsp option enables OCSP Stapling, a feature that improves the performance of SSL negotiation while maintaining visitor privacy.

The email address you provide with the --email option is used by Let’s Encrypt to send notifications related to your SSL certificate, such as renewal reminders and security notices.

Please replace you@example.com with your actual email address and yourdomain.com with your domain. Run the following command:

sudo certbot --nginx --agree-tos --redirect --hsts --staple-ocsp --email you@example.com -d yourdomain.com

Upon successfully executing the command, Certbot will generate an SSL certificate for your domain, configure Nginx to use this certificate, and apply the security options specified. Consequently, your server’s connection will be secure, and your website will be accessible via HTTPS.

Alternative Certbot Configuration Method

For those who prefer a more guided and interactive approach, Certbot provides an alternative method that prompts you for information and configuration choices. Here’s how to use this method:

Run the following command:

sudo certbot --nginx

Certbot will initiate an interactive session. Below is a walkthrough of the prompts you may encounter:

1. Enter email address (used for urgent renewal and security notices): Provide your email address. Let’s Encrypt will use this for communication regarding your certificates.
2. Agree to the Let’s Encrypt terms of service: You will be asked to agree to the terms of service. Input A to agree.
3. Share your email with the Electronic Frontier Foundation for updates on their work: If you want to support the EFF, input Y for yes. Otherwise, input N for no.
4. Which names would you like to activate HTTPS for: Certbot will display the domain names it can issue certificates for. Input the numbers corresponding to your domains or leave them blank for all.
5. Select the appropriate action: You will be given an option to either:
   • 1: Attempt to reinstall the certificate
   • 2: Renew & replace the certificate (limit ~5 per 7 days)
   Select the option that suits your needs.
6. Choose whether or not to redirect HTTP traffic to HTTPS: You will be asked if you want to redirect HTTP traffic to HTTPS. This is advisable for most websites:
   • 1: No redirect – Make no further changes to the webserver configuration.
   • 2: Redirect – Make all requests redirect to secure HTTPS access.
   Select option 2 for better security.

Once you have gone through all the prompts and the process is complete, Certbot will output a message similar to the one mentioned previously, indicating the location of your certificate files and further information.

Trial Run of Certificate Renewal

Before you commit to an automatic renewal schedule, it’s good practice to confirm that the renewal process functions correctly. You can do this by initiating a dry run, which simulates the renewal process without making any actual changes:

sudo certbot renew --dry-run

Setting up the Certificate Renewal Schedule

Provided that the dry run proceeds without any issues, you can now move on to scheduling automatic certificate renewals. To begin, open the crontab file in edit mode with this command:

sudo crontab -e

Next, append the following line at the bottom of the file. This line sets a daily renewal check at 2:30 AM:

30 2 * * * /usr/bin/certbot renew --quiet

Once you save and close the file, you’ve successfully set up an automatic process. Each day, cron will check whether any certificates need renewal. The --quiet flag ensures that this task runs in the background without generating output, unless an error arises.

Enhance SSL with NGINX Configuration

In this optional section, you’ll be tweaking your domain’s NGINX configuration to optimize performance. This involves setting up SSL certificates, configuring session parameters, and implementing security enhancements.

Edit the NGINX Configuration File

To start, you need to access the configuration file for your domain within NGINX. Execute the following command:

sudo nano /etc/nginx/sites-available/your_domain

This opens up the configuration file for your domain in a text editor called nano. Once you’re in, make the following adjustments within the server block.

Specify SSL Certificates and Key

First, set the path to your SSL certificate and its corresponding private key:

ssl_certificate /path/to/signed_cert_plus_intermediates;
ssl_certificate_key /path/to/private_key;

Configure SSL Sessions

Now, you need to configure the SSL session parameters. This controls how long sessions are stored and ensures efficient re-establishment of secure connections:

ssl_session_timeout 1d;
ssl_session_cache shared:MozSSL:10m;  # approximately 40000 sessions
ssl_session_tickets off;

Configure Diffie-Hellman Parameters

To further enhance security, you should configure Diffie-Hellman (DH) parameters. The DH algorithm ensures secure key exchanges when establishing an SSL/TLS connection.

To begin, generate a Diffie-Hellman parameter file. Generally, a longer key length equates to stronger security. Common key lengths are 2048 and 4096 bits. While 2048 bits are often deemed sufficient, opting for 4096 bits offers additional security, albeit at the expense of performance. Consider your security requirements and your server’s capabilities before making a decision.

To generate a 2048-bit DH parameter file, use the following command:

sudo openssl dhparam -out /etc/ssl/certs/dhparam.pem 2048

Alternatively, for heightened security, you can create a 4096-bit key by executing this command:

sudo openssl dhparam -out /etc/ssl/certs/dhparam.pem 4096

After generating the file, specify its location in your NGINX configuration. Update the ssl_dhparam directive with the path to the file you just created:

ssl_dhparam /etc/ssl/certs/dhparam.pem;

Set Protocols and Ciphers

To ensure high security and compatibility, specify which SSL protocols and ciphers should be used:

ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers [long string of ciphers here];
ssl_prefer_server_ciphers off;

Implement HSTS

Add HTTP Strict Transport Security (HSTS) to enforce secure connections:

add_header Strict-Transport-Security "max-age=63072000" always;

Enable OCSP Stapling

OCSP stapling is a feature that improves the SSL certificate verification process. Turn it on and ensure that the chain of trust is verified using Root CA and Intermediate certificates:

ssl_stapling on;
ssl_stapling_verify on;
ssl_trusted_certificate /path/to/root_CA_cert_plus_intermediates;

Specify DNS Resolver

Finally, set the IP address of your DNS resolver. This is essential for OCSP stapling:

resolver 1.1.1.1

Make sure you replace 1.1.1.1 with the actual IP address of your resolver if you do not want to use the one by Cloudflare.

Validate and Apply the Changes

Once you’re done, save and exit the file. It’s vital to validate your NGINX configuration to ensure no syntax errors. Run this command to check:

sudo nginx -t

If there are no issues, apply the changes by reloading NGINX:

sudo systemctl restart nginx

Conclusion

Throughout this article, we covered securing Nginx with Let’s Encrypt SSL certificates on Debian 10, 11, and 12. We emphasized the importance of SSL certificates for secure communication between servers and clients. Starting with installing Certbot, we explained how to obtain a free SSL certificate from Let’s Encrypt, configure Nginx to use the certificate, automate renewal with cron jobs, and enhance security with Diffie-Hellman parameters.

Finally, monitoring logs and keeping the system updated regularly is essential. These practices will help you stay informed about potential issues and protect your server against the latest security vulnerabilities.