{"id":74,"date":"2019-02-18T19:25:50","date_gmt":"2019-02-18T11:25:50","guid":{"rendered":"https:\/\/freeapp.sbs\/blog\/?p=74"},"modified":"2025-04-01T17:10:08","modified_gmt":"2025-04-01T08:10:08","slug":"gdyhhpramtn5lxq","status":"publish","type":"post","link":"https:\/\/eternalsphere.net\/echoes\/index.php\/2019\/02\/18\/gdyhhpramtn5lxq\/","title":{"rendered":"How To Secure Nginx with Let&#8217;s Encrypt on CentOS 7"},"content":{"rendered":"\n<h3 class=\"wp-block-heading\" id=\"introduction\">Introduction<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Let&#8217;s Encrypt is a new Certificate Authority (CA) that provides an easy way to obtain and install free TLS\/SSL certificates, thereby enabling encrypted HTTPS on web servers. It simplifies the process by providing a software client, Certbot, that attempts to automate most (if not all) of the required steps. Currently, the entire process of obtaining and installing a certificate is fully automated on both Apache and Nginx web servers.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In this tutorial, we will show you how to use the&nbsp;<code>certbot<\/code>&nbsp;Let&#8217;s Encrypt client to obtain a free SSL certificate and use it with Nginx on CentOS 7. We will also show you how to automatically renew your SSL certificate.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"prerequisites\">Prerequisites<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Before following this tutorial, you&#8217;ll need a few things.<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>A CentOS 7 server with a non-root user who has&nbsp;<code>sudo<\/code>&nbsp;privileges. You can learn how to set up such a user account by following steps 1-3 in our&nbsp;<a href=\"https:\/\/www.digitalocean.com\/community\/articles\/initial-server-setup-with-centos-7\">initial server setup for CentOS 7 tutorial<\/a>.<\/li><li>You must own or control the registered domain name that you wish to use the certificate with. If you do not already have a registered domain name, you may register one with one of the many domain name registrars out there (e.g. Namecheap, GoDaddy, etc.).<\/li><li>A DNS&nbsp;<strong>A Record<\/strong>&nbsp;that points your domain to the public IP address of your server. This is required because of how Let&#8217;s Encrypt validates that you own the domain it is issuing a certificate for. For example, if you want to obtain a certificate for&nbsp;<code>example.com<\/code>, that domain must resolve to your server for the validation process to work. Our setup will use&nbsp;<strong>example.com<\/strong>&nbsp;and&nbsp;<strong><a href=\"http:\/\/www.example.com\/\">www.example.com<\/a><\/strong>&nbsp;as the domain names, so&nbsp;<strong>both DNS records are required<\/strong>.<\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Once you have all of the prerequisites out of the way, let&#8217;s move on to installing the Let&#8217;s Encrypt client software.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"step-1-\u2014-installing-the-certbot-let-39-s-encrypt-client\">Step 1 \u2014 Installing the Certbot Let&#8217;s Encrypt Client<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The first step to using Let&#8217;s Encrypt to obtain an SSL certificate is to install the&nbsp;<code>certbot<\/code>&nbsp;software on your server. Currently, the best way to install this is through the EPEL repository.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Enable access to the EPEL repository on your server by typing:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo yum install epel-release<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Once the repository has been enabled, you can obtain the&nbsp;<code>certbot-nginx<\/code>&nbsp;package by typing:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo yum install certbot-nginx<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The&nbsp;<code>certbot<\/code>&nbsp;Let&#8217;s Encrypt client is now installed and ready to use.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"step-2-\u2014-setting-up-nginx\">Step 2 \u2014 Setting up Nginx<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">If you haven&#8217;t installed Nginx yet, you can do so now. The EPEL repository should already be enabled from the previous section, so you can install Nginx by typing:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo yum install nginx<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Then, start Nginx using&nbsp;<code>systemctl<\/code>:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo systemctl start nginx<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Certbot can automatically configure SSL for Nginx, but it needs to be able to find the correct&nbsp;<code>server<\/code>&nbsp;block in your config. It does this by looking for a&nbsp;<code>server_name<\/code>&nbsp;directive that matches the domain you&#8217;re requesting a certificate for. If you&#8217;re starting out with a fresh Nginx install, you can update the default config file:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo vi \/etc\/nginx\/nginx.conf<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Find the existing&nbsp;<code>server_name<\/code>&nbsp;line:\/etc\/nginx\/sites-available\/default<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>server_name _;<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Replace the&nbsp;<code>_<\/code>&nbsp;underscore with your domain name:\/etc\/nginx\/nginx.conf<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>server_name example.com www.example.com;<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Save the file and quit your editor. Verify the syntax of your configuration edits with:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo nginx -t<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">If that runs with no errors, reload Nginx to load the new configuration:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo systemctl reload nginx<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Certbot will now be able to find the correct&nbsp;<code>server<\/code>&nbsp;block and update it. Now we&#8217;ll update our firewall to allow HTTPS traffic.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"step-3-\u2014-updating-the-firewall\">Step 3 \u2014 Updating the Firewall<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">If you have a firewall enabled, make sure port 80 and 443 are open to incoming traffic. If you are not running a firewall, you can skip ahead.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If you have a&nbsp;<strong>firewalld<\/strong>&nbsp;firewall running, you can open these ports by typing:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo firewall-cmd --add-service=http\nsudo firewall-cmd --add-service=https\nsudo firewall-cmd --runtime-to-permanent<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">If have an&nbsp;<strong>iptables<\/strong>&nbsp;firewall running, the commands you need to run are highly dependent on your current rule set. For a basic rule set, you can add HTTP and HTTPS access by typing:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo iptables -I INPUT -p tcp -m tcp --dport 80 -j ACCEPT\nsudo iptables -I INPUT -p tcp -m tcp --dport 443 -j ACCEPT<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">We&#8217;re now ready to run Certbot and fetch our certificates.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"step-4-\u2014-obtaining-a-certificate\">Step 4 \u2014 Obtaining a Certificate<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Certbot provides a variety of ways to obtain SSL certificates, through various plugins. The Nginx plugin will take care of reconfiguring Nginx and reloading the config whenever necessary:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo certbot --nginx -d example.com -d www.example.com<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">This runs&nbsp;<code>certbot<\/code>&nbsp;with the&nbsp;<code>--nginx<\/code>&nbsp;plugin, using&nbsp;<code>-d<\/code>&nbsp;to specify the names we&#8217;d like the certificate to be valid for.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If this is your first time running&nbsp;<code>certbot<\/code>, you will be prompted to enter an email address and agree to the terms of service. After doing so,&nbsp;<code>certbot<\/code>&nbsp;will communicate with the Let&#8217;s Encrypt server, then run a challenge to verify that you control the domain you&#8217;re requesting a certificate for.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If that&#8217;s successful,&nbsp;<code>certbot<\/code>&nbsp;will ask how you&#8217;d like to configure your HTTPS settings:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>OutputPlease choose whether HTTPS access is required or optional.\n-------------------------------------------------------------------------------\n1: Easy - Allow both HTTP and HTTPS access to these sites\n2: Secure - Make all requests redirect to secure HTTPS access\n-------------------------------------------------------------------------------\nSelect the appropriate number [1-2] then [enter] (press 'c' to cancel):<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Select your choice then hit&nbsp;<code>ENTER<\/code>. The configuration will be updated, and Nginx will reload to pick up the new settings.&nbsp;<code>certbot<\/code>&nbsp;will wrap up with a message telling you the process was successful and where your certificates are stored:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>OutputIMPORTANT NOTES:\n - Congratulations! Your certificate and chain have been saved at\n   \/etc\/letsencrypt\/live\/example.com\/fullchain.pem. Your cert will\n   expire on 2017-10-23. To obtain a new or tweaked version of this\n   certificate in the future, simply run certbot again with the\n   \"certonly\" option. To non-interactively renew *all* of your\n   certificates, run \"certbot renew\"\n - Your account credentials have been saved in your Certbot\n   configuration directory at \/etc\/letsencrypt. You should make a\n   secure backup of this folder now. This configuration directory will\n   also contain certificates and private keys obtained by Certbot so\n   making regular backups of this folder is ideal.\n - If you like Certbot, please consider supporting our work by:\n\n   Donating to ISRG \/ Let's Encrypt:   https:\/\/letsencrypt.org\/donate\n   Donating to EFF:                    https:\/\/eff.org\/donate-le<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Your certificates are downloaded, installed, and loaded. Try reloading your website using&nbsp;<code>https:\/\/<\/code>&nbsp;and notice your browser&#8217;s security indicator. It should represent that the site is properly secured, usually with a green lock icon.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/www.digitalocean.com\/community\/tutorials\/how-to-secure-nginx-with-let-s-encrypt-on-centos-7\">https:\/\/www.digitalocean.com\/community\/tutorials\/how-to-secure-nginx-with-let-s-encrypt-on-centos-7<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Introduction Let&#8217;s Encrypt is a new Certificate Authority (CA) that provides an easy way to obtain and install free TLS\/SSL certificates, thereby enabling encrypted HTTPS on web servers. It simplifies the process by providing a software client, Certbot, that attempts to automate most (if not all) of the required steps. &hellip;<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[29],"tags":[],"class_list":["post-74","post","type-post","status-publish","format-standard","hentry","category-vuwvtm6m4vkbg"],"_links":{"self":[{"href":"https:\/\/eternalsphere.net\/echoes\/index.php\/wp-json\/wp\/v2\/posts\/74","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/eternalsphere.net\/echoes\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/eternalsphere.net\/echoes\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/eternalsphere.net\/echoes\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/eternalsphere.net\/echoes\/index.php\/wp-json\/wp\/v2\/comments?post=74"}],"version-history":[{"count":1,"href":"https:\/\/eternalsphere.net\/echoes\/index.php\/wp-json\/wp\/v2\/posts\/74\/revisions"}],"predecessor-version":[{"id":2343,"href":"https:\/\/eternalsphere.net\/echoes\/index.php\/wp-json\/wp\/v2\/posts\/74\/revisions\/2343"}],"wp:attachment":[{"href":"https:\/\/eternalsphere.net\/echoes\/index.php\/wp-json\/wp\/v2\/media?parent=74"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/eternalsphere.net\/echoes\/index.php\/wp-json\/wp\/v2\/categories?post=74"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/eternalsphere.net\/echoes\/index.php\/wp-json\/wp\/v2\/tags?post=74"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}