DEV Community: Mouhamadou Tidiane Seck

How to Obtain a Let's Encrypt SSL Certificate for Nginx on Ubuntu 22.04

Mouhamadou Tidiane Seck — Tue, 20 Aug 2024 00:00:54 +0000

Introduction

Securing your web server with SSL is a crucial step in protecting your users' data and ensuring the integrity of your web application. Let’s Encrypt is a popular service that offers free SSL certificates via an automated API, with Certbot as the most commonly used client. In this guide, we'll walk through the process of obtaining a Let’s Encrypt SSL certificate for Nginx on Ubuntu 22.04 using Certbot.

We won't delve deeply into SSL configuration, but by the end of this tutorial, you'll have a valid certificate that renews automatically. Plus, you'll know how to automate the reloading of your service to account for the renewed certificate.

Prerequisites

Before starting, ensure you have the following:

An Ubuntu 22.04 server with a non-root user configured with sudo privileges and a basic firewall.
Nginx installed, with a server block for your domain.
A domain name pointing to your server (replace your_domain in the tutorial with your actual domain).
Port 80 must be reachable from the internet. In standalone mode, Certbot runs its own temporary web server on this port, so Nginx has to be stopped while a certificate is issued or renewed (Step 2 automates this with hooks). If you prefer to keep Nginx running, consider using Certbot's webroot mode instead.

Step 1 — Installing Certbot

Certbot recommends using their snap package for installation. Snaps are supported on most Linux distributions, but you'll need snapd installed to manage snap packages. Ubuntu 22.04 supports snaps by default, so start by ensuring your snapd core is up to date:

sudo snap install core; sudo snap refresh core

If you have an older version of Certbot installed, remove it:

sudo apt remove certbot

Then, install the Certbot package:

sudo snap install --classic certbot

Finally, link the Certbot command to your path:

sudo ln -s /snap/bin/certbot /usr/bin/certbot

Certbot is now installed, and we can proceed to obtain our SSL certificate.

Step 2 — Running Certbot

Certbot needs to respond to a cryptographic challenge issued by the Let’s Encrypt API to prove that you control your domain. In standalone mode, it uses port 80 (HTTP) for this purpose. Open port 80 for the challenge and port 443 for the HTTPS traffic Nginx will serve:

sudo ufw allow 80
sudo ufw allow 443

Run Certbot to obtain your certificate, using the --standalone option to let Certbot handle the challenge with its built-in web server. Since Nginx already listens on port 80, the --pre-hook and --post-hook options stop Nginx before the challenge and start it again afterwards. Certbot saves these hooks and reuses them for every renewal:

sudo certbot certonly --standalone -d your_domain \
  --pre-hook "systemctl stop nginx" \
  --post-hook "systemctl start nginx"

You’ll need to enter an email address and accept the terms of service. If successful, Certbot will inform you where the certificates are stored.

Step 3 — Configuring Your Application

Configuring your application for SSL varies depending on the software you use, but let’s explore what Certbot has downloaded. List the directory containing your keys and certificates:

sudo ls /etc/letsencrypt/live/your_domain

The most commonly needed files are:

privkey.pem: This is the private key for your certificate. Keep this file secure and private.
fullchain.pem: This is your certificate bundled with any intermediate certificates. Most configurations refer to this file as the actual certificate.

For more details on the other files, check the Certbot documentation.

For Nginx, reference these two files in the server block of your site (for example /etc/nginx/sites-available/your_domain):

server {
    listen 443 ssl;
    listen [::]:443 ssl;
    server_name your_domain;

    ssl_certificate /etc/letsencrypt/live/your_domain/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/your_domain/privkey.pem;

    # your existing location blocks
}

Then test the configuration and reload Nginx:

sudo nginx -t
sudo systemctl reload nginx

Step 4 — Managing Automatic Renewals with Certbot

Let’s Encrypt certificates are valid for 90 days, encouraging users to automate the renewal process. The Certbot snap package handles this with a systemd timer, which runs twice daily and renews any certificate that is close to expiration. You can check the timer with:

systemctl list-timers | grep certbot

The hooks passed in Step 2 are stored in /etc/letsencrypt/renewal/your_domain.conf, so each renewal stops Nginx, renews the certificate, and starts Nginx again with the new certificate. You can confirm they were saved:

sudo cat /etc/letsencrypt/renewal/your_domain.conf

If another service uses the same certificate, place an executable script in /etc/letsencrypt/renewal-hooks/deploy/ to reload it after each renewal. Then perform a dry run to check for errors (this briefly stops and restarts Nginx):

sudo certbot renew --dry-run

If there are no errors, you're all set. Certbot will now automatically renew your certificate and execute the necessary commands.

Conclusion

In this tutorial, we installed the Let’s Encrypt Certbot client, obtained an SSL certificate using the standalone mode, configured Nginx to use it, and set up automatic renewals with custom hooks. This process provides a solid foundation for using Let’s Encrypt certificates with various services beyond the typical web server.

Notes

Written for Ubuntu 22.04 LTS with Nginx 1.18.0 from the Ubuntu repositories and Certbot from the snap store.

References

Configuring Nginx as a Reverse Proxy on Ubuntu 22.04

Mouhamadou Tidiane Seck — Mon, 19 Aug 2024 23:58:16 +0000

A reverse proxy is a server that sits between client devices and backend servers, forwarding client requests to the appropriate server. Nginx is commonly used as a reverse proxy due to its stability, simple configuration, and low resource consumption. In this guide, we'll walk through how to configure Nginx as a reverse proxy.

Network Architecture

A reverse proxy is often deployed between two networks, sometimes with a dedicated network interface for each:

External Interface: This interface is exposed to the internet and handles requests from external users.
Internal Interface: This interface communicates with the backend web servers that hold the requested information.

Here’s a diagram illustrating the basic flow:

External Users -> Reverse Proxy (Nginx) -> Internal Web Servers

Roles and Benefits of a Reverse Proxy

Using a reverse proxy like Nginx offers several advantages:

Load Balancing: Distributes incoming traffic across multiple web servers, improving performance and availability.
Traffic Management: Allows you to manage server maintenance or migrations without downtime.
Centralized Configuration: Manages access and configuration for multiple sites and web servers from a single location.
Traffic Optimization: Uses caching and compression to improve response times.
Enhanced Security: Handles SSL encryption and filters requests/URLs to increase security.

Configuring Nginx as a Reverse Proxy

Step 1 — Installing Nginx

Start by installing Nginx on your server:

Update the package index:

  sudo apt update

Install Nginx:

  sudo apt install nginx

Ensure Nginx is running:

  systemctl status nginx

Step 2 — Configuring the Firewall (Optional)

If your server’s firewall is active, you'll need to allow HTTP traffic:

Allow HTTP traffic:

  sudo ufw allow 'Nginx HTTP'

Step 3 — Creating a Configuration File

Create a configuration file for your site:

Use a text editor like nano to create a new configuration file in the /etc/nginx/sites-available/ directory:

  sudo nano /etc/nginx/sites-available/your_domain

Step 4 — Configuring the Server Block

Edit the server block configuration with your domain and application server address:

Insert the following configuration into your new file, replacing your_domain and app_server_address with your actual domain and the address of your application server (for example 127.0.0.1:8000):

  server {
      listen 80;
      listen [::]:80;

      server_name your_domain www.your_domain;

      location / {
          proxy_pass http://app_server_address;
          include proxy_params;
      }
  }

Step 5 — Activating the Configuration

Activate the new configuration file:

Create a symbolic link from the configuration file to the directory that Nginx reads from at startup:

  sudo ln -s /etc/nginx/sites-available/your_domain /etc/nginx/sites-enabled/

Step 6 — Testing the Configuration

Test the Nginx configuration for syntax errors and then restart Nginx:

Verify the configuration:

  sudo nginx -t

Restart Nginx to apply the changes:

  sudo systemctl restart nginx

Optional: Using Gunicorn

If you need to run a Python web application, you can use Gunicorn as an application server:

Install Gunicorn:

  sudo apt install gunicorn

Create a test application that returns "Hello World!" in an HTTP response to verify Gunicorn is working correctly, for example in ~/wsgi.py:

  def app(environ, start_response):
      start_response("200 OK", [("Content-Type", "text/plain")])
      return [b"Hello World!\n"]

Start Gunicorn on the loopback interface, port 8000:

  gunicorn --chdir ~ --bind 127.0.0.1:8000 wsgi:app

Set proxy_pass http://127.0.0.1:8000; in your server block, reload Nginx with sudo systemctl reload nginx, then open http://your_domain: the response should be "Hello World!".

Conclusion

You have successfully configured Nginx as a reverse proxy for your websites. This setup not only optimizes traffic management but also enhances the security and scalability of your web infrastructure. Feel free to explore more Nginx features to further improve your deployment!

Notes

Written for Ubuntu 22.04 LTS with Nginx 1.18.0 and Gunicorn from the Ubuntu repositories.