> For the complete documentation index, see [llms.txt](https://paul-gleason.gitbook.io/nginx/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://paul-gleason.gitbook.io/nginx/subsection/updated-certbot-guide.md). # Updated Certbot Guide ## Nginx Install ``` sudo apt update sudo apt install nginx ``` ## Certbot Resource link: ; Install: Nginx Certbot ``` apt install python3 python3-venv libaugeas0 python3 -m venv /opt/certbot/ /opt/certbot/bin/pip install --upgrade pip /opt/certbot/bin/pip install certbot certbot-nginx ln -s /opt/certbot/bin/certbot /usr/bin/certbot ``` #### Install: cloudflare plugin ``` /opt/certbot/bin/pip install certbot certbot-dns-cloudflare ``` ## Option 1: User nginx reverse proxy with certbot nginx ### Make Nginx config: Make file for domain: ``` sudo nano /etc/nginx/sites-available/yourdomain.com ``` Config setup: (This config will be auto managed by cert bot) ``` server { listen 80; server_name .yourdomain.com; location / { proxy_pass http://your_backend_server_address; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; } } ``` Now simlink your available site to enabled: ``` sudo ln -s /etc/nginx/sites-available/yourdomain.com /etc/nginx/sites-enabled/ ``` Now test config and restart nginx: ``` nginx -t systemctl restart nginx ``` ### Make nginx cert ``` certbot --nginx ``` Follow instructions on screen (Adding screenshots soon) Test cert renew: ``` sudo certbot renew --dry-run ``` ## Option 2: User nginx reverse proxy with certbot cloudflare ### Cloudflare API token used by Certbot Make .ini file for domain in: ``` mkdir -p /home//.secrets/certbot/ /home//.secrets/certbot/ ``` Contents in file: ``` dns_cloudflare_api_token = YOUR_CLOUDFLARE_API_TOKEN ``` Save and close file Now change file permissions: ``` chmod 600 /path/to/file/.ini ``` Make cert: ``` certbot certonly \ --dns-cloudflare \ --dns-cloudflare-credentials /home//.secrets/certbot/.ini \ --dns-cloudflare-propagation-seconds 60 \ -d "*.example.com" ``` Test cert renew: ``` sudo certbot renew --dry-run ``` ### Make Nginx config: #### Root-Domain: This section is for if you're making a nginx reverse proxy for just your root domain and no subdomains. Make file for domain: ``` sudo nano /etc/nginx/sites-available/yourdomain.com ``` Config setup: (This config WON'T be auto managed by certbot) ``` server { listen 443 ssl http2; server_name yourdomain.com; ssl_certificate /etc/letsencrypt/live/yourdomain.com/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/yourdomain.com/privkey.pem; ssl_protocols TLSv1.2 TLSv1.3; ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256'; ssl_prefer_server_ciphers on; ssl_session_cache shared:SSL:10m; ssl_session_timeout 1d; ssl_session_tickets off; ssl_stapling on; ssl_stapling_verify on; resolver 8.8.8.8 8.8.4.4 valid=300s; resolver_timeout 5s; add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; add_header X-Content-Type-Options nosniff; add_header X-Frame-Options SAMEORIGIN; add_header X-XSS-Protection "1; mode=block"; location / { proxy_pass http://your_backend_server_address; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; } } ``` #### Sub-Domain: This section is for if you're using sub-domains. Make file for domain: ``` sudo nano /etc/nginx/sites-available/.yourdomain.com ``` Config setup: (This config WON'T be auto managed by certbot) ``` server { listen 443 ssl http2; server_name .yourdomain.com; ssl_certificate /etc/letsencrypt/live/yourdomain.com/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/yourdomain.com/privkey.pem; ssl_protocols TLSv1.2 TLSv1.3; ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256'; ssl_prefer_server_ciphers on; ssl_session_cache shared:SSL:10m; ssl_session_timeout 1d; ssl_session_tickets off; ssl_stapling on; ssl_stapling_verify on; resolver 8.8.8.8 8.8.4.4 valid=300s; resolver_timeout 5s; add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; add_header X-Content-Type-Options nosniff; add_header X-Frame-Options SAMEORIGIN; add_header X-XSS-Protection "1; mode=block"; location / { proxy_pass http://your_backend_server_address; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; } } ``` Now simlink your available site to enabled: ``` sudo ln -s /etc/nginx/sites-available/yourdomain.com /etc/nginx/sites-enabled/ ``` #### Now test config and restart nginx: ``` nginx -t systemctl restart nginx ``` ## Auto renew with cron ``` contrab -e # To renew on the first day of each month 0 0 1 * * root certbot renew --quiet ``` ## Extras ### Http Password: 
sudo apt-get update
sudo apt-get install apache2-utils

# -c is used to create the file
sudo htpasswd -c /etc/nginx/.<passwordfile> <username>

# If file already exsists and want to add user
sudo htpasswd /etc/nginx/.<passwordfile> <anotherusername>

# In nginx config add the line below in location
location / {
    auth_basic "Restricted Content";
    auth_basic_user_file /etc/nginx/.<passwordfile>; # The path to the password file
}