WORK IN PROGRESS - I am converting these instructions to use acme.sh
I use X.509 certificates signed by Let's Encrypt for all of my internal services that use TLS, including web servers, mail servers, LDAPS server, etc.
I use security/acme.sh to help generate and automatically renew these certificates. Upstream instructions for how to use this tool are available at https://wiki.acme.sh/.
# pkg install acme.sh
Let's Encrypt will sign your certificate if you can demonstrate that you control the domain. It does this by issuing the client software with a challenge… For more information about how Let's Encrypt works, visit https://github.com/Neilpang/acme.sh/wiki/dnsapi. I use Gandi as my DNS provider, so I have followed the instructions at https://github.com/Neilpang/acme.sh/wiki/dnsapi#18-use-gandi-livedns-api.
After this, acme.sh can generate a new Let's Encrypt account key and certificate, get them signed, and install them with the following command:
...
This will give verbose output and perform the following:
Now that you have a signed certificate, re-configure nginx.conf to instead listen for HTTPS connections on port 443, and re-direct HTTP connections to HTTPS. Note that you must keep the directory alias for responding to Let's Encrypt challenges on HTTP port 80.
server {
listen 80;
server_name example.com www.example.com;
# Lets encrypt
location ^~ /.well-known/acme-challenge/ {
alias /usr/local/www/acme/;
}
# Redirect other HTTP connections to HTTPS
location / {
return 301 https://example.com$request_uri;
}
}
server {
listen 443 ssl;
server_name example.com www.example.com;
ssl_certificate /usr/local/etc/ssl/acme/fullchain.pem;
ssl_certificate_key /usr/local/etc/ssl/acme/private/privkey.pem;
... MOVE REMAINDER OF NGINX CONFIG FOR WEBSITE HERE
}
Restart nginx with:
# service nginx restart
In a web browser, go to http://example.com/ and confirm it re-directs to https://example.com/ and the browser trusts the certificate.
Now visit https://www.ssllabs.com/ssltest/ to see how your website scores, and close any security flaws as necessary.
Two of the common fixes that need to be applied are: