131 lines
2.6 KiB
Markdown
131 lines
2.6 KiB
Markdown
# 🔐 Certbot
|
||
|
||
## 📦 Install Certbot
|
||
|
||
```bash
|
||
sudo apt update
|
||
sudo apt install certbot python3-certbot-nginx -y
|
||
```
|
||
|
||
*Installs Certbot and the Nginx plugin to automatically manage certificates.*
|
||
|
||
---
|
||
|
||
## 🖥️ Method 1 – Standalone Mode
|
||
|
||
```bash
|
||
sudo certbot certonly --standalone -d www.example.com
|
||
```
|
||
|
||
💡 **Standalone mode** runs its own temporary server for domain verification.
|
||
|
||
* Use if **Nginx is not running** on port 80/443.
|
||
* Certificates saved in:
|
||
|
||
* `/etc/letsencrypt/live/<domain>/` → latest version (symlink)
|
||
* `/etc/letsencrypt/archive/<domain>/` → all versions
|
||
|
||
---
|
||
|
||
## 🌐 Method 2 – Webroot Mode
|
||
|
||
```bash
|
||
sudo certbot certonly --webroot -w /var/www/html -d www.example.com
|
||
```
|
||
|
||
💡 **Webroot mode** places verification files in your website’s public folder.
|
||
|
||
* `<path>` = Nginx document root
|
||
* Use if Nginx is running and serving your site.
|
||
|
||
---
|
||
|
||
## 🛠️ Method 3 – Nginx Plugin (Auto Configuration)
|
||
|
||
```bash
|
||
sudo certbot --nginx -d www.example.com -d example.com
|
||
```
|
||
|
||
💡 **Nginx plugin** automatically:
|
||
|
||
* Obtains SSL certificate
|
||
* Configures HTTPS in Nginx
|
||
* Adds HTTP → HTTPS redirect
|
||
* Reloads Nginx
|
||
|
||
---
|
||
|
||
## 🌱 Method 4 – Manual DNS Challenge (Wildcard)
|
||
|
||
```bash
|
||
sudo certbot certonly --manual --preferred-challenges dns -d "*.example.com" -d example.com
|
||
```
|
||
|
||
💡 **DNS challenge** is required for wildcard certificates or if HTTP verification isn’t possible.
|
||
|
||
* Add TXT record as instructed by Certbot
|
||
* Works even if Nginx is down or port 80 is blocked
|
||
|
||
---
|
||
|
||
## ♻️ Renew Certificates
|
||
|
||
### Automatic Renewal
|
||
|
||
```bash
|
||
sudo certbot renew
|
||
```
|
||
|
||
* Renews all certificates nearing expiration
|
||
|
||
### Force Renewal
|
||
|
||
```bash
|
||
sudo certbot renew --force-renewal
|
||
```
|
||
|
||
* Immediately renews certificates, even if not near expiry
|
||
|
||
### Test Renewal
|
||
|
||
```bash
|
||
sudo certbot renew --dry-run
|
||
```
|
||
|
||
* Tests renewal without making changes
|
||
|
||
---
|
||
|
||
## 🔄 Reload Nginx After Renewal
|
||
|
||
```bash
|
||
sudo systemctl reload nginx
|
||
```
|
||
|
||
* Apply new certificates without downtime
|
||
|
||
*Tip:* You can add a **deploy-hook** for automatic reload:
|
||
|
||
```bash
|
||
sudo certbot renew --deploy-hook "systemctl reload nginx"
|
||
```
|
||
|
||
---
|
||
|
||
## 📅 Tips & Best Practices
|
||
|
||
* Certificates expire every **90 days** — enable **auto-renewal**.
|
||
* Keep `/etc/letsencrypt/` **backed up** (contains keys and configs).
|
||
* Use **staging** for testing to avoid hitting rate limits:
|
||
|
||
```bash
|
||
sudo certbot --staging --nginx -d www.example.com
|
||
```
|
||
|
||
* Monitor renewal logs: `/var/log/letsencrypt/letsencrypt.log`
|
||
|
||
---
|
||
|
||
✨ **Result:** Fully automated HTTPS for Nginx with Let’s Encrypt certificates. Fast, free, and secure! 🔒🚀
|
||
|