View source for Docs:04.2 Managing certificates for https

You can follow [https://certbot.eff.org/instructions instructions for using Certbot] depending on the set-up of your server.

Below you will also see instructions for the use of [https://help.ubuntu.com/community/UFW Uncomplicated Firewall] (ufw), you can read more about the opening of ports with ufw in [[Docs:03.2 Tinc server side prep|03.2 Tinc server side prep]]

Before proceeding, it is worth taking note of your current Ngix config set up, as some automated editing of the Nginx config will occur and you will need to do a manual check that everything is as it should be at the end of the following process.

<span id="certbot"></span>
== Certbot ==

After installing and setting up nginx install certbot and the nginx plugin:

<syntaxhighlight lang="bash">sudo apt install certbot python3-certbot-nginx</syntaxhighlight>
Make sure nginx ports are open by: - checking their status

<syntaxhighlight lang="shell">sudo ufw status</syntaxhighlight>
We need ‘Nginx Full’ enabled with:

<syntaxhighlight lang="shell">sudo ufw allow 'Nginx Full'</syntaxhighlight>
Delete any other http etc, e.g.

<syntaxhighlight lang="shell">sudo ufw delete allow 'Nginx HTTP'</syntaxhighlight>
Your status should now look something like this:

<pre>sudo ufw status
</pre>
<pre>OutputStatus: active

To                         Action      From
--                         ------      ----
OpenSSH                    ALLOW       Anywhere
Nginx Full                 ALLOW       Anywhere
OpenSSH (v6)               ALLOW       Anywhere (v6)
Nginx Full (v6)            ALLOW       Anywhere (v6)</pre>
Register with certbot

<syntaxhighlight lang="shell">sudo certbot register</syntaxhighlight>
You will then enter emails and agree to terms and bits.

Then to start cerifying use

<syntaxhighlight lang="shell">sudo certbot --nginx</syntaxhighlight>
It will then ask which site to certify, press enter to do them all.

NOTE: It will then auto paste details for the certificates into your Nginx config, these will probably need editing, but will contain the right paths for your ssl certificate!

Certbot should now automatically keep your certificates updated.

[[Category:Docs]]