Let's Encrypt and Nginx
I'm late to the game, but I finally gave Let's Encrypt a try and I love it. The biggest advantage is the fact that SSL certificates can be completely automated. No more remembering how to renew certificates once a year.
These are mostly just notes for my future use, but maybe it will be useful for somebody. This is how I use Let's Encrypt with Nginx.
Install the letsencrypt client:
cd /opt
git clone https://github.com/letsencrypt/letsencrypt
VENV_PATH=/opt/letsencrypt/env/ /opt/letsencrypt/letsencrypt-auto plugins
Create a directory for the client to use for authorization:
mkdir -p /srv/www/letsencrypt
Then I put this into my nginx site config:
vim /etc/nginx/sites-enabled/example.com
location /.well-known/acme-challenge {
root /srv/www/letsencrypt;
}
service nginx reload
That allows the letsencrypt client to manage authorization files for my domain. And now I can generate the first certificate:
/opt/letsencrypt/env/bin/letsencrypt certonly --webroot -w /srv/www/letsencrypt/ -d example.com,www.example.com
Hopefully, that should generate a certificate and I can put them into the HTTPS section of my nginx config:
vim /etc/nginx/sites-enabled/example.com
ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
service nginx reload
And for the main benefit, I can now set up a cron job like this, that will make sure my certificates stay up to date:
10 20 * * * /opt/letsencrypt/env/bin/letsencrypt-renewer >/dev/null && service nginx reload >/dev/null