Nginx and a free Let's Encrypt SSL certificate

Nginx is a fast web server and reverse proxy. Let's Encrypt issues free SSL certificates, and certbot renews them automatically.

Preparation

1. Point your domain's A record (for example, example.kz and www.example.kz) at your server's IP.
2. Open ports 80 and 443 in the firewall.

Install Nginx

apt update && apt install -y nginx        # Ubuntu, Debian
dnf install -y nginx && systemctl enable --now nginx   # AlmaLinux, Rocky

Open http://SERVER-IP — you should see the Nginx welcome page.

Site configuration

Create /etc/nginx/sites-available/example.kz (on AlmaLinux and Rocky — /etc/nginx/conf.d/example.kz.conf).

A static site:

server {
    listen 80;
    server_name example.kz www.example.kz;
    root /var/www/example.kz;
    index index.html;
}

A proxy for an app on port 3000:

server {
    listen 80;
    server_name example.kz www.example.kz;
    location / {
        proxy_pass http://127.0.0.1:3000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

Enable the site and check the configuration:

ln -s /etc/nginx/sites-available/example.kz /etc/nginx/sites-enabled/
nginx -t && systemctl reload nginx

Get a certificate

apt install -y certbot python3-certbot-nginx      # Ubuntu, Debian
dnf install -y certbot python3-certbot-nginx      # AlmaLinux, Rocky (requires EPEL)
certbot --nginx -d example.kz -d www.example.kz

Certbot adds HTTPS to the configuration and sets up the HTTP redirect. Check auto-renewal:

certbot renew --dry-run

Recommendations

• Enable HTTP/2: add http2 to the listen 443 ssl line or use the http2 on; directive.
• Turn on gzip on; for text files.
• Test your setup on ssllabs.com — aim for A or A+.