Using letsencrypt

letsencrypt.md

Download

git clone https://github.com/letsencrypt/letsencrypt
cd letsencrypt

Generate SSL certificate

./letsencrypt-auto certonly --webroot -w /usr/share/nginx/html -d www.deglet.xyz -d deglet.xyz

Update nginx config

server {
	listen 443;
	server_name deglet.xyz;

	ssl on;

	ssl_dhparam /etc/nginx/ssl/dhparams.pem;

	ssl_certificate /etc/letsencrypt/live/www.deglet.xyz/fullchain.pem;
	ssl_certificate_key /etc/letsencrypt/live/www.deglet.xyz/privkey.pem;

	ssl_session_cache shared:SSL:1m;
	ssl_session_timeout 1440m;

	ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
	ssl_prefer_server_ciphers on;

	ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA';

...
}

Renew SSL cert

./letsencrypt-auto --renew certonly --webroot -w /usr/share/nginx/html -d www.deglet.xyz -d deglet.xyz
sudo service nginx reload

Using crontab

(untested) Renew the certificate at midnight of the 1st day of every month, and then reload nginx 10 minutes later:

0 0 1 * * /path/to/letsencrypt/letsencrypt-auto --renew certonly --webroot -w /usr/share/nginx/html -d www.deglet.xyz -d deglet.xyz
10 0 1 * * service nginx reload

Others

• https://github.com/diafygi/acme-tiny/ might be good to alternative to ./letsencrypt-auto.
• https://github.com/kuba/simp_le
• https://gethttpsforfree.com/

List of other clients: https://community.letsencrypt.org/t/list-of-client-implementations/2103?u=pfg