keevitaja

How to setup Let's Encrypt for Nginx on Ubuntu 16.04 (including IPv6, HTTP/2 and A+ SLL rating)

There are two main modes to run the Let's Encrypt client (called Certbot):

• Standalone: replaces the webserver to respond to ACME challenges
• Webroot: needs your webserver to serve challenges from a known folder.

Webroot is better because it doesn't need to replace Nginx (to bind to port 80).

In the following, we're setting up mydomain.com. HTML is served from /var/www/mydomain, and challenges are served from /var/www/letsencrypt.

keevitaja

# Advanced config for NGINX
	server_tokens off;
	add_header X-XSS-Protection "1; mode=block";
	add_header X-Content-Type-Options nosniff;

# Redirect all HTTP traffic to HTTPS
server {
   listen 80;
   	server_name www.domain.com domain.com;
   	return 301 https://$host$request_uri;

keevitaja

# This versions uses ELB loadbalancing
# The ELB points to these two HAProxy hosts 
# The C-name of the Domain points to the ELB
# ELB -> HAPROXY 1 or 2 -> Varnish --> HIT or MISS  --> HAPROXY 1 or 2 -> Backend 1/2/3
vcl 4.0;
import directors;
backend haproxy1 {
    .host = "172.31.xx.235"; # back to HAPROXY-1 internal address
    .port = "8080";
    .probe = {