gistfile1.txt

sudo git clone https://github.com/letsencrypt/letsencrypt /opt/letsencrypt

cd /opt/letsencrypt

sudo -H ./letsencrypt-auto certonly --standalone --renew-by-default -d example.com -d www.example.com

# cronjob, maandelijks
echo '@monthly root /opt/letsencrypt/letsencrypt-auto certonly --quiet --standalone --renew-by-default -d example.com -d www.example.com >> /var/log/letsencrypt/letsencrypt-auto-update.log' | sudo tee --append /etc/crontab

# /etc/nginx/sites-enabled/yourivanmill.nl
server {
        listen  80;
        listen  [::]:80;

        server_name yourivanmill.nl www.yourivanmill.nl;
        return 301 https://$server_name$request_uri;
}

server {
        listen 443 ssl;
        listen [::]:443 ssl;
        server_name yourivanmill.nl www.yourivanmill.nl;

        root /var/www/yourivanmill.nl/html;
        index index.html index.htm index.nginx-debian.html index.php;

        ssl on;
        ssl_certificate /etc/letsencrypt/live/yourivanmill.nl/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/yourivanmill.nl/privkey.pem;
        ssl_trusted_certificate /etc/letsencrypt/live/yourivanmill.nl/chain.pem;
        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
        ssl_ciphers HIGH:!aNULL:!MD5;

        location / {
                try_files $uri $uri/ =404;
        }

        location ~ \.php$ {
                fastcgi_pass    unix:/run/php/php7.0-fpm.sock;
                fastcgi_index   index.php;
                include         fastcgi_params;
                fastcgi_param   SCRIPT_FILENAME $document_root$fastcgi_script_n$
        }

        # Allow access to the letsencrypt ACME Challenge
        location ~ /\.well-known\/acme-challenge {
                allow all;
        }

        # deny access to .htaccess files, if Apache's document root
        # concurs with nginx's one
        #
        #location ~ /\.ht {
        #       deny all;
        #}
}