SSL Certificate One-Click Setup (Certbot)

Quick Install & Certificate

# 1. Install Certbot
apt install certbot python3-certbot-nginx -y

# 2. Get certificate (Nginx)
certbot --nginx -d example.com -d www.example.com

# 3. Test auto-renewal
certbot renew --dry-run

# 4. Check certificate status
certbot certificates

Wildcard Certificate (Multiple Subdomains)

# Requires DNS challenge (DNS API plugin)
certbot certonly --manual --preferred-challenges dns \
  -d *.example.com -d example.com

# Or use DNS plugin (Cloudflare example)
certbot certonly --dns-cloudflare \
  --dns-cloudflare-credentials ~/.cloudflare/credentials \
  -d *.example.com -d example.com

Nginx SSL Configuration

server {
    listen 443 ssl http2;
    server_name example.com www.example.com;

    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
    ssl_trusted_certificate /etc/letsencrypt/live/example.com/chain.pem;

    # Modern TLS config
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
    ssl_prefer_server_ciphers off;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 1d;

    # HSTS (uncomment after confirming HTTPS works)
    # add_header Strict-Transport-Security "max-age=63072000" always;
}

# HTTP redirect
server {
    listen 80;
    server_name example.com www.example.com;
    return 301 https://$server_name$request_uri;
}

Auto-Renewal Setup

Certbot adds a systemd timer automatically. Verify:

# Check renewal timer
systemctl list-timers | grep certbot

# Force renewal check
certbot renew --force-renewal

# Check renewal log
grep -i "renew\|success" /var/log/letsencrypt/letsencrypt.log

Troubleshooting

Security Checklist

• SSL set to Full (Strict) in Cloudflare (if proxied)
• Redirect HTTP → HTTPS
• HSTS enabled after HTTPS confirmed working
• Auto-renewal verified with certbot renew --dry-run
• SSL Labs rating A or A+
• Certificate expiry monitoring configured