How to Setup Let’s Encrypt SSL with Nginx on CentOS 8
In this tutorial we will show you how to provide an encrypted HTTPS connection for our site on the Nginx web server using a free Let’s Encrypt SSL certificate. Necessary conditions:
In the Serverspace you can create a server with already installed app "Nginx".
- Domain name;
- CentOS 8 server with public IP that appears in the DNS A record of your domain name;
- Installed Nginx web server.
Installing and configuring snapd
It is better to use snapd to install and maintain Certbot. This way, it will always be updated, and automatic certificate renewal will be pre-configured. To install snapd, use the following commands:
dnf install epel-release; dnf install snapdEnable and start snapd.
systemctl enable --now snapd.socketEnable classic snap support.
ln -s /var/lib/snapd/snap /snapNow reboot the system.
rebootCheck if the latest version of snapd is installed.
snap install core; snap refresh coreInstalling the Certbot package
Before installing the Certbot package from snap, you must be sure that there is no other Certbot installed on the system.
dnf remove certbotNow, install Certbot from snap.
snap install --classic certbotRun the following command to make sure that Certbot will start.
ln -s /snap/bin/certbot /usr/bin/certbotAutomatic obtaining and installation of Let’s Encrypt SSL certificate on Nginx
We recommend configuring the Nginx virtual host by adding its configuration to the /etc/nginx/conf.d/ folder with the .conf extension. If this is not done, the HTTPS configuration for the domain will be added to the nginx.conf file. Execute the next command to begin the certificate acquisition process and follow the instructions.
certbot --nginxAfter the process completes successfully, restart Nginx.
systemctl restart nginxRedirect from HTTP to HTTPS is configured automatically. Now you can check the result by accessing the domain name in the address bar of your browser.
Automatic SSL certificate renewal
Automatic renewal of the SSL certificate is configured during the installation of Certbot from snap. You can check if the timer is running using this command:
systemctl list-timers | grep certbotIf there is no output, try these locations:
cat /etc/crontab
cat /etc/cron.*/*You can also run a test run of auto-renewing your certificates:
certbot renew --dry-run
700
300
700
300
700
300
700
300
