===== nginx and Let's Encrypt with strong SSL ciphers =====

==== Let's Encrypt ====

> [[https://en.wikipedia.org/wiki/Let%27s_Encrypt|Let's Encrypt]] is a certificate authority that launched on April 12, 2016 that provides free X.509 certificates for Transport Layer Security (TLS) encryption via an automated process designed to eliminate the current complex process of manual creation, validation, signing, installation, and renewal of certificates for secure websites.

=== SSL certificate renewal ===

Let's Encrypt certificates expire every three months, and certbot automatically renews them. After renewing the certificates, you have to reload nginx. This can be automated with a script you put in ''/etc/letsencrypt/renewal-hooks/post/'':

<code bash /etc/letsencrypt/renewal-hooks/post/nginx.sh>
#!/bin/sh
systemctl reload nginx.service
</code>

Make it executable:

<code bash>
sudo chmod +x /etc/letsencrypt/renewal-hooks/post/nginx.sh
</code>

----
\\

==== nginx ====
\\

=== SSL cipher suite ===

Edit the global configuration file:

<file nginx /etc/nginx/nginx.conf>
##
# SSL Settings
##

ssl_protocols TLSv1.3;
ssl_prefer_server_ciphers on;
</file>
\\

=== HTTP headers ===

Create a configuration file:

<file nginx /etc/nginx/conf.d/headers.conf>
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";
add_header X-Content-Type-Options nosniff;
add_header X-Frame-Options DENY;
</file>

----
\\

==== Restart nginx ====

<code bash>
sudo systemctl restart nginx.service
</code>

----