Generate ssl certs for your nginx vhost

Let's Encrypt with nginx

#!/bin/bash
## Author: Anh Tuan Nguyen (anhtuank7c@hotmail.com)
## Created: 23/08/2016
## Install Let's Encrypt and generate certs for nginx
## If you want to install nginx server: https://gist.github.com/anhtuank7c/74d404b63ebb33ce17973d079b84aed1
## You will need git installed on your server

# Download lets encrypt to /opt/letsencrypt
sudo git clone https://github.com/letsencrypt/letsencrypt /opt/letsencrypt

# modify your nginx vhost like this
server {
  listen       80;
  server_name  localhost;

  # Google pagespeed
  #pagespeed on;
  #pagespeed FileCachePath /var/ngx_pagespeed_cache;
  #pagespeed CriticalImagesBeaconEnabled false;
  #location ~ ".pagespeed.([a-z].)?[a-z]{2}.[^.]{10}.[^.]+" {
  #  add_header "" "";
  #}
  #location ~ "^/pagespeed_static/" { }
  #location ~ "^/ngx_pagespeed_beacon$" { }

  root projects/demo/; # point to your project source code
  # root projects/demo/webroot; # point to project webroot if source code is CakePHP

  index index.php index.html index.htm;
  location / {
     try_files $uri /index.php?$args;
  }
  #error_page  404              /404.html;
  # redirect server error pages to the static page /50x.html
  #
  #error_page   500 502 503 504  /50x.html;
  #location = /50x.html {
  #  root   projects/demo/;
  #}
  # pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
  #
  location ~ \.php$ {
    fastcgi_pass   127.0.0.1:9000;
    fastcgi_index  index.php;
    fastcgi_param  SCRIPT_FILENAME  $document_root$fastcgi_script_name;
    include        fastcgi_params;
  }

  # Lets Encrypt
  location ~ /.well-known {
    allow all;
  }
}


# Generate cert (for general php sources)
./letsencrypt-auto certonly -a webroot --webroot-path=/usr/local/nginx/projects/demo -d your_domain.com

# Note for CakePHP: point webroot-path to webroot
./letsencrypt-auto certonly -a webroot --webroot-path=/usr/local/nginx/projects/demo/webroot -d your_domain.com

# Generate Diffie-Hellman 4096 lenght (will take a while)
openssl dhparam -out /etc/letsencrypt/keys/dhparams.pem 4096

# ----------------------------------------------------------------------------------------------------------------
# After generate finish and have successful message, you will need edit nginx vhost, listen 443 ssl
# I redirect all HTTP request to HTTPS

# HTTP
server {
  listen       80;
  server_name  localhost;

  # redirect to https
  return 301 https://$server_name$request_uri;
}

# HTTPS
server {
  listen       443 ssl;
  server_name  localhost;

  ssl_certificate /etc/letsencrypt/live/your_domain.com/fullchain.pem;
  ssl_certificate_key /etc/letsencrypt/live/your_domain.com/privkey.pem;

  ssl_session_timeout 1d;
  ssl_session_cache shared:SSL:50m;
  ssl_session_tickets off;

  # Diffie-Hellman parameter for DHE ciphersuites, recommended 2048 bits, i use 4096 for sure
  ssl_dhparam /etc/letsencrypt/keys/dhparam.pem;

  # intermediate configuration. tweak to your needs.
  ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
  ssl_ciphers 'ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS';
  ssl_prefer_server_ciphers on;

  # HSTS (ngx_http_headers_module is required) (15768000 seconds = 6 months)
  add_header Strict-Transport-Security max-age=15768000;

  # OCSP Stapling ---
  # fetch OCSP records from URL in ssl_certificate and cache them
  ssl_stapling on;
  ssl_stapling_verify on;
  resolver 8.8.8.8 8.8.4.4 valid=300s;
  resolver_timeout 5s;

  # Google pagespeed
  #pagespeed on;
  #pagespeed FileCachePath /var/ngx_pagespeed_cache;
  #pagespeed CriticalImagesBeaconEnabled false;
  #location ~ ".pagespeed.([a-z].)?[a-z]{2}.[^.]{10}.[^.]+" {
  #  add_header "" "";
  #}
  #location ~ "^/pagespeed_static/" { }
  #location ~ "^/ngx_pagespeed_beacon$" { }

  root projects/demo/;
  # root projects/backend/webroot/; # point root to webroot if your source code is CakePHP

  index index.php index.html index.htm;
  location / {
     try_files $uri /index.php?$args;
  }

  #error_page  404              /404.html;
  # redirect server error pages to the static page /50x.html
  #
  #error_page   500 502 503 504  /50x.html;
  #location = /50x.html {
  #  root   projects/demo/;
  #}
  # pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
  #

  location ~ \.php$ {
    fastcgi_pass   127.0.0.1:9000;
    fastcgi_index  index.php;
    fastcgi_param  SCRIPT_FILENAME  $document_root$fastcgi_script_name;
    include        fastcgi_params;
  }

  # Lets Encrypt
  location ~ /.well-known {
    allow all;
  }
}
# ----------------------------------------------------------------------------------------------------------------

# Optional: create crontab job to update Let's Encrypt, renew certs

crontab -e

# write these contents to crontab
# ---------------------------------------------------------------------------------------------------------------------
# Lets Encrypt update software
10      3       *       *       1       cd /opt/letsencrypt && git pull >> /var/log/letsencrypt/letsencrypt-update.log

# Lets Encrypt update certs
30      3       *       *       1       /opt/letsencrypt/letsencrypt-auto renew >> /var/log/letsencrypt/letsencrypt-renew.log

# Restart nginx after update certs
35      3       *       *       1       /etc/init.d/nginx reload
# ---------------------------------------------------------------------------------------------------------------------

# TEST your certs:
Enter url to your browser `https://www.ssllabs.com/ssltest/analyze.html?d=your_domain.com`