rc6.orgAbout MeJournal☰ MenuUsing Let’s Encrypt SSL certificates to get an A+ rating with nginxRecorded on December 7th, 2015Browser makers and technology firms have increasingly focused on improving the encryption and privacy of communications on the Web. Google, for example, has turned HTTPS on by default, uses whether a site offers HTTPS as a positive signal for search ranking, and has started displaying error messages for sites that use older encryption standards for their certificates.Lets Encrypt aims to remove the technical and financial hurdles for website administrators that continue to balk at offering secure HTTP for every site visitor. Even technically savvy workers who frequently manage websites have trouble configuring their servers to properly serve secure HTTP.Last year, the Electronic Frontier Foundation, Mozilla, Cisco, Akamai, and IdenTrust announced the formation of Let’s Encrypt, a new certificate authority created to remove the barriers preventing widespread adoption of HTTPS. They hope to simplify the entire certificate process and reduce setup time to 20-30 seconds through their Let’s Encrypt Client, a tool that uses the ACME (Automated Certificate Management Environment) protocol.PluginsThe Let’s Encrypt client supports a number of different plugins that can be used to obtain and/or install certificates. Plugins that can obtain a cert are called “authenticators” and can be used with the “certonly” command. Plugins that can install a cert are called “installers”. Plugins that do both can be used with the “letsencrypt run” command, which is the default.For example, there’s an Apache plugin that’ll both “authenticate” you as the holder of a specific domain as well as “install” the certificate in your Apache configuration files - effectively reducing the amount of effort you have to take to get SSL up and running to a few seconds at most.The nginx plugin supports both authentication and installation, but it was a bit too beta for me to want to run it on my server. Instead I opted to go for the webroot plugin, which obtains a certificate by writing to the webroot directory of an already running webserver.Installing the Let’s Encrypt clientLet’s Encrypt recommends cloning the client repository to get started. You’ll need to install git if you don’t have it already.sudo apt-get updatesudo apt-get install gitgit clone https://github.com/letsencrypt/letsencryptcd letsencrypt
You’re now ready to use letsencrypt-auto, which is the recommended method of running the Let’s Encrypt client beta releases on systems that don’t have a packaged version. There’s no need to run the command with sudo, instead just run it with your regular permissions. The client will prompt you when it needs additional permissions.
Getting our first certificate
If you’re running a webserver that you don’t want to stop to use standalone or you’re like me and you don’t quite trust the beta state of