DMIT HTTPS/SSL Setup: Let's Encrypt Certbot Guide

Why HTTPS matters

HTTPS encrypts traffic between the client and server with TLS, preventing eavesdropping and tampering. Browsers flag plain-HTTP sites as "Not Secure", which hurts trust and conversions. This guide shows how to configure a free Let's Encrypt certificate on Nginx for a DMIT cloud server.

Prerequisites

A domain A (or AAAA) record pointing to your server IP
Nginx installed and serving on port 80
Firewall allowing ports 80 and 443
SSH access configured (see SSH Hardening)

Install Certbot

# Debian/Ubuntu
apt update
apt install certbot python3-certbot-nginx -y

# verify
certbot --version

Request a certificate and auto-configure Nginx

The Certbot Nginx plugin edits your site config and enables HTTPS automatically:

certbot --nginx -d example.com -d www.example.com

After accepting the terms and entering an email, Certbot will: obtain the certificate, edit the Nginx config, redirect HTTP→HTTPS, and set up auto-renewal.

Webroot mode (optional)

certbot certonly --webroot -w /var/www/html -d example.com

Verify auto-renewal

Let's Encrypt certificates are valid for 90 days; Certbot renews them via a systemd timer. Test the renewal logic:

certbot renew --dry-run

"Congratulations" means renewal is configured correctly. Real renewals run silently via the system timer.

Recommended Nginx TLS settings

ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers HIGH:!aNULL:!MD5;
ssl_prefer_server_ciphers on;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 10m;
add_header Strict-Transport-Security "max-age=31536000" always;

Enabling HSTS forces HTTPS in browsers, but make sure the certificate stays valid or the site becomes unreachable.

Multi-domain and wildcard certificates

certbot certonly --manual --preferred-challenges=dns -d "*.example.com"

Add the TXT record shown to complete DNS validation. DNS validation cannot auto-renew; use a DNS API plugin instead.

Certificate file locations

/etc/letsencrypt/live/example.com/
  ├── fullchain.pem   # cert chain
  ├── privkey.pem     # private key
  ├── cert.pem        # certificate
  └── chain.pem       # intermediate

Common issues

Renewal fails?

ss -tlnp | grep :80
dig +short example.com

Mixed-content warning?

Any http:// resource triggers a mixed-content warning. Use relative paths or https://, and add:

add_header Content-Security-Policy "upgrade-insecure-requests";

Performance impact?

TLS has minor overhead, but modern CPUs and TLS 1.3 0-RTT reduce latency sharply. See Performance Tuning for more.

First Deploy Checklist, Docker Deployment Guide, Troubleshooting Guide.

Data checked: 2026-08-18. Certbot commands follow the official documentation.