Chapter 71: DevOps Projects Part 1: Linux Server, Scripts, Nginx, HTTPS and Firewall
71.8 Project 8: Free HTTPS with Let's Encrypt and auto-renewal
Friends, browsers warn on plain HTTP. Today we add free TLS with Certbot and Let's Encrypt, redirect HTTP to HTTPS, and prove renew dry-run.
मित्रांनो, browsers HTTP वर warn करतात. आज Certbot आणि Let's Encrypt ने free TLS, HTTP ते HTTPS redirect, renew dry-run.
दोस्तों, browsers HTTP पर warn करते हैं. आज Certbot और Let's Encrypt से free TLS, HTTP से HTTPS redirect, renew dry-run.
What you will build in this project
- Certbot installed with Nginx plugin.
- A certificate for a practice domain.
- HTTP to HTTPS redirect.
- Renew dry-run success.
1. Start from a real company story
At Zoho in Chennai, a customer portal still served HTTP. Chrome showed Not Secure and sign-ups dropped 18 percent.
Legal also asked for TLS before a €50,000 EU deal.
Ananya used Certbot with the Nginx plugin, opened 443, and set renew timers.
Today we practice the same steps. Use a domain you control; examples use portal.example.com.
Ravindra Bagale's Tip
Many students copy private keys into chat. Never do that. Keys stay on the server mode 600. Keep that rule.
खूप students private keys chat मध्ये paste करतात. कधीच करू नका. Keys server वर mode 600. नियम ठेवा.
बहुत students private keys chat में paste करते हैं. कभी नहीं. Keys server पर mode 600. नियम रखिए.
2. Start and prepare
Step 1: Install Certbot
Why: Package first. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.
What: apt install certbot. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.
Example 1: Install
Type this:
sudo apt-get install -y certbot python3-certbot-nginx 2>&1 | tail -2
You will see:
Setting up certbot ...
Setting up python3-certbot-nginx ...
What it means: Installed.
Example 2: Version
Type this:
certbot --version
You will see:
certbot 2.9.0
What it means: Version note.
Example 3: Plugin help
Type this:
certbot plugins 2>&1 | grep nginx | head -1
You will see:
nginx Enter details...
What it means: Plugin present.
Step 2: Check Nginx site ready
Why: HTTP site must already answer. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.
What: curl Host 200. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.
Example 4: Site answers
Type this:
curl -s -o /dev/null -w '%{http_code}' -H 'Host: portal.example.com' http://127.0.0.1/ || curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1/
You will see:
200
What it means: HTTP works.
Example 5: server_name note
Type this:
echo 'server_name must match the real domain before certbot'
You will see:
server_name must match the real domain before certbot
What it means: Important.
Example 6: Nginx active
Type this:
systemctl is-active nginx
You will see:
active
What it means: Up.
Step 3: Open firewall ports
Why: 443 must accept traffic. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.
What: ufw allow 443. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.
Example 7: Allow 443
Type this:
sudo ufw allow 443/tcp 2>/dev/null || echo 'open SG 443'
You will see:
Rule added
What it means: Firewall.
Example 8: Allow 80
Type this:
sudo ufw allow 80/tcp 2>/dev/null || echo 'open SG 80'
You will see:
Rule added
What it means: HTTP-01 needs 80.
Example 9: ss
Type this:
ss -ltn | grep -E ':80|:443' | head
You will see:
LISTEN 0 511 0.0.0.0:80
What it means: 443 after cert.
3. Build the main pieces
Step 4: DNS reminder
Why: Name must resolve. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.
What: dig or console. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.
Example 10: DNS reminder
Type this:
echo 'A record portal.example.com -> SERVER_PUBLIC_IP'
You will see:
A record portal.example.com -> SERVER_PUBLIC_IP
What it means: You must own the name.
Example 11: dig shape
Type this:
echo 'dig +short portal.example.com'
You will see:
dig +short portal.example.com
What it means: Should return your IP.
Example 12: Wrong DNS fails
Type this:
echo 'certbot will fail with NXDOMAIN if DNS is wrong'
You will see:
certbot will fail with NXDOMAIN if DNS is wrong
What it means: Fix DNS first.
Step 5: Run certbot nginx plugin
Why: Plugin edits Nginx. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.
What: certbot --nginx. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.
Example 13: Command shape
Type this:
echo 'sudo certbot --nginx -d portal.example.com --non-interactive --agree-tos -m you@example.com --redirect'
You will see:
sudo certbot --nginx -d portal.example.com --non-interactive --agree-tos -m you@example.com --redirect
What it means: Practice email only.
Example 14: Success shape
Type this:
printf '%s\n' 'Successfully received certificate.' 'Certificate is saved at: /etc/letsencrypt/live/portal.example.com/fullchain.pem'
You will see:
Successfully received certificate.
Certificate is saved at: /etc/letsencrypt/live/portal.example.com/fullchain.pem
What it means: What good looks like.
Example 15: Nginx edited
Type this:
echo 'listen 443 ssl; ssl_certificate ... added by plugin'
You will see:
listen 443 ssl; ssl_certificate ... added by plugin
What it means: Plugin change.
Step 6: See certificate files
Why: live and archive folders. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.
What: ls /etc/letsencrypt. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.
Example 16: List live
Type this:
sudo ls /etc/letsencrypt/live/portal.example.com/ 2>/dev/null || echo 'fullchain.pem privkey.pem cert.pem chain.pem'
You will see:
fullchain.pem
privkey.pem
cert.pem
chain.pem
What it means: Four files.
Example 17: notAfter shape
Type this:
echo 'openssl x509 -in fullchain.pem -noout -enddate'
You will see:
openssl x509 -in fullchain.pem -noout -enddate
What it means: Shows expiry.
Example 18: Simulate enddate
Type this:
echo 'notAfter=Jan 26 12:00:00 2027 GMT'
You will see:
notAfter=Jan 26 12:00:00 2027 GMT
What it means: About 90 days.
4. Automate and verify
Step 7: Force redirect
Why: HTTP should bounce. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.
What: return 301. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.
Example 19: Redirect idea
Type this:
echo 'return 301 https://$host$request_uri;'
You will see:
return 301 https://$host$request_uri;
What it means: HTTP to HTTPS.
Example 20: curl -I shape
Type this:
echo 'curl -I http://portal.example.com/'
You will see:
curl -I http://portal.example.com/
What it means: Expect 301.
Example 21: Simulate 301
Type this:
printf '%s\n' 'HTTP/1.1 301 Moved Permanently' 'Location: https://portal.example.com/'
You will see:
HTTP/1.1 301 Moved Permanently
Location: https://portal.example.com/
What it means: Good.
Step 8: Test HTTPS curl
Why: Browser-like check. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.
What: curl -Ik. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.
Example 22: HTTPS head
Type this:
echo 'curl -Ik https://portal.example.com/'
You will see:
curl -Ik https://portal.example.com/
What it means: -k only in labs with bad local trust.
Example 23: Simulate TLS
Type this:
printf '%s\n' 'HTTP/1.1 200 OK' 'SSL certificate verify ok.'
You will see:
HTTP/1.1 200 OK
SSL certificate verify ok.
What it means: Browser happy.
Example 24: ss 443
Type this:
echo 'ss -ltn | grep 443'
You will see:
ss -ltn | grep 443
What it means: Listener present after issue.
Step 9: Renew dry-run
Why: Dry-run proves renew. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.
What: certbot renew. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.
Example 25: Dry-run
Type this:
echo 'sudo certbot renew --dry-run'
You will see:
sudo certbot renew --dry-run
What it means: No real renew.
Example 26: Success shape
Type this:
printf '%s\n' 'Congratulations, all simulated renewals succeeded:'
You will see:
Congratulations, all simulated renewals succeeded:
What it means: Pass.
Example 27: Failure hint
Type this:
echo 'If dry-run fails, fix DNS or port 80 before expiry'
You will see:
If dry-run fails, fix DNS or port 80 before expiry
What it means: Act early.
5. Harden and accept
Step 10: Enable timer
Why: systemd timer. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.
What: systemctl enable. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.
Example 28: Timer
Type this:
systemctl list-timers 2>/dev/null | grep certbot || ls /etc/cron.d/certbot 2>/dev/null || echo 'certbot.timer expected'
You will see:
certbot.timer expected
What it means: Twice daily.
Example 29: Enable
Type this:
sudo systemctl enable --now certbot.timer 2>/dev/null || echo 'cron.d/certbot present on some distros'
You will see:
enabled
What it means: Armed.
Example 30: list
Type this:
systemctl is-enabled certbot.timer 2>/dev/null || echo cron_fallback
You will see:
enabled
What it means: OK.
Step 11: Protect key modes
Why: Mode 600 on privkey. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.
What: stat privkey. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.
Example 31: privkey mode
Type this:
echo 'sudo stat -c %a /etc/letsencrypt/live/portal.example.com/privkey.pem'
You will see:
sudo stat -c %a /etc/letsencrypt/live/portal.example.com/privkey.pem
What it means: Expect 600 or 777 via symlink target 600.
Example 32: Simulate
Type this:
echo '600'
You will see:
600
What it means: Private.
Example 33: No chat
Type this:
echo 'never paste privkey.pem'
You will see:
never paste privkey.pem
What it means: Rule.
Step 12: Acceptance checklist
Why: Ananya signs off when these pass. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.
What: All green. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.
Example 34: dry-run ok
Type this:
echo renew_dry_run_ok
You will see:
renew_dry_run_ok
What it means: Proven when domain real.
Example 35: redirect ok
Type this:
echo redirect_ok
You will see:
redirect_ok
What it means: 301 path.
Example 36: Sign-off
Type this:
echo 'Ananya: PASS'
You will see:
Ananya: PASS
What it means: Done.
Check yourself
Q1. Tool name?
Certbot
Q2. Certificate authority?
Let's Encrypt
Q3. HTTPS port?
443
Q4. Renew test flag?
--dry-run
Q5. Who did this at Zoho?
Ananya
Q6. Dangerous place for a private key?
Chat or email
Friends, you added Let's Encrypt TLS and proved renew dry-run. Did you understand? Let us try it once more. Check the timer and the certificate notAfter date.
मित्रांनो, तुम्ही Let's Encrypt TLS जोडले. Timer आणि notAfter तपासा.
दोस्तों, आपने Let's Encrypt TLS जोड़ा. Timer और notAfter जाँचें.
Lab: try at home
- Install certbot.
- Point DNS to the server.
- Run certbot --nginx.
- Force HTTPS redirect.
- certbot renew --dry-run.
Recap
- Certbot talks to Let's Encrypt.
- Nginx plugin edits server blocks.
- Port 443 must be open.
- Renew runs twice daily via timer.
- Private keys stay mode 600.