I was able to stumble may through getting SSL setup and thought I would share what worked for me.
##Step 1 — Installing Certbot
The first step to using Let’s Encrypt to obtain an SSL certificate is to install the Certbot software on your server.
First, add the repository.
sudo add-apt-repository ppa:certbot/certbot
You’ll need to press ENTER to accept. Then, update the package list to pick up the new repository’s package information.
sudo apt-get update
And finally, install Certbot’s Nginx package with apt-get.
sudo apt-get install python-certbot-nginx
Certbot is now ready to use, but in order for it to configure SSL for Nginx, we need to verify some of Nginx’s configuration.
Step 2 — Setting up Nginx
Certbot can automatically configure SSL for Nginx, but it needs to be able to find the correct server block in your config. It does this by looking for a server_name directive that matches the domain you’re requesting a certificate for.
If you’re starting out with a fresh Nginx install, you can update the default config file. Open it with nano or your favorite text editor.
sudo nano /etc/nginx/sites-available/default
Find the existing server_name line and replace the underscore, _, with your domain name:
Save the file and quit your editor.
Then, verify the syntax of your configuration edits.
sudo nginx -t
If you get any errors, reopen the file and check for typos, then test it again.
Once your configuration’s syntax is correct, reload Nginx to load the new configuration.
sudo systemctl reload nginx
Certbot will now be able to find the correct server block and update it. Next, we’ll update our firewall to allow HTTPS traffic.
## Step 4 — Obtaining an SSL Certificate
Certbot provides a variety of ways to obtain SSL certificates, through various plugins. The Nginx plugin will take care of reconfiguring Nginx and reloading the config whenever necessary:
sudo certbot --nginx -d sub.example.com -d www.example.com
(if running www.example.com somewhere else remove -d www.example.com)
Copy
This runs certbot with the --nginx plugin, using -d to specify the names we’d like the certificate to be valid for.
If this is your first time running certbot, you will be prompted to enter an email address and agree to the terms of service. After doing so, certbot will communicate with the Let’s Encrypt server, then run a challenge to verify that you control the domain you’re requesting a certificate for.
If that’s successful, certbot will ask how you’d like to configure your HTTPS settings.
!!You have now installed certbot and made it through the Lets Encrypt setup!!
open sudo nano /etc/nginx/conf.d/librenms.conf
inside of this you will see text that Lets Encrypt has put inside librenms.conf copy the entire file and put it in notepad. Below is the CORRECT text for the librenms.conf (example needs replaced with your website)
server {
listen 80;
listen [::]:80;
server_name example-matches-LetsEncrpt.com;
return 301 https://$server_name$request_uri;
}server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
include snippets/ssl-example.com.conf;
include snippets/ssl-params.conf;
server_name example-matches-LetsEncrpt.com;
root /opt/librenms/html;
index index.php;
access_log /opt/librenms/logs/access_log;
error_log /opt/librenms/logs/error_log;charset utf-8;
gzip on;
gzip_types text/css application/javascript text/javascript application/x-javascript image/svg+xml text/plain text/xsd text/xsl text/xml image/x-icon;proxy_read_timeout 300;
proxy_connect_timeout 300;
proxy_send_timeout 300;location / {
try_files $uri $uri/ /index.php?$query_string;
}
location /api/v0 {
try_files $uri $uri/ /api_v0.php?$query_string;
}
location ~ .php {
include fastcgi.conf;
fastcgi_split_path_info ^(.+.php)(/.+)$;
fastcgi_pass unix:/run/php-fpm-librenms.sock;
}
location ~ /.ht {
deny all;
}}
Now you need to create the following files called out above
include snippets/ssl-example.com.conf;
include snippets/ssl-params.conf
First create the configuration snippet file:
sudo nano /etc/nginx/snippets/ssl-example.com.conf
Now go back to your notepad copy of librenms.conf inside of it find three lines that look like the following, put these 3 lines inside of /etc/nginx/snippets/ssl-example.com.conf
ssl_certificate /etc/letsencrypt/live/example-matches-LetsEncrpt.com/fullchain.pem; # managed by Certb> ssl_certificate_key /etc/letsencrypt/live/example-matches-LetsEncrpt.com/privkey.pem; # managed by Cer> include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
Second create the encryption settings snippet file:
sudo nano /etc/nginx/snippets/ssl-params.conf
inside of this file add the following info that is also inside of your notepad copy
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
run these commands to check everything and restart the config
Check for syntax errors sudo nginx -t
systemctl restart nginx
systemctl restart php7.4-fpm
DONE
Sources
How To Secure Nginx with Let's Encrypt on Ubuntu 16.04 | DigitalOcean steps 1,2,4
Installing LibreNMS - LibreNMS Docs
Unable to set HTTPS using LetsEncrypt in Nginx server - Stack Overflow
SSL Configuration - LibreNMS Docs