# How to configure Nginx for HTTPS

> Learn how to set up HTTPS on your Nginx web server using Certbot to obtain a free Let's Encrypt SSL certificate, then configure Nginx to serve it securely.

Author: [Flavio Copes](https://flaviocopes.com/about/) | Published: 2020-08-12 | Topics: [Networking](https://flaviocopes.com/tags/network/) | Canonical: https://flaviocopes.com/nginx-https-certbot/

I recently set up a VPS on DigitalOcean using the official [Node.js](https://flaviocopes.com/nodejs/) droplet, which installs Ubuntu Linux with Node and Nginx as a reverse proxy, which means it's a middleman between users and your Node.js apps.

By default the droplet is configured to use HTTP, but we want our apps to be served using HTTPS, the secure version of HTTP.

So we need to do a little procedure that involves using [Certbot](https://certbot.eff.org/) to obtain a SSL certificate through [Let's Encrypt](https://letsencrypt.org), and configuring Nginx to use it.

By the way, I built a free [nginx config generator](https://flaviocopes.com/tools/nginx-generator/) that writes server blocks with the certbot HTTPS setup already included.

These are the steps we'll follow:

<!-- TOC -->

- [Install Certbot and the Certbot Nginx package](#install-certbot-and-the-certbot-nginx-package)
- [Set up Nginx](#set-up-nginx)
- [Generate the SSL certificate using Certbot](#generate-the-ssl-certificate-using-certbot)

<!-- /TOC -->

## Install Certbot and the Certbot Nginx package

These instructions assume you are using Ubuntu, Debian or any other Linux distribution that uses `apt-get` to manage packages:

```bash
sudo apt-get install certbot python3-certbot-nginx
```

## Set up Nginx

Edit `/etc/nginx/sites-available/default` to set the correct server name (essential for SSL)

```bash
sudo nano /etc/nginx/sites-available/default
```

find the line `server_name` and enter your domain name:

```
server_name my.domain.com;
```

Now run

```
sudo systemctl reload nginx
```

to reload Nginx with the updated configuration.

The firewall should already be configured to accept HTTPS, find it out typing `sudo ufw status`. You should see `Nginx Full` in the list. If you only see `Nginx HTTP`, look up how to change that.

## Generate the SSL certificate using Certbot

Now we can invoke Certbot to generate the certificate. You must run this as root:

```bash
sudo certbot --nginx -d my.domain.com
```

(of course, change `my.domain.com` to your domain name)

Enter your real email, as that will be used to communicate you any problem.

I also suggest to choose the option to redirect HTTP to HTTPS automatically.

That's it!

SSL certificates are valid for 90 days, and Certbot is already set up for automated renewal. To simulate and test-drive the renewal process, run:

```
sudo certbot renew --dry-run
```

This should give you a successful message.

That's it, now your Node apps should successfully run on HTTPS with no additional changes on your part.