Anybody up for teaching me how to SSL working with NGINX?

Technical Support
  • SSL is new to me, as such I haven't made it work on any other site that I've run before.

    Looking at Letsencrypt and their directions I don't get any nginx information. Everything is for apache. So I don't know where to begin (I understand generally what I'd do in nginx to point 443 but otherwise I'm pretty lost).

    Anyone have a general step by step overview for me?


  • Started learning about SSL and TLS a couple weeks ago, was still new to me then... was a good starting point back then.
    Found this guide which helped me put a bit, but there were a couple issues with this...
    For one, DON'T NEVER EVER add the trailing slash at proxy_pass;, just use proxy_pass;
    Also lets encrypt wasn't able to validate the ownership of my website, because nodebb isn't using the classic folder structure like most PHP servers do (/index.php /folder/otherFile.php etc.), thats why I had to add that too...
    I tested my site for security on a website (I don't remeber how it's called) and found out, that there was a slight security issue, which i also fixed.
    To make your life easier, I will show you my config, and I'll try to explain what I did there.

    server {
        listen 80;
        rewrite     ^   https://$host$request_uri? permanent; # This redirects all non https requests to https
    server {
        listen 443 ssl;
        ssl_certificate /etc/letsencrypt/live/; #Those are the certificates generated by the certbot
        ssl_certificate_key /etc/letsencrypt/live/;
        # Turn on OCSP stapling as recommended at
        # requires nginx version >= 1.3.7
        ssl_stapling on;
        ssl_stapling_verify on;
        add_header Strict-Transport-Security "max-age=31536000";
        ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH'; # When using this ciphers, old browsers like IE8 are not supported
        ssl_prefer_server_ciphers on; # This was the security issue I was talking about... shows you how to generate a pem key
        ssl_dhparam /etc/dhparam/dhparams.pem;
        location /.well-known { # this is needed for let's encrypt, so all requests to are redirected to the given folder below instead if nodebb
            alias /var/www/nodebb/.well-known; # this folder needs to be the same folder like the one you specified in your certbot command
        location / {
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header Host $http_host;
            proxy_set_header X-NginX-Proxy true;
            proxy_pass; # This redirects the http request to your nodebb server
            proxy_redirect off;
            # Socket.IO Support
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";

    I hope I could help you with this!
    If you have any questions, feel free to ask

  • @etakmit
    Goto and choose your webserver/platform for a step-by-step guide.

    It takes a couple of minutes to be up and running:

    > sudo apt-get install letsencrypt 
    > letsencrypt certonly --webroot -w /home/blaha/NodeBB/public -d ****

    The certs will be available in the following folder (this is the nginx config)

     ssl_certificate         /etc/letsencrypt/live/****/fullchain.pem;
     ssl_certificate_key     /etc/letsencrypt/live/****/privkey.pem;

    Then add letsenctypt renew (and service ngninx reload) in a crontab running every day.

    Just point the letsencrypt script to the public folder of your NodeBB install.

  • Just point the letsencrypt script to the public folder of your NodeBB install.

    Hmm should have known that, but works for me, so I'm going to be too lazy to change that...
    Still thanks for the information

  • @hek that's where its getting me. since my nodebb is in /opt/nodebb I could just run the letsencrypt script facing that right?

  • @etakmit

    Yep, just point it to the public folder of your install.

  • @RoiEXLab thanks! Between your reply and @hek 's reply I should be able to figure this out!

  • All set. Thanks guys. Was definitely painless once I wrapped my head around it (and remembered to allow 443 through my firewall ... d'oh)

  • @hek said:

    Then add letsenctypt renew (and service ngninx reload) in a crontab running every day.

    Good lord, that's a bit overkill isn't it? Those servers aren't free to run ๐Ÿ˜†

    I used to do every other month, but switched to calling letsencrypt-auto renew every month...

  • It will only actually only renew when it is time. So no need to worry! ๐Ÿ™‚

  • @julian I'm still determining what is best. I think once a month depending on the timing could be problematic (although a manual renew isn't the worst thing in the world).

    Even the letsencrypt walkthrough says twice a day

    Note: if you're setting up a cron or systemd job, we recommend running it twice per day (it won't do anything until your certificates are due for renewal or revoked, but running it regularly would give your site a chance of staying online in case a Let's Encrypt-initiated revocation happened for some reason). Please select a random minute within the hour for your renewal tasks.

    I might go with that or I might go weekly. We'll see.

Suggested Topics

  • /login button stopped working

    Unsolved Technical Support
    0 Votes
    6 Posts

    @kurulumu-net Odd. I'm not able to reproduce this. Have you tried disabling plugins to see if any of those are the culprit ?

  • 0 Votes
    9 Posts

    โ˜  โ˜  โ˜  Check the credit card!!! โ˜  โ˜  โ˜ 


  • Time to Rethink Nginx?

    Technical Support
    0 Votes
    4 Posts

    @julian Yeah, I was thinking more of the Nginx Plux vs. Nginx Open Source duality. Too often such results in major split personality disorders wh/end up essentially forcing extortion to even get access to any reasonable docs or support.

    Nginx woes are still unclear. My concern is that if the bad actors succeed in their claims, then the license itself may be declared null and void. I can imagine this then leading to a scenario where "might makes right" and any forks then become their next targets. Crazy stuff happens in the US Federal Courts these days, particularly a certain district court in Texas, which has a well earned reputation for being very pro corporation in its rulings. Some towns thrive on industry, others eco tourism, etc. That TX town's niche is rich corporate lawyers dumping buckets of cash into the local economy.

    Anyways, I am still curious as to community reports regarding Apache deployments, as I have not used it in many years now.

    NodeBB rocks and is one of the best pieces of FOSS this ol' dinosaur had the pleasure of using. Keep up the great work.

  • 0 Votes
    3 Posts

    I was crating bug to GitHub, but thought that this could be know issue, after upgrade, so thats why added this question first... I did se you managed to do it fist, so I added information to there. I use tags, both 1.4.5 and 1.4.6 has this issue.

    Upload cover picture does not work when using subfolder ยท Issue #5631 ยท NodeBB/NodeBB

    Uploaded cover picture path does not contain the relative_path.


    GitHub (

  • Custom CSS not working

    Technical Support
    0 Votes
    13 Posts

    @Thouv said in Custom CSS not working:

    @PitaJ said in Custom CSS not working:

    I just want to make sure that every possibility is exhausted.

    Can you try turning the Enable Custom CSS toggle off, then saving the page, then turning it back on, then saving the page again? Thanks.

    And can you check for any errors in the browser console when on that page?

    It worked! Thanks
    Just had to disable, save, and reenable. Weird.

    ๐Ÿ˜› Hi thouv