How to Secure Nginx with Let’s Encrypt SSL on Debian 12

The following steps cover installing Certbot, obtaining a free Let’s Encrypt SSL certificate for your domain, configuring Nginx for HTTPS with automatic HTTP redirection, enabling HSTS security headers, and setting up automatic certificate renewal.

Installing Certbot #

Certbot is the official Let’s Encrypt client that automates certificate issuance and Nginx configuration. Install it along with the Nginx plugin:

sudo apt update && sudo apt install -y certbot python3-certbot-nginx

Verify the installation:

certbot --version

You should see the Certbot version number in the output, confirming a successful installation.

Obtaining an SSL Certificate #

Before requesting a certificate, verify that your domain resolves to your server’s IP address:

host example.com

The output should show your server’s public IP. If it doesn’t, update your DNS A record at your domain registrar and wait for propagation before continuing.

Run Certbot with the Nginx plugin to obtain and install your certificate. Replace example.com with your actual domain:

sudo certbot --nginx -d example.com -d www.example.com

Certbot will prompt you for the following:

1. Email address — for certificate expiry notifications and account recovery. Enter a valid email.
2. Terms of Service — you must agree (Y) to proceed.
3. EFF mailing list — optional. Enter Y or N based on your preference.

If successful, you will see output confirming the certificate was issued and deployed:

Successfully received certificate.
Certificate is saved at: /etc/letsencrypt/live/example.com/fullchain.pem
Key is saved at:         /etc/letsencrypt/live/example.com/privkey.pem
This certificate expires on 2026-05-20.

Deploying certificate
Successfully deployed certificate for example.com
Successfully deployed certificate for www.example.com

Congratulations! You have successfully enabled HTTPS on
https://example.com and https://www.example.com

Verifying HTTPS #

Open your browser and visit https://example.com. You should see your site served over HTTPS with a padlock icon in the address bar.

From the command line, verify the HTTPS response headers:

curl -sI https://example.com

You should see HTTP/2 200 (or HTTP/1.1 200 OK) at the top of the response.

Next, verify that HTTP requests are automatically redirected to HTTPS:

curl -sI http://example.com

You should see a 301 Moved Permanently response with a Location header pointing to https://example.com/. This confirms that all HTTP traffic is being redirected to the secure HTTPS version.

Strengthening SSL Security #

Certbot’s default configuration provides solid SSL security, including modern TLS protocols and cipher suites managed via /etc/letsencrypt/options-ssl-nginx.conf. To further protect your site, enable HTTP Strict Transport Security (HSTS), which instructs browsers to always use HTTPS even if a user types http:// in the address bar.

Open the Nginx server block that Certbot modified:

sudo nano /etc/nginx/sites-available/example.com

Find the server block that listens on port 443 (the one Certbot added the SSL directives to) and add the HSTS header inside it:

server {
    listen 443 ssl; # managed by Certbot
    server_name example.com www.example.com;
    root /var/www/example.com;

    # HSTS — force browsers to use HTTPS for one year
    add_header Strict-Transport-Security "max-age=31536000" always;

    # ... rest of your configuration ...
}

Save and exit (press CTRL + X, press Y, then press ENTER)

Test the configuration and reload Nginx:

sudo nginx -t && sudo systemctl reload nginx

Verify the HSTS header is present:

curl -sI https://example.com | grep -i strict

You should see:

strict-transport-security: max-age=31536000

Automatic Certificate Renewal #

Let’s Encrypt certificates are valid for 90 days. Certbot installs a systemd timer that automatically checks for renewal twice daily and renews any certificate within 30 days of expiry.

Verify the renewal timer is active:

sudo systemctl status certbot.timer

You should see active (waiting) in the output, along with the next scheduled run time.

Test the renewal process with a dry run (simulates renewal without making any changes):

sudo certbot renew --dry-run

If the dry run completes without errors, automatic renewal is working correctly. You should see Congratulations, all simulated renewals succeeded in the output.

Important File Locations #

Key paths for managing SSL certificates on Debian 12 (Bookworm):

• Certificate (full chain): /etc/letsencrypt/live/example.com/fullchain.pem — The complete certificate chain sent to browsers.
• Private Key: /etc/letsencrypt/live/example.com/privkey.pem — Your certificate’s private key. Keep this secure.
• Nginx Server Block: /etc/nginx/sites-available/example.com — Your site configuration with Certbot’s SSL additions.
• Renewal Configuration: /etc/letsencrypt/renewal/example.com.conf — Settings used for automatic renewal.
• SSL Options: /etc/letsencrypt/options-ssl-nginx.conf — Certbot-maintained TLS protocol and cipher settings.
• Certbot Log: /var/log/letsencrypt/letsencrypt.log — Detailed log for troubleshooting certificate operations.

Conclusion #

Your Debian 12 (Bookworm) server is now secured with a free Let’s Encrypt SSL certificate, automatic HTTP-to-HTTPS redirection, HSTS security headers, and automated 90-day certificate renewal.