The following snippet sets up NGINX to use the certificate issued by Certbot, listens on port 443 for TLS connections, and serves the files from the webroot directory required by Let's Encrypt for domain ownership validation. All other requests on port 443 are handled by the location sections.

ssl_certificate     /etc/letsencrypt/live/${FQDN}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/${FQDN}/privkey.pem;

ssl_protocols TLSv1.2 TLSv1.3;

server {
  listen 443 ssl;
  listen [::]:443 ssl;
  server_name ${FQDN};

  # Let's Encrypt webroot validation
  root /var/www/html;
  location ~ /.well-known {
    allow all;
  }

  location /internal/humio {
    proxy_set_header    X-Forwarded-Prefix /internal/humio;
    proxy_set_header    X-Forwarded-Proto $scheme;
    proxy_set_header    X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header    X-Real-IP $remote_addr;
    proxy_redirect      http:// https://;
    proxy_read_timeout  600s;
    expires             off;

    proxy_set_header    Upgrade $http_upgrade;
    proxy_set_header    Connection "upgrade";
    proxy_http_version  1.1;
    proxy_set_header    Host $host;
    proxy_pass          http://localhost:8080;
  }
}

server {
  listen 80;
  listen [::]:80;
  server_name ${FQDN};

  # Let's Encrypt webroot validation
  root /var/www/html;
  location ~ /.well-known {
    allow all;
  }

  # Redirect all other HTTP traffic to HTTPS
  location / {
    return 301 https://$server_name$request_uri;
  }
}

Reload nginx

$ systemctl reload nginx

Install Certbot and issue the certificate. The Let's Encrypt servers must be able to resolve your domain in DNS and reach your server during this process. If that is not possible in your environment, refer to the Certbot documentation for alternative validation methods such as DNS-01 challenges.

$ certbot certonly --webroot --webroot-path=/var/www/html \
  -m "${YOUR_EMAIL}" --agree-tos -d "${FQDN}"

Certbot installs a systemd timer by default that automatically checks for and performs certificate renewals. You can verify it is active with:

systemctl status certbot.timer

After renewal, NGINX needs to be reloaded to pick up the new certificate. The recommended approach is to add a deploy hook. Create the file /etc/letsencrypt/renewal-hooks/deploy/reload-nginx.sh with the following content:

#!/bin/sh
systemctl reload nginx

Then set the correct permissions:

chmod 755 /etc/letsencrypt/renewal-hooks/deploy/reload-nginx.sh

Certbot will automatically execute this script after a successful renewal.

The above examples assume NGINX is running as a systemd-controlled service on the host. If you plan to run NGINX inside a Docker container, NGINX still needs to be able to read the certificate files.

Mount the Let's Encrypt directory into the container as a read-only volume by adding the following to your docker run command:

-v /etc/letsencrypt:/etc/letsencrypt:ro

Since the container needs to be restarted to pick up a renewed certificate, create a deploy hook at /etc/letsencrypt/renewal-hooks/deploy/restart-nginx-container.sh:

#!/bin/sh
docker restart your-nginx-container

Then set the correct permissions:

chmod 755 /etc/letsencrypt/renewal-hooks/deploy/restart-nginx-container.sh

Start from the template for letsencrypt above, then replace the certificate paths with those provided by your certificate authority:

ssl_certificate     /path/to/your/public_key_fullchain.pem;
ssl_certificate_key /path/to/your/cert_private_key.pem;