The following snippet sets up NGINX to use the certificate issued and renewed above and tells NGINX to use port 443 for TLS connections, and port 80 for plain HTTP connections. It serves the files from the "root" directory required by letsencrypt for validating the ownership of the domains. On TLS all other requests are handled by the "location" sections. On port 80 for plain HTTP, the config redirects all requests that do not start with "." to TLS.

ssl_certificate /etc/letsencrypt/live/${FQDN}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/${FQDN}/privkey.pem;

ssl_protocols TLSv1.2;

server {
  ssl on;
  listen [::]:443;
  listen 443;
  server_name ${FQDN};

  # letsencrypt webroot:
  root /var/www/html;
  location ~ /.well-known {
    allow all;
  }
}

server {
  ssl off;
  listen [::]:80;
  listen 80;
  server_name ${FQDN};

  # letsencrypt webroot:
  root /var/www/html;
  location ~ /.well-known {
    allow all;
  }
  # Everything that does not start with ".", redir to https.
  location ~ /[^.] {
    return 301 https://\$server_name\$request_uri;
  }
}

Reload nginx

$ systemctl reload nginx

Issue the certificate using letsencrypt. The letsencrypt servers must be able to lookup the name in DNS and get in touch with the server running the command for the process to succeed. (If this is not possible for you, then see the letsencrypt documentation on how to issue certificates using TXT records, or other means of obtaining certificates)

$ letsencrypt certonly -a webroot --webroot-path=/var/www/html -m "${YOUR_EMAIL}" --agree-tos --domains "${FQDN}"

The following snippet sets up a crontab entry that checks if the certificate needs renewal and renews it if needed. If the certificate is renewed, nginx gets reloaded to use the new certificate. Using a simple text editor, create a file in the /etc/cron.weekly/ directory — name it humio-letsencrypt and copy the following lines into it:

#!/bin/sh
letsencrypt renew -a webroot --webroot-path=/var/www/html -m "${YOUR_EMAIL}" && systemctl reload nginx

You'll have to replace ${YOUR_EMAIL} with your email address. When you're finished, save the file and use chmod to set the permissions to 755. The cron utility will then run this file once a week to review letsencrypt.

The above examples assume that NGINX was running as a plain systemd-controlled on the host system. If you plan to run NGINX inside a Docker container, NGINX still needs to be able to read the certificate files.

When NGINX needs to start as root inside the container in order to read the mounted files. The suggested solution is to add the following to the Docker run command, keeping letsencrypt outside the docker container:

-v /etc/letsencrypt:/etc/letsencrypt:ro

We suggest this in order to not loose the files that letsencrypt stores in /etc/letsencrypt as you have to start over and issue from scratch if those files are lost. The renewal then needs to restart the docker container instead. Again, using a simple text editor, create a file named humio-letsencrypt in the /etc/cron.weekly/ and copy these lines into it:

#!/bin/sh
## Renewal for nginx wirh nginx inside a docker container:
letsencrypt renew -a webroot --webroot-path=/var/www/html -m "${YOUR_EMAIL}" && docker restart your-nginx-container

Use chmod to set the permissions to 755.

Start from the template for letsencrypt above, then edit the following lines:

ssl_certificate /path/to/your/public_key_fullchain.pem;
ssl_certificate_key /path/to/your/cert_private_key.pem;