This morning I went through the unexpectedly pleasant experience of adding an SSL certification to this site. Turned out to be much easier than I planned on, and there was only one small hiccup I was able to resolve quickly.
I opted to go with a free Let's Encrypt SSL/TLS Certificate and use the automated installation from certbot. The certbot instructions were straightforward and only took a few minutes to complete, but did result in one issue, so here's a quick tutorial on how to add an SSL cert to your Ghost site quickly.
First, a few specifics about my current setup:
- Ubuntu 14.04 (trusty)
- Nginx 1.4.6
- Ghost 0.11.10
- Hosted on DigitalOcean
Install the necessary packages
sudo apt-get update sudo apt-get install software-properties-common sudo add-apt-repository ppa:certbot/certbot sudo apt-get update sudo apt-get install python-certbot-nginx
This installs the Certbox Nginx plugin, which we then run with:
sudo certbot --nginx
Running this will issue a certificate for you and have Certbot edit your Nginx configuration automatically.
Fix the Nginx Configuration
Unfortunately for me, as I discovered the editing of my Nginx configuration was flawed and required some changes. I noticed the issue after restarting the server - resulting in a
To fix the issue, find and open your Nginx configuration file. To find which file is being used, run:
This will show the location of the Nginx configuration file. This file might be, or will contain the path in an
include statement to the Nginx configuration file. Open this file in a text editor.
In my case it looked like the parsing of the file had gone awry and the
server block was a mix of port
Another fix I had to make was to add the
X-Forwarded-Proto header to several of the
proxy_set_header X-Forwarded-Proto https;
Here's the full Nginx configuration I'm using:
Setup auto-renew on the SSL
Let's Encrypt certificates last for 90 days so unless you want to go through some of the steps above you'll want to setup a cron job to auto-renew the SSL. To do this, run:
select your favorite editor and add the following line:
15 3 * * * /usr/bin/certbot renew --quiet --renew-hook "/usr/sbin/service nginx reload"
This sets the Certbox auto-renew script to run each day at 3:15am. Your SSL certificate will be automatically renewed and reloaded when it has thirty days or less before it's expiration date.