English

简体中文

English

简体中文

Appearance

Nginx Setup ​

For VPS, cloud servers, and dedicated servers with SSH and sudo access.

This page uses Certbot to issue the certificate and configure Nginx automatically.

1. Set Variables ​

bash
export ACME_SERVER="your Server URL"
export EAB_KID="your EAB MAC ID"
export EAB_HMAC_KEY="your EAB MAC key"
export EMAIL="[email protected]"
export DOMAIN="example.com"
export WWW_DOMAIN="www.example.com"

Single-domain certificates should protect both the root domain and www.

For Multi-Domain or wildcard products, read Domain Types first.

2. Install Certbot ​

Ubuntu / Debian:

bash
sudo apt update
sudo apt install -y certbot python3-certbot-nginx

AlmaLinux / Rocky Linux / CentOS:

bash
sudo dnf install -y epel-release || sudo yum install -y epel-release
sudo dnf install -y certbot python3-certbot-nginx || sudo yum install -y certbot python3-certbot-nginx

Snap:

bash
sudo snap install core
sudo snap refresh core
sudo snap install --classic certbot
sudo ln -sf /snap/bin/certbot /usr/bin/certbot

3. Issue and Install ​

Single domain, including example.com and www.example.com by default:

bash
sudo certbot --nginx \
  --non-interactive \
  --agree-tos \
  --email "$EMAIL" \
  --server "$ACME_SERVER" \
  --eab-kid "$EAB_KID" \
  --eab-hmac-key "$EAB_HMAC_KEY" \
  --domain "$DOMAIN" \
  --domain "$WWW_DOMAIN" \
  --cert-name "$DOMAIN"

Multi-domain:

bash
sudo certbot --nginx \
  --non-interactive \
  --agree-tos \
  --email "$EMAIL" \
  --server "$ACME_SERVER" \
  --eab-kid "$EAB_KID" \
  --eab-hmac-key "$EAB_HMAC_KEY" \
  --domain example.com \
  --domain www.example.com \
  --domain example.net \
  --domain shop.example.org \
  --cert-name example.com

4. Wildcard Certificate ​

Wildcard coverage should include:

text
example.com
*.example.com

Wildcard certificates require DNS validation. The --nginx HTTP flow cannot issue wildcard certificates.

Cloudflare DNS API example with acme.sh:

bash
export CF_Token="Cloudflare API Token"
export CF_Account_ID="Cloudflare Account ID"

~/.acme.sh/acme.sh --issue \
  --dns dns_cf \
  -d "$DOMAIN" \
  -d "*.$DOMAIN" \
  --server "$ACME_SERVER"

After issuance, install the certificate files and configure ssl_certificate and ssl_certificate_key in Nginx.

5. Check ​

bash
sudo nginx -t
curl -I "https://$DOMAIN"
sudo certbot certificates

Open:

text
https://example.com

6. Renewal Test ​

bash
sudo certbot renew --dry-run