SSL/TLS Installation, Automation with Certbot, and Cipher Hardening

How a TLS handshake works

1. Point DNS at the server

Let's Encrypt validates that you control the domain, so the A/AAAA records must already resolve to this server. See our DNS records guide. If you use CAA records, allow letsencrypt.org.

2. Issue the certificate

sudo snap install --classic certbot
sudo ln -s /snap/bin/certbot /usr/bin/certbot
sudo certbot --nginx -d example.ca -d www.example.ca --redirect

3. Confirm automatic renewal

systemctl list-timers | grep certbot
sudo certbot renew --dry-run

4. Harden the TLS configuration

listen 443 ssl;
http2 on;

ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers off;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305;
ssl_session_timeout 1d;
ssl_session_cache shared:TLS:10m;
ssl_session_tickets off;

add_header Strict-Transport-Security "max-age=63072000; includeSubDomains" always;

This follows the 'intermediate' profile popularised by Mozilla's SSL configuration generator, which balances security with compatibility. Add HSTS preload only once you are sure every subdomain supports HTTPS permanently.

A note on OCSP stapling

Let's Encrypt has phased out OCSP in favour of certificate revocation lists, so ssl_stapling directives are no longer useful with its certificates. If you use a commercial CA that still runs OCSP, enable ssl_stapling on and ssl_stapling_verify on with a resolver directive.

5. Test

openssl s_client -connect example.ca:443 -servername example.ca -tls1_3 </dev/null | head -20
curl -sI https://example.ca | grep -i strict-transport

Back to server infrastructure, or set up your stack with the LEMP guide.