Nginx as reverse proxy with acme (letsencrypt) - Revision history

John3-16: Added /* See also */ Jitsi Meet

2026-01-01T02:55:19Z

Added See also: Jitsi Meet

← Older revision		Revision as of 02:55, 1 January 2026
Line 266:		Line 266:
	</nowiki>}}		</nowiki>}}


			== See also ==

			* [[Jitsi Meet]] - Often uses Nginx as a reverse proxy using TLS e.g. [https://github.com/jitsi/docker-jitsi-meet/issues/962 with Docker].

	[[Category:Authentication]]		[[Category:Authentication]]
	[[Category:Networking]]		[[Category:Networking]]
	[[Category:Web Server]]		[[Category:Web Server]]

2024-05-28T16:48:54Z

Undo revision 26790 by Zcrayfish (talk) - wrong button pressed on patroller page!

Can't load revision 26791

2024-05-28T16:47:14Z

Reverting: Simple vandalism

Can't load revision 26790

2024-05-26T21:01:32Z

SSL configuration: Replace a dead link by a relevant one

← Older revision		Revision as of 21:01, 26 May 2024
Line 73:		Line 73:
	Configure a file with all SSL-parameters that we can include in the virtual hosts configs later on.<br>		Configure a file with all SSL-parameters that we can include in the virtual hosts configs later on.<br>
	The security settings are inspired by the [https://ssl-config.mozilla.org/#server=nginx&version=1.16.1&config=modern&openssl=1.1.1k&guideline=5.7 Mozilla SSL Configuration Generator]. Please also read https://hstspreload.org for details about HSTS.		The security settings are inspired by the [https://ssl-config.mozilla.org/#server=nginx&version=1.16.1&config=modern&openssl=1.1.1k&guideline=5.7 Mozilla SSL Configuration Generator]. Please also read https://hstspreload.org for details about HSTS.
	{{Cat\|/etc/nginx/conf.d/ssl-params.inc\|<nowiki># secure nginx, see https://~~cipherli~~.~~st/~~		{{Cat\|/etc/nginx/conf.d/ssl-params.inc\|<nowiki># secure nginx, see https://ssl-config.mozilla.org

	ssl_protocols TLSv1.3		ssl_protocols TLSv1.3

2023-08-30T22:08:41Z

SSL configuration: Added session_timeout.

← Older revision		Revision as of 22:08, 30 August 2023
Line 77:		Line 77:
	ssl_protocols TLSv1.3		ssl_protocols TLSv1.3
	ssl_prefer_server_ciphers off;		ssl_prefer_server_ciphers off;
			ssl_session_timeout 1d;
	ssl_session_cache shared:SSL:10m;		ssl_session_cache shared:SSL:10m;
	ssl_session_tickets off; # Requires nginx >= 1.5.9		ssl_session_tickets off; # Requires nginx >= 1.5.9

2023-08-30T22:07:41Z

Per site HTTPS configuration: Work with dual-stack hosts.

← Older revision		Revision as of 22:07, 30 August 2023
Line 196:		Line 196:
	{{Cat\|/etc/nginx/conf.d/alpinelinux.org.conf\|<nowiki>		{{Cat\|/etc/nginx/conf.d/alpinelinux.org.conf\|<nowiki>
	server {		server {
	listen 443 ssl http2;		listen 443 ssl http2;
			listen [::]:443 ssl http2;
	server_name alpinelinux.org		server_name alpinelinux.org
	ssl on;		ssl on;
Line 210:		Line 211:
	}		}
	</nowiki>}}		</nowiki>}}



	=== Redirect HTTP to HTTPS ===		=== Redirect HTTP to HTTPS ===

2023-08-30T22:05:20Z

dh is ancient and not great. It should not be needed on current versions of nginx thanks to EC cryptography.

← Older revision		Revision as of 22:05, 30 August 2023
Line 95:		Line 95:
	add_header X-Robots-Tag none;		add_header X-Robots-Tag none;
	</nowiki>}}		</nowiki>}}

	~~==== Diffie–Hellman Parameters ====~~

	In the above configuration <var>ssl_dhparam</var> is used, so we need to generate a global <code>dhparam</code> file. We want to use a 4096 key size, but this can take a very long time. Because of this, we are adding an extra option (<var>dsaparam</var>) to generate our <code>dhparam</code> file (see [https://wiki.openssl.org/index.php/Manual:Dhparam(1)#OPTIONS this]{{dead link}} wiki section):

	~~{{Cmd\|openssl dhparam -dsaparam -out /etc/nginx/dhparam.pem 4096}}~~

	~~At this point, you should be able to (re)start your nginx server, but it will not use any of the security features yet.~~

	==== Per site configuration files (conf.d) ====		==== Per site configuration files (conf.d) ====

2023-08-30T22:03:45Z

SSL configuration: Updated SSL configuration to make sense with nginx 1.16.1 and up.

← Older revision		Revision as of 22:03, 30 August 2023
Line 72:		Line 72:

	Configure a file with all SSL-parameters that we can include in the virtual hosts configs later on.<br>		Configure a file with all SSL-parameters that we can include in the virtual hosts configs later on.<br>
	The security settings are ~~taken from~~ https://~~cipherli~~.~~st{{dead link}}~~. Please also read https://hstspreload.org for details about HSTS.		The security settings are inspired by the [https://ssl-config.mozilla.org/#server=nginx&version=1.16.1&config=modern&openssl=1.1.1k&guideline=5.7 Mozilla SSL Configuration Generator]. Please also read https://hstspreload.org for details about HSTS.
	{{Cat\|/etc/nginx/conf.d/ssl-params.inc\|<nowiki># secure nginx, see https://cipherli.st/		{{Cat\|/etc/nginx/conf.d/ssl-params.inc\|<nowiki># secure nginx, see https://cipherli.st/

	#ssl_protocols TLSv1.3~~; # Requires nginx >= 1.13.0 else use TLSv1.2~~		ssl_protocols TLSv1.3
	~~ssl_protocols TLSv1.2; # We use TLSv1.2 because current stable nginx release don't support TLSv1.3 yet~~		ssl_prefer_server_ciphers off;
	ssl_prefer_server_ciphers ~~on;~~
	~~ssl_dhparam /etc/nginx/dhparam.pem; # openssl dhparam -out /etc/nginx/dhparam.pem 4096~~
	~~ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH";~~
	~~ssl_ecdh_curve secp384r1~~; ~~# Requires nginx >= 1.1.0~~
	ssl_session_cache shared:SSL:10m;		ssl_session_cache shared:SSL:10m;
	ssl_session_tickets off; # Requires nginx >= 1.5.9		ssl_session_tickets off; # Requires nginx >= 1.5.9

2021-12-20T22:14:59Z

Marked a dead link.

← Older revision		Revision as of 22:14, 20 December 2021
Line 72:		Line 72:

	Configure a file with all SSL-parameters that we can include in the virtual hosts configs later on.<br>		Configure a file with all SSL-parameters that we can include in the virtual hosts configs later on.<br>
	The security settings are taken from https://cipherli.st. Please also read https://hstspreload.org for details about HSTS.		The security settings are taken from https://cipherli.st{{dead link}}. Please also read https://hstspreload.org for details about HSTS.
	{{Cat\|/etc/nginx/conf.d/ssl-params.inc\|<nowiki># secure nginx, see https://cipherli.st/		{{Cat\|/etc/nginx/conf.d/ssl-params.inc\|<nowiki># secure nginx, see https://cipherli.st/

2021-12-20T22:07:48Z

Marked a dead link.

← Older revision		Revision as of 22:07, 20 December 2021
Line 102:		Line 102:
	==== Diffie–Hellman Parameters ====		==== Diffie–Hellman Parameters ====

	In the above configuration <var>ssl_dhparam</var> is used, so we need to generate a global <code>dhparam</code> file. We want to use a 4096 key size, but this can take a very long time. Because of this, we are adding an extra option (<var>dsaparam</var>) to generate our <code>dhparam</code> file (see [https://wiki.openssl.org/index.php/Manual:Dhparam(1)#OPTIONS this] wiki section):		In the above configuration <var>ssl_dhparam</var> is used, so we need to generate a global <code>dhparam</code> file. We want to use a 4096 key size, but this can take a very long time. Because of this, we are adding an extra option (<var>dsaparam</var>) to generate our <code>dhparam</code> file (see [https://wiki.openssl.org/index.php/Manual:Dhparam(1)#OPTIONS this]{{dead link}} wiki section):

	{{Cmd\|openssl dhparam -dsaparam -out /etc/nginx/dhparam.pem 4096}}		{{Cmd\|openssl dhparam -dsaparam -out /etc/nginx/dhparam.pem 4096}}