How to create a SSL with Letsencrypt

Letsencrypt for Nginx

Your web server ports (443,80) must be open the public;

user@webserver:~$ git clone https://github.com/letsencrypt/letsencrypt
user@webserver:~$ cd letsencrypt
user@webserver:~/letsencrypt$ ./letsencrypt-auto --help

user@webserver:$./letsencrypt-auto certonly --standalone --agree-tos --redirect --duplicate --text --email your@mailaddress -d yourdomain.com

Open Nginx config file;

server {

listen 443 ssl;

    ssl_certificate         /etc/letsencrypt/live/helloworld.letsencrypt.org/fullchain.pem;
    ssl_certificate_key     /etc/letsencrypt/live/helloworld.letsencrypt.org/privkey.pem;
    ssl_trusted_certificate /etc/letsencrypt/live/helloworld.letsencrypt.org/fullchain.pem;
    ssl_session_timeout 1d;
    ssl_session_cache shared:SSL:50m;

ssl_dhparam /etc/nginx/dhparam.pem;

ssl_protocols TLSv1 TLSv1.1 TLSv1.2;

ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:ECDHE-RSA-DES-CBC3-SHA:ECDHE-ECDSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA';

ssl_prefer_server_ciphers on;

add_header Strict-Transport-Security max-age=15768000;

ssl_stapling on; ssl_stapling_verify on;

}

For more information ;

https://github.com/letsencrypt/letsencrypt 

Exporting SSL certificates from Windows to Linux

Exporting SSL certificates from Windows to  Linux 

Step 1:
Exporting ssl cert. from iis , format must be .pfx.

Step 2:
#cd /etc/nginx/
#mkdir ssl
#cd ssl
#mv /path/to/pfx/sslbackup.pfx
#chmod 400 sslbackup.fpx

Step 3:
3.1:
Export public cert.
#openssl pkcs12 -in ./sslbackup.pfx -clcerts -nokeys -out public.crt
3.2:
Export key
#openssl pkcs12 -in ./sslbackup.pfx -nocerts -nodes -out private.rsa
3.3:
Test the cert..
#openssl s_server -www -accept 443 -cert ./public.crt -key ./private.rsa
!!permisson kontrol #chmod 400 /etc/nginx/ssl/*

Step 4:
#nano /etc/nginx/sites-available/example.org.conf
upstream exampleapp{
        server web-app-node1;
        server web-app-node2;
        }

server {
        listen 80;
        listen 443 ssl;
        server_name example.org;

        ssl on;
        ssl_certificate /etc/nginx/ssl/public.crt;
        ssl_certificate_key /etc/nginx/ssl/private.rsa;

        location / {
        proxy_pass http://exampleapp;
        proxy_set_header Host $host;
        proxy_set_header X-Ssl on;
        }
}
#service nginx configtest

#service nginx reload

Exporting SSL certificates from Linux to Windows

Exporting SSL certificates from Linux to  Windows 

Step 1: Create pem file
#openssl rsa -in server.key -out nopassword.key
#cat nopassword.key > server.pem
#cat server.crt >> server.pem
#cat intermediate.crt >> server.pem

Pem file must be like this and there mustn't any whitespace;

-----BEGIN RSA PRIVATE KEY-----
(Your Private Key: your_domain_name.key)
-----END RSA PRIVATE KEY-----
-----BEGIN CERTIFICATE-----
(Your Primary SSL certificate: your_domain_name.crt)
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
(Your Intermediate certificate: certChainCA.crt)
-----END CERTIFICATE-----

Step 2: p12 file
#openssl pkcs12 -export -in server.pem -out server.p12


Step 3: Import the p12 file in IIS