Skip to content
SKSohaib Khan

Setup Nginx for Odoo with SSL using Let's Encrypt

OpenERP backend We are assuming you've Odoo already installed on your server, If it's not installed use my guide to install it first. How to install Odoo on Ubuntu or Debian Install Nginx and Certbot first sudo apt…

Sohaib Khan2 min read
Setup Nginx for Odoo with SSL using Let's Encrypt

OpenERP backend

We are assuming you've Odoo already installed on your server, If it's not installed use my guide to install it first. How to install Odoo on Ubuntu or Debian

Install Nginx and Certbot first

Shell1 line
sudo apt install certbot && nginx -y
Shell1 line
sudo openssl dhparam -out /etc/ssl/certs/dhparam.pem 2048
Shell3 lines
mkdir -p /var/lib/letsencrypt/.well-known
chgrp www-data /var/lib/letsencrypt
chmod g+s /var/lib/letsencrypt
Shell1 line
sudo nano /etc/nginx/snippets/letsencrypt.conf
Nginx6 lines
location ^~ /.well-known/acme-challenge/ {
  allow all;
  root /var/lib/letsencrypt/;
  default_type "text/plain";
  try_files $uri =404;
}
Shell1 line
sudo nano /etc/nginx/snippets/ssl.conf
PLAINTEXT18 lines
ssl_dhparam /etc/ssl/certs/dhparam.pem;

ssl_session_timeout 1d;
ssl_session_cache shared:SSL:50m;
ssl_session_tickets off;

ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers 'ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS';
ssl_prefer_server_ciphers on;

ssl_stapling on;
ssl_stapling_verify on;
resolver 8.8.8.8 8.8.4.4 valid=300s;
resolver_timeout 30s;

add_header Strict-Transport-Security "max-age=15768000; includeSubdomains; preload";
add_header X-Frame-Options SAMEORIGIN;
add_header X-Content-Type-Options nosniff;
Nginx35 lines
## OpenERP backend ##
upstream sohaib {
   server 127.0.0.1:8069;
}

server {
    index index.html index.htm;
    server_name YOURDOMAIN.COM;
    location / {
        proxy_pass  http://sohaib;
        proxy_next_upstream error timeout invalid_header http_500 http_502 http_503 http_504;
        proxy_redirect off;

        proxy_set_header    Host            $host;
        proxy_set_header    X-Real-IP       $remote_addr;
        proxy_set_header    X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header    X-Forwarded-Proto https;
    }

    listen 443 ssl;
    ssl_certificate /etc/letsencrypt/live/YOURDOMAIN.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/YOURDOMAIN.com/privkey.pem;
    include snippets/letsencrypt.conf;
    ssl_dhparam /etc/ssl/certs/dhparam.pem;
}

server {
    if ($host = YOURDOMAIN.COM) {
        return 301 https://$host$request_uri;
    }
    listen 80 ;
    listen [::]:80 ;
    server_name yourdomain.com;
    return 301 https://$host$request_uri;
}

Let's get that Certificate
If you get any error by running the following command, that normally means you screw something up, Other than that, everything should be fine, but before you run the following command, make sure your domain is pointing and host is resolving.

Shell1 line
sudo certbot certonly --agree-tos --email [email protected] --webroot -w /var/lib/letsencrypt/ -d sohaib.com -d www.sohaib.com
PLAINTEXT2 lines
crontab -e
30 03 * * 0 certbot renew

Was this worth your time?

Continue reading

Related field notes

Full archive