Certbot on Apache server behind a Nginx reverse proxy

[Anonimni]

Thanks guys for everything!
[Mon Feb 13 23:36:39 UTC 2017] Your cert is in /root/.acme.sh/amacert.info/amacert.info.cer
[Mon Feb 13 23:36:39 UTC 2017] Your cert key is in /root/.acme.sh/amacert.info/amacert.info.key
[Mon Feb 13 23:36:41 UTC 2017] The intermediate CA cert is in /root/.acme.sh/amacert.info/ca.cer
[Mon Feb 13 23:36:41 UTC 2017] And the full chain certs is there: /root/.acme.sh/amacert.info/fullchain.cer

You did it!

I just have one more question, i have to edit my nginx config file now and i need to add
ssl on;
ssl_certificate /etc/nginx/ssl/example.io-cert.pem;
ssl_certificate_key /etc/nginx/ssl/example.io-key.pem;
The certs i got are .cer and .key and in the example its .pem , does that matter?

[mnordhoff]

To be clear, you should set Nginx's ssl_certificate to the "full chain" file, "/root/.acme.sh/amacert.info/fullchain.cer" in that example. E.g.:

ssl_certificate /root/.acme.sh/amacert.info/fullchain.cer;

You shouldn't use the "cert" file, amacert.info.cer.

But you can call the files whatever you want. If "/etc/nginx/ssl/example.io-cert.pem" is a copy of the "fullchain.cer" file, that's fine!

@Anonimni

The certs i got are .cer and .key and in the example its .pem , does that matter?

Nope! It's all the same. Different people prefer to call the files different things, but it doesn't matter. They're using the same file format, and Nginx doesn't inherently care what you call the file, just what it contains.

[Anonimni]

Thanks guys for everything, you both are lifesavers! I just have to go around the shitty namecheap dns servers and all my domains will be with ssl. Thanks thanks thanks!

[schoen]

I’m glad it worked (nice work, @mnordhoff)! Please remember to renew your certificate within 90 days so that your visitors won’t encounter a certificate expiration error.

[Anonimni]

I managed to create the certificates, set up my nginx config like this:

server {
listen 80;
listen 443 ssl;
server_name amacert.info www.amacert.info;

ssl on;
ssl_certificate /root/.acme.sh/amacert.info/fullchain.cer;
ssl_certificate_key /root/.acme.sh/amacert.info/amacert.info.key;

location / {
    proxy_pass http://mybackendip:8080;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
}

}

It works, but my browser gives me this warning:

Screenshot

"This page is trying to load scripts from unauthenticated source"
And my scripts cant load until i enable them in the browser. How do i fix this?

[mnordhoff]

If that’s your precise configuration, you need to remove the deprecated “ssl on;” directive.

“listen 443 ssl;” already enables SSL on (IPv4) port 443.

“ssl on;” may cause it to also do SSL on port 80, the HTTP port! Anyone connecting to http://amacert.info/ or http://www.amacert.info/ would then get a bizarre error message.

[Anonimni]

I forgot to say it only stays in https if i add proxy_redirect http:// $scheme://; to my nginx config, if i leave it out it simply redirects to http version of the site. But when i use the proxy_redirect http:// $scheme://; command it shows the mixed content warning. Is it maybe because my connection between my backend and my frontend server isnt over https? I set up my servers with this guide: https://www.digitalocean.com/community/tutorials/how-to-configure-nginx-as-a-web-server-and-reverse-proxy-for-apache-on-one-ubuntu-16-04-server
How can i secure the connection between backend(apache) and frontend(nginx) with my current setup?
Thank you so much for the great support you have given me till now, i dont know where you draw your energy from but i appreciate it really, thanks!

[Anonimni]

Could i maybe set up nginx to cache all files from the backend server? Would that solve my problem and if, how do i do that? Thanks!

[leader]

You should not need to use proxy_redirect. The fact that the connection between the frontend and backend is not secure is also irrelevant. The fact that you are getting mixed content errors and it does not “stay in https” is more likely caused by referencing specific scheme explicitly on your pages. Basically you are trying to load a page over https, but some (or all) links and references to active content (such as JS) are pointing to http://. Drop the scheme (just use //) and errors will probably go away.

[Anonimni]

I fixed it by editing my code, thanks for the advice. I got everything set up thanks to this community and the users who spend their precious time by helping others. Thanks!