Assign SSL to Wordpress, nginx, certbot

This tutorial recommends to assign SSL before installing Wordpress and only then install it directly from https. If the wordpress is already installed then delete all tables from Wordpress database. Of course all content of Wordpress site will be gone!

nginx use virtual hosts layer to put Wordpress into the air.

I have a domain name 5d61050b753b.sn.mynetname.net which comes for free when I enable VPN into the Mikrotik router. I am running Wordpress server on Raspbian Jessie operating system on Raspberry Pi 3.

The NAT for 80 port and 443 has been made

I am hosting Wordpress on internal address 192.168.88.24

The main nginx configuration /etc/nginx/nginx.conf says:

#egrep -v "^[[:space:]]*#|^$" /etc/nginx/nginx.conf
user www-data;
worker_processes 4;
pid /run/nginx.pid;
events {
        worker_connections 768;
}
http {
        client_max_body_size 256m;
        sendfile on;
        tcp_nopush on;
        tcp_nodelay on;
        keepalive_timeout 65;
        types_hash_max_size 2048;
        server_names_hash_bucket_size 64;
        include /etc/nginx/mime.types;
        default_type application/octet-stream;
        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
        ssl_prefer_server_ciphers on;
        access_log /var/log/nginx/access.log;
        error_log /var/log/nginx/error.log;
        gzip on;
        gzip_disable "msie6";
        include /etc/nginx/conf.d/*.conf;
        include /etc/nginx/sites-enabled/*;
}
#nginx -t -c /etc/nginx/nginx.conf

Lets install free SSL

#move to supper root
sudo su

#make sure all repositories are up to date and the system have already newest packages
apt-get upgrade -y && apt-get update -y

#move to the home directory of root
cd

#download certbot utility. this will take care of everything as much it can
wget https://dl.eff.org/certbot-auto

#set cert bot executable
chmod +x certbot-auto

#generate certificate
./certbot-auto certonly
#at first time this will install a lot of python packages and modules and so on.
#this will take like 10 minutes on Raspberry Pi 3. feel free to take a cup of tea

Choose [Place files in web directory] option:

Enter email address:

Read and agree terms of service:

Enter domain name:

Choose [Enter new webroot]:

This is the complicated part. Easiest way is to write full webroot by hand:

All done. I got key and certificate now :)

All files is located:

ls /etc/letsencrypt/live/5d61050b753b.sn.mynetname.net

And here is four files:

cert.pem  chain.pem  fullchain.pem  privkey.pem

I need to use only fullchain.pem and privkey.pem!

Lets assign these files to virtual host file:

#cat /etc/nginx/sites-available/5d61050b753b.sn.mynetname.net
server {
server_name 5d61050b753b.sn.mynetname.net;
#listen 80;
listen 443;
ssl on;
ssl_certificate /etc/letsencrypt/live/5d61050b753b.sn.mynetname.net/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/5d61050b753b.sn.mynetname.net/privkey.pem;
root /var/www/5d61050b753b.sn.mynetname.net/;
access_log /var/log/nginx/5d61050b753b.sn.mynetname.net-access.log;
error_log /var/log/nginx/5d61050b753b.sn.mynetname.net-error.log;
index index.php index.html index.htm;
location ~ \.php {
fastcgi_split_path_info ^(.+\.php)(/.+)$;
fastcgi_pass unix:/var/run/php5-fpm.sock;
fastcgi_index index.php;
include fastcgi.conf;
}
}
#nginx -t -c /etc/nginx/nginx.conf
#/etc/init.d/nginx restart

Now I only need to restart nginx:

/etc/init.d/nginx restart