SSL/HTTPS Access¶

Enable Auto SSL (Let’s Encrypt) or add your Own Certificate to make your website reachable over HTTPS. Nowadays, this is considered good practice and should be enabled on all websites.

When SSL is enabled, access to the website by HTTP is not possible anymore but redirectet to HTTPS instead (HTTP Redirect for details).

Auto SSL (Let’s Encrypt)¶

We support free ssl certificates by Let’s Encrypt. Just activate Let’s Encrypt on your desired website. The certificates are automatically renewed 30 days before expiration.

Debug validation problems¶

In order to debug validation issues, we introduced the letsencrypt-renew shortcut which will trigger a run of our Let’s Encrypt client, and let you see all debug output to identifiy possible problems.

Make sure that all hosts added to Server name point to the correct server (A and AAAA DNS records).
Let’s Encrypt will try to reach your website at the endpoint /.well-known/acme-challenge/ for validation purposes. Make sure that you do not overwrite this path within your own nginx configuration.
You can check access to the validation directory by yourself by fetching the control file reachable at http://example.com/.well-known/acme-challenge/monitoring

Renewal¶

Certificates from Let’s Encrypt will be valid for 90 days. They are renewed automatically as soon as they expire in under 30 days. You can follow these checks and renewals by grep for letsencrypt in /var/log/syslog.

Furthermore, we check all certificates from our monitoring and will contact you if there are certificates expiring in less than 21 days.

Export¶

Existing Let’s Encrypt certificates are saved within /etc/nginx/ssl and can be read with the Generic Admin User. This is useful if you want to temporarily use the old certificate on a new server.

Own Certificate¶

You can add your own certificate by using the SSL cert and SSL key fields within the desired websites Advanced tab.

Before installing a custom certificate, please make sure that:

your key matches your certificate
all required intermediate certificates are included
you used up-to-date settings to generate your key and signing request

Tip

Please contact us if you are not proficient with this topic. We are happy to guide you through the process and can also order and install custom certificates on your behalf.

HTTP Redirect¶

By default, all HTTP requests within a given website are redirected to HTTPS keeping the hostname supplied by the client. If you want to change this behaviour somehow, for example by always redirect to the first hostname of the vhost, you can set http_redirect_dest string within the Custom JSON Website Level Configuration:

{
  "http_redirect_dest": "https://$server_name$request_uri"
}

Furthermore, it is possible to set the redirect destination globally through website::http_redirect_dest which will be used on all HTTP redirects without a explicitly set http_redirect_dest within the Custom JSON Server Level Configuration:

{
  "website::http_redirect_dest": "https://$server_name$request_uri"
}

Advanced Configuration¶

We will make sure that all required settings do match the state of the art configuration. Usually it is not required to change those settings, nevertheless it is possible and might be required in certain use cases.

Cipher Suite¶

Configure your desired cipher suite trough website::ssl_ciphers within the Custom JSON Server Level Configuration:

{
  "website::ssl_ciphers": "desired-cipher-suites"
}

Warning

We configure and update this value with sane defaults. Overwrite only when really required, and if you are aware of the consequences.

Diffie-Hellman parameters¶

Diffie-Hellman parameters are used for perfect forward secrecy. We supply default Diffie-Hellman parameters and update them on a regular schedule. If you want to use your own Diffie-Hellman parameters, you can generate them:

openssl dhparam -out /tmp/dhparam.pem 4096

and configure them trough website::ssl_dhparam within the Custom JSON Server Level Configuration:

{
  "website::ssl_dhparam": "-----BEGIN DH PARAMETERS-----\nMIICCAKCAgEAoOePp+Uv2M34IA+basW9CBHp/jsZihB3FI8KVRLVFJPIUJ9Llm8F\n...\n-----END DH PARAMETERS-----"
}

HSTS Header¶

By default, we add a HTTP Strict Transport Security (HSTS) header to each SSL enabled website:

Strict-Transport-Security max-age=63072000 always;

Use the header_hsts string to override the default HSTS header within the Custom JSON Website Level Configuration:

{
  "header_hsts": "max-age=3600; includeSubDomains; preload"
}

You can also disable HSTS as follows:

{
  "header_hsts": "max-age=0"
}

Tip

See the OWASP HTTP Strict Transport Security Cheat Sheet for details.

Test¶

We recommend the following online services for testing: