How to secure your website with an Nginx Reverse-Proxy and Acmetool/Let’s Encrypt

Assuming you want to secure your website from the outside environment, I will show you how to properly do that using a reverse-proxy and a http to https redirector on a fresh Debian 8.
Let’s start by downloading nginx

apt-get install -y nginx

After which, you should create a new configuration for your reverse-proxy.

sudo nano /etc/nginx/sites-available/reverse

And add the following code in it, modify it accordingly so it will suit your needs

server {
        listen 443 ssl;
        server_name example.com;
        #ssl_certificate 
        #ssl_certificate_key 
        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
        ssl_prefer_server_ciphers on;
        ssl_session_cache shared:SSL:10m;
        add_header X-Frame-Options SAMEORIGIN;
        add_header X-Content-Type-Options nosniff;
        ssl_session_tickets off; # Requires nginx >= 1.5.9
        ssl_stapling on; # Requires nginx >= 1.3.7
        ssl_stapling_verify on; # Requires nginx => 1.3.7
        location / {
             proxy_set_header        Host $host;
             proxy_set_header        X-Real-IP $remote_addr;
                proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header        X-Forwarded-Proto $scheme;
             proxy_pass http://192.168.x.x;
        }
}

As you can see I’ve commented the ssl_certificate and ssl_certificate_key lines, for now. We will return to that after we install acmetool. I have to mention that you have to change example.com with your domain and the proxy_pass should point to the IP of your website, webserver, app, etc.
Exit and save the file, and run the following command to activate the virtual host.

sudo ln -s /etc/nginx/sites-available/reverse /etc/nginx/sites-enabled/reverse

To avoid having a conflict between Nginx and acmetool (acmetool requires port 80), we have delete, or modify /etc/nginx/sites-enabled/default. You can delete it by running the command sudo rm /etc/nginx/sites-enabled/default or you can edit it like this:

nano /etc/nginx/sites-enabled/default

find the following lines:

server {
        	listen 80 default_server;
        	listen [::]:80 default_server;

and edit them to look like this:

server {
        	listen 8080 default_server;
        	listen [::]:8080 default_server;

This way nginx will not interfere with acmetool. Don’t worry acmetool has a redirector function that will automatically redirect you from port 80 to port 443 (from http to https).
We will leave nginx as it is for now and we will install and configure Acmetool, so that we can acquire a ssl certificate. To install acmetool we have to run the following commands:

echo 'deb http://ppa.launchpad.net/hlandau/rhea/ubuntu xenial main' > /etc/apt/sources.list.d/rhea.list
	apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 9862409EF124EC763B84972FF5AC9651EDB58DFA
	apt-get update
	apt-get install acmetool

Now that we have acmetool installed we just have initialize it and run some commands to enable the redirector and request a certificate.
Run the quickstart wizard, this will set up your let’s encrypt account, will set your renewal cronjob, etc.

sudo acmetool quickstart

This is the result of the command:

We will choose (and press) number 1, we want after all live certificates for a live website.
Next, this screen will appear, we will select (and press) number 3, because we want automatic redirection to https.

We have to agree to the terms of service so we press Y

And now we have to set up and email for the let’s encrypt account, this way if something goes wrong and the certificates are not renewed, you will be notified by email in the moment that there are 19 day left until your certificate expires.

The next step is to install acmetool-redirector, it will be installed as a service so if you want to restart/stop/start it, you should run service acmetool-redirector start/stop/restart. For now, just press Y.

The next screen is just to inform you if acmetool-redirector has been installed/started successfully.

Just hit Enter and a new screen appears. On this step it asks you if you want to install auto-renewal cronjob. I recommend you press Y, but you can also press N if you want to setup the cronjob yourself.

And we are finished, the configuration is complete.

To request a certificate you have to run the command mentioned above. Be aware that for this to work your reverse proxy server needs to have a public IP.

sudo acmetool want example.com 

If the request is successful you have to edit the nginx reverse proxy configuration to set to commented lines we talked about earlier. So the configuration will look something like this:

server {
        listen 443 ssl;
        server_name example.com;
        #ssl_certificate /var/lib/acme/live/example.com/fullchain;
        #ssl_certificate_key /var/lib/acme/live/example/com/privkey; 
        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
        ssl_prefer_server_ciphers on;
        ssl_session_cache shared:SSL:10m;
        add_header X-Frame-Options SAMEORIGIN;
        add_header X-Content-Type-Options nosniff;
        ssl_session_tickets off; # Requires nginx >= 1.5.9
        ssl_stapling on; # Requires nginx >= 1.3.7
        ssl_stapling_verify on; # Requires nginx => 1.3.7
        location / {
             proxy_set_header        Host $host;
             proxy_set_header        X-Real-IP $remote_addr;
                proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header        X-Forwarded-Proto $scheme;
             proxy_pass http://192.168.x.x;
        }
}

Restart your nginx server and you should have a working reverse-proxy.

And that’s it, feel free to comment down bellow if you encounter any errors or if you have any questions.