🔒 Make Your Website HTTPS (Free SSL with Certbot)

📘 What You Will Learn

• What HTTPS is and why your site needs it
• How SSL certificates work (simple explanation)
• How to get a FREE certificate using Certbot
• How to auto-redirect HTTP → HTTPS
• How to auto-renew so it never expires

---

🧠 Easy Analogy (Must Read First!)

Think of HTTP vs HTTPS like sending a message:

• 📮 HTTP = Sending a postcard. Anyone who handles it can read everything.
• 🔐 HTTPS = Sending a sealed, locked envelope. Only the receiver can open it.

When users type passwords or personal info on your website — HTTPS keeps it safe.

---

🧠 What is an SSL Certificate?

An SSL Certificate is a small file that does 2 things:

1. ✅ Proves your site is real (not a fake copy)
2. ✅ Encrypts all data between browser and server

Certificates are issued by trusted organizations called Certificate Authorities (CAs).

We will use Let's Encrypt — a CA that gives certificates 100% free.

Their tool Certbot does almost everything automatically.

---

⚔️ HTTP vs HTTPS

Feature	HTTP ❌	HTTPS ✅
Data encrypted?	No	Yes
Browser padlock?	No	Yes
Google SEO ranking	Lower	Higher
Safe for passwords?	No	Yes
Modern features (camera, payments)?	No	Yes

---

🚨 Before You Start

Make sure: - ✅ You have a domain name (e.g., studycode.pro) - ✅ Domain DNS points to your server IP - ✅ Nginx is installed and running - ✅ Port 80 and 443 are open on your firewall

Check Nginx is running:

sudo systemctl status nginx

You should see: active (running)

---

🛠️ Step 1: Install Certbot

Certbot is the tool that gets your certificate and configures Nginx for you.

sudo apt update
sudo apt install certbot python3-certbot-nginx -y

🧠 Why python3-certbot-nginx?

This is a plugin that lets Certbot automatically edit your Nginx config file. Without it, you'd have to configure everything by hand.

---

🛠️ Step 2: Get Your Certificate

sudo certbot --nginx -d yourdomain.com -d www.yourdomain.com

🧠 Command Breakdown

Part	Meaning
--nginx	Use Nginx plugin (auto-configure)
-d yourdomain.com	Issue certificate for your domain
-d www.yourdomain.com	Also cover the www version

---

🛠️ Step 3: Answer Certbot's Questions

Certbot will ask you a few things:

Enter email address: your@email.com

Agree to Terms of Service? → A (Agree)

Redirect HTTP to HTTPS?
  1: No redirect
  2: Redirect ✅ ← Choose this

🧠 Why choose Redirect?

If someone visits http://yourdomain.com — they automatically go to https://yourdomain.com.

Nobody accidentally uses the insecure version. ✅

---

✅ Success Output

If it works, you'll see:

Congratulations! Your certificate and chain have been saved at:
/etc/letsencrypt/live/yourdomain.com/fullchain.pem

Your certificate will expire on 2025-08-14.

🎉 Your website is now HTTPS!

---

🧠 What Certbot Did Behind the Scenes

Certbot automatically:

1. ✅ Verified you own yourdomain.com
2. ✅ Generated a certificate and private key
3. ✅ Edited your Nginx config to use SSL
4. ✅ Added redirect rule: HTTP → HTTPS

Your Nginx config now looks like this:

# HTTPS — your main site
server {
    listen 443 ssl;
    server_name yourdomain.com www.yourdomain.com;

    ssl_certificate /etc/letsencrypt/live/yourdomain.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/yourdomain.com/privkey.pem;

    # ... rest of your config ...
}

# HTTP → HTTPS redirect
server {
    listen 80;
    server_name yourdomain.com www.yourdomain.com;
    return 301 https://$host$request_uri;
}

The 301 means: "This page permanently moved to HTTPS." Browsers remember this and go straight to HTTPS next time.

---

🛠️ Step 4: Test and Reload Nginx

# Check config for errors
sudo nginx -t

# Apply changes
sudo systemctl reload nginx

Now open your browser: - https://yourdomain.com → 🔒 Padlock shows - http://yourdomain.com → Auto-redirects to HTTPS

---

🛠️ Step 5: Set Up Auto-Renewal

Let's Encrypt certificates expire every 90 days.

Certbot already sets up a timer that checks and renews automatically. Let's confirm it's active:

sudo systemctl status certbot.timer

You should see: active (waiting) ✅

Test the renewal process (safe — doesn't actually renew):

sudo certbot renew --dry-run

✅ If you see "simulated renewal succeeded" — you're done. Your certificate will renew itself forever. You never need to touch it again.

---

❌ Common Problems & Fixes

❌ Port 443 blocked / Connection refused

# Open ports in Linux firewall
sudo ufw allow 'Nginx Full'
sudo ufw status

---

❌ certbot: command not found

sudo snap install --classic certbot
sudo ln -s /snap/bin/certbot /usr/bin/certbot

---

❌ Domain did not pass validation

Certbot couldn't reach your domain. Check: - Does your domain DNS A record point to your server IP? - Is port 80 open? (Certbot needs it to verify your domain) - Is Nginx running?

---

🎯 Final Summary

HTTP  = Unsecure, plain text ❌
HTTPS = Encrypted, safe ✅

Let's Encrypt = Free certificate authority
Certbot = Tool that gets and installs the certificate

Certificate expires every 90 days → auto-renewed by Certbot ✅

---

📌 Quick Command Reference

Step	Command
Install Certbot	sudo apt install certbot python3-certbot-nginx
Get certificate	sudo certbot --nginx -d yourdomain.com
Test Nginx config	sudo nginx -t
Reload Nginx	sudo systemctl reload nginx
Test auto-renewal	sudo certbot renew --dry-run

---

📌 Next Step

👉 Learn how Nginx and Gunicorn work together to serve your Flask app →