Configure SSL on the WordPress image

If, after configuring the domain on our WordPress image, you want to secure your blog with an SSL certificate, follow the steps below.

You will need to install Certbot to install a free certificate from Let’s Encrypt. To complete these steps, you will need to connect via SSH to the WordPress server we created and configure it  as explained below.

Getting started

Before installing the certificate, you will first need to configure the domain in WordPress. To do this, follow the steps in this other tutorial: Add a domain to the WordPress image. When adding the domain in WordPress, it is important that you use HTTPS instead of HTTP:

Once you save the changes, the website will stop working. You will then need to connect to the server via SSH and carry out the following steps.

Manual SSL certificate installation

Install the following packages to manage certificates with Certbot:

# apt update && apt install python3-certbot-nginx -y

You will then need to modify the site's NGINX configuration file:

# nano /etc/nginx/sites-enabled/default

And change the server_name line to your domain and/or subdomains. Example (adding www is optional, it is not required):

server_name midominio.es www.midominio.es;

Save and restart the Nginx service:

# systemctl reload nginx

Finally, generate the certificate with the following command (if you have only added one record):

# certbot --redirect --installer nginx -d midominio.es

If you have added www or another, you will need to add it using this pattern:

# certbot --redirect --installer nginx -d midominio.es -d www.midominio.es

When you run it, you will be prompted to enter an email address and then accept the terms and conditions. Finally, you will also be asked whether you want to subscribe to the Let's Encrypt newsletter (optional). Once completed, certbot will automatically obtain and configure the certificate on the web server.

SSL certificate installation using a script

To automate the entire process, we have created a script to run the installation with a single command. Check your operating system by running:

# hostnamectl

Download the script to configure SSL in Nginx on the WordPress image:

# wget https://gitlab.com/clouding.io-tech.support/certbot-ssl-images/raw/master/wp-nginx-ssl.sh
# chmod u+x wp-nginx-ssl.sh

The syntax for generating the certificate is:

# ./wp-nginx-ssl.sh dominio e-mail [www]

For example:

# ./wp-nginx-ssl.sh clouding.io no-reply@clouding.io

If you also want to add an alias for www, you can run it with the optional www option:

# ./wp-nginx-ssl.sh clouding.io no-reply@clouding.io www

The email address must be active, and the domain and the www alias must point to the server.

Configure Nginx to pass security tests (Optional)

add_header Strict-Transport-Security “max-age=31536000; includeSubDomains; preload”;
add_header X-Frame-Options DENY;
add_header X-Content-Type-Options nosniff;
add_header X-XSS-Protection “1; mode=block”;
add_header Referrer-Policy “origin”;

With these 5 parameters, you will get an A rating on www.webpagetest.org, but to achieve the highest rating of A+, you will need to configure an additional header for "Content Security Policy", which is quite complicated, as you will need to identify and specify all the trusted sources your site uses. 

add_header Content-Security-Policy "default-src 'none'; script-src 'self'; connect-src 'self'; img-src 'self'; style-src 'self';";

This last case requires a lot of trial and error to find the optimal configuration that does not block your server. If you are unsure how to use this policy, bear in mind that it is not strictly necessary to achieve a good security rating.

Disable obsolete TLS versions in certificates (Optional)

Currently, versions SSLv1, SSLv2, SSLv3, TLS 1.0 and TLS 1.1 are considered obsolete and this makes using these versions of the TLS protocol unsafe. To address this, you will need to edit the following file:

# vi /etc/letsencrypt/options-ssl-nginx.conf 

Edit the variable "ssl_protocols" to match the following example:

ssl_protocols TLSv1.2 TLSv1.3;

With these changes, you should pass all SSL and security tests for your web server.