By BenJohnston
Hi,
I’m having an issue getting Let’s Encrypt to work on my current droplet (Nginx on Ubuntu 16.04.2 with the Grav CMS). I’ve followed the tutorial (https://www.digitalocean.com/community/tutorials/how-to-secure-nginx-with-let-s-encrypt-on-ubuntu-16-04) and once I figured out that installing Grav had moved the root, I experienced no errors.
The problem is, it just isn’t working. My site still returns http and errors at https. Is there something I’m missing? My /etc/nginx/sites-available/default file is pasted below. Could Grav be overwriting something?
Any help appreciated.
Thanks,
Ben
server { listen 80; listen [::]:80; server_name ben-johnston.co.uk www.ben-johnston.co.uk; return 301 https://www.ben-johnston.co.uk$request_uri; }
server{ # SSL configuration # listen 443 ssl http2 default_server; listen [::]:443 ssl http2 default_server; include snippets/ssl-www.ben-johnston.co.uk.conf; include snippets/ssl-params.conf; # # Note: You should disable gzip for SSL traffic. # See: https://bugs.debian.org/773332 # # Read up on ssl_ciphers to ensure a secure configuration. # See: https://bugs.debian.org/765782 # # Self signed certs generated by the ssl-cert package # Don’t use them in a production server! # # include snippets/snakeoil.conf; server_name www.ben-johnston.co.uk;
root /home/grav/www/html;
location ~ /.well-known {
allow all;
}
# Add index.php to the list if you are using PHP
index index.html index.htm index.nginx-debian.html;
server_name www.ben-johnston.co.uk;
location / {
# First attempt to serve request as file, then
# as directory, then fall back to displaying a 404.
try_files $uri $uri/ =404;
}
} # pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000 # #location ~ .php$ { # include snippets/fastcgi-php.conf; # # # With php7.0-cgi alone: # fastcgi_pass 127.0.0.1:9000; # # With php7.0-fpm: # fastcgi_pass unix:/run/php/php7.0-fpm.sock; #}
# deny access to .htaccess files, if Apache's document root
# concurs with nginx's one
#
#location ~ /\.ht {
# deny all;
#}
}
This textbox defaults to using Markdown to format your answer.
You can type !ref in this text area to quickly search our full set of tutorials, documentation & marketplace offerings and insert the link!
Hi @BenJohnston
Let’s make sure the configurations in /etc/nginx/sites-available/ are the same as the ones in /etc/nginx/sites-enabled/.
Please run these two commands and post the result:
ls -ls /etc/nginx/sites-available/
ls -ls /etc/nginx/sites-enabled/
And let’s see the status of your firewall, so we know if it’s active or not:
sudo ufw status
PS - use the </> button the comment editor to encapsulate as code, which is easier to read and it doesn’t lose formatting.
OK, so here’s what we’ve got in there. I’m guessing I need to add the SSL configuration files into this file?
server {
#listen 80;
index index.html index.php;
## Begin - Server Info
root /home/grav/www/html;
server_name 138.68.130.152;
## End - Server Info
## Begin - Index
# for subfolders, simply adjust the rewrite:
# to use `/subfolder/index.php`
location / {
try_files $uri $uri/ /index.php?_url=$uri;
}
## End - Index
## Begin - PHP
location ~ \.php$ {
# Choose either a socket or TCP/IP address
fastcgi_pass unix:/run/php/php7.0-fpm.sock;
# fastcgi_pass 127.0.0.1:9000;
fastcgi_split_path_info ^(.+\.php)(/.+)$;
fastcgi_index index.php;
include fastcgi_params;
fastcgi_param SCRIPT_FILENAME $document_root/$fastcgi_script_name;
}
## End - PHP
## Begin - Security
# deny all direct access for these folders
location ~* /(.git|cache|bin|logs|backups)/.*$ { return 403; }
# deny running scripts inside core system folders
location ~* /(system|vendor)/.*\.(txt|xml|md|html|yaml|php|pl|py|cgi|twig|sh|bat)$ { return 403; }
# deny running scripts inside user folder
location ~* /user/.*\.(txt|md|yaml|php|pl|py|cgi|twig|sh|bat)$ { return 403; }
# deny access to specific files in the root folder
location ~ /(LICENSE|composer.lock|composer.json|nginx.conf|web.config|htaccess.txt|\.htaccess) { return 403; }
## End - Security
}
Thanks again.
Become a contributor for community
Get paid to write technical tutorials and select a tech-focused charity to receive a matching donation.
DigitalOcean Documentation
Full documentation for every DigitalOcean product.
Resources for startups and SMBs
The Wave has everything you need to know about building a business, from raising funding to marketing your product.
The developer cloud
Scale up as you grow — whether you're running one virtual machine or ten thousand.
Get started for free
Sign up and get $200 in credit for your first 60 days with DigitalOcean.*
*This promotional offer applies to new accounts only.