Nginx is a high-performance open-source web server that powers a huge number of high-load sites around the world. Nginx has gained widespread popularity due to its light weight, reliability, scalability, and ease of setup.

Today, we will install Nginx together with Let's Encrypt on Rocky Linux 9.

First, update your system:

Run this command to install Nginx:

Once Nginx is installed, run this command to start Nginx:

To automatically start Nginx on every boot, run the following command:

Now you need to allow HTTP and HTTPS in your firewall. You can do this in IPtables or a firewall.

IPtables:

If you use IPtables, run these commands:

Save changes:

Restart iptables to apply the changes:

Firewalld:

If you are using firewalld, run these commands to allow HTTP and HTTPS:

Create a folder for your domain (type your actual domain instead of your_domain):

Assign ownership of the directory:

Create a simple HTML page to test the Nginx setup:

Paste this text:

Then restart Nginx to apply the changes:

Open the Nginx configuration file for your domain (type your actual domain instead of yourdomain.ltd):

Paste this content and change yourdomain.ltd to your actual domain:

Save the file and exit (press "Esc", then type :wq and click "Enter").

Restart nginx for changes to take effect:

Run this command to install Certbot:

After that, you can obtain a certificate for your domain (type your actual domain instead of your_domain):

You will need to select the domain you want to secure and enter your email address to receive notifications from Let's Encrypt. You will also need to agree to the Terms of Service (mandatory) and agree or disagree to share your email address with Electronic Frontier Foundation (optional).

After this, you can open your web browser, go to the created test page, and see if it opens with a valid SSL certificate (via HTTPS). Click on the padlock icon in the address bar to see information about the certificate.

Let's Encrypt certificates are valid for 90 days. You can renew them manually or automatically.

To renew manually, run this command:

If the certificate is less than 30 days away from expiration, this command will renew it.

If you want to specify auto-renewal, you can create cronjob to run the above command twice a day automatically:

Add this line to the crontab:

You're all set. When necessary, certbot will renew your certificates and reload Apache to pick up the changes.