Let's Encrypt Free SSL

Prerequisites

Domain DNS Requirements

To use Let's Encrypt SSL certificate support in Centmin Mod Nginx, ensure your domain name's DNS A records for the apex domain.com, www.domain.com, and/or any subdomain.domain.com point to your Centmin Mod server's IP address.

By default, Let's Encrypt domain validation is done via the webroot authentication method, where the client automatically generates a challenge file at:

https://yourdomain.com/.well-known/acme-challenge/*

For domains behind a CDN or proxy, use DNS-based validation instead.

Issuing SSL Certificate

Enable Let's Encrypt Support

To enable native Let's Encrypt SSL certificate support, set the following variable in the persistent config file /etc/centminmod/custom_config.inc (create the file if it does not already exist):

LETSENCRYPT_DETECT='y'

This allows Centmin Mod Nginx's vhost creation routines to use addons/acmetool.sh to obtain free Let's Encrypt SSL certificates for the desired Nginx vhost domain name.

Using acmetool.sh

The primary tool for managing Let's Encrypt certificates is the acmetool.sh addon script located at:

/usr/local/src/centminmod/addons/acmetool.sh

For full details on usage, refer to the official community forum discussion thread.

Dual RSA + ECDSA Certificates

Centmin Mod Nginx uses OpenSSL 1.1.1+ which supports dual RSA 2048-bit + ECC 256-bit ECDSA SSL certificates. When enabled, two SSL certificates are issued: one RSA 2048-bit and one ECC 256-bit. Nginx will serve the ECC certificate to browsers that support it (better performance), falling back to RSA for browsers that don't.

To enable dual certificate support, add both variables to /etc/centminmod/custom_config.inc:

LETSENCRYPT_DETECT='y'
DUALCERTS='y'

ZeroSSL Alternative

ZeroSSL is an alternative free CA provider supported by Centmin Mod's acmetool.sh. Key differences from Let's Encrypt:

• No rate limits for SSL certificate issuance
• GUI-based management console for issued certificates
• Better backward compatibility with older devices via cross-signed root certificates

Switching to ZeroSSL

Step 1. Register an account at ZeroSSL.com and obtain EAB credentials from app.zerossl.com/developer. Alternatively, register directly via the command line with your email:

acme.sh --register-account -m myemail@example.com --server zerossl

Step 2. If you obtained EAB credentials manually, register them with the acme.sh client:

acme.sh --register-account --server zerossl \
  --eab-kid xxxxxxxxxxxx \
  --eab-hmac-key xxxxxxxxx

Step 3. Set ZeroSSL as the default CA in /etc/centminmod/custom_config.inc:

ACME_DEFAULT_CA='zerossl'

To switch back to Let's Encrypt, remove the variable or set it explicitly:

ACME_DEFAULT_CA='letsencrypt'

Step 4. Reissue existing certificates using ZeroSSL with the reissue-only option (this only touches SSL certificate configuration, leaving the rest of your Nginx vhost config intact):

/usr/local/src/centminmod/addons/acmetool.sh reissue-only yourdomain.com live

DNS Validation

Cloudflare DNS API Validation

Centmin Mod's acmetool.sh supports DNS domain validation via the Cloudflare DNS API. Instead of webroot URL authentication, the client automatically generates a DNS TXT record through your Cloudflare API, and Let's Encrypt reads that record to validate your domain.

This method is recommended if your Centmin Mod Nginx domain is behind Cloudflare's orange cloud proxy with Full or Full Strict SSL mode enabled.

Add these variables to /etc/centminmod/custom_config.inc:

LETSENCRYPT_DETECT='y'
CF_DNSAPI_GLOBAL='y'
CF_Token="YOUR_CF_TOKEN"
CF_Account_ID="YOUR_CF_ACCOUNT_ID"

Creating a Cloudflare API Token

Create your Cloudflare API Token at dash.cloudflare.com/profile/api-tokens with the following permissions:

• Read access to Zone.Zone
• Edit/write access to Zone.DNS
• Apply across all Zones

Your Cloudflare Account ID can be found on any of your Cloudflare domain's main dashboard in the right-side column.

Wildcard Certificates

Wildcard certificates (e.g., *.domain.com) require DNS-based validation. Webroot validation cannot be used for wildcard certificates. Configure the Cloudflare DNS API as described above, then use acmetool.sh to issue the wildcard certificate with DNS validation mode.

Certificate Renewal

Automatic Renewal

Let's Encrypt SSL certificates are valid for 90 days. The acme.sh client installs a cron job that automatically renews certificates before they expire. No manual intervention is required for routine renewals.

Manual Renewal

To manually reissue an existing certificate, use the reissue-only option:

/usr/local/src/centminmod/addons/acmetool.sh reissue-only yourdomain.com live

Checking Certificate Dates

To list all SSL certificates and their expiry dates for all Nginx-configured sites on the server:

/usr/local/src/centminmod/addons/acmetool.sh checkdates

Example output showing both Nginx-installed and acme.sh-obtained certificates with their expiry dates and SHA1 fingerprints:

----------------------------------------------
nginx installed
----------------------------------------------

/usr/local/nginx/conf/ssl/domain.com/domain.com-acme.cer
SHA1 Fingerprint=06FE84519E09ACB75BBE11EDF26F7D41D0Bxxxxx
certificate expires in 83 days on 25 Dec 2021

----------------------------------------------
acme.sh obtained
----------------------------------------------

/root/.acme.sh/domain.com/domain.com.cer
SHA1 Fingerprint=06FE84519E09ACB75BBE11EDF26F7D41D0Bxxxxx
certificate expires in 83 days on 25 Dec 2021

Troubleshooting

dig +short yourdomain.com A
dig +short www.yourdomain.com A

crontab -l | grep acme

For additional support, visit the official community forum discussion thread or the Cloudflare DNS API validation thread.

Security Headers

Security headers provide an additional layer of protection for your HTTPS site. Add these headers to your Nginx HTTPS server block to improve security.

HSTS (HTTP Strict Transport Security)

HSTS tells browsers to always use HTTPS for your domain, preventing protocol downgrade attacks and cookie hijacking:

# max-age=31536000 = 1 year
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

Clearing HSTS for a Domain

If you need to undo HSTS after enabling it, follow these steps. Start with the server-side fix, then clear the cached policy in each browser that visited your site.

Server-Side (Recommended First Step)

Send a header with max-age=0 over HTTPS to immediately expire the cached HSTS policy. Per the MDN specification, this tells browsers to stop enforcing HSTS for your domain.

# Set max-age=0 to expire HSTS policy immediately
add_header Strict-Transport-Security "max-age=0" always;

Browser-Specific Clearing

After updating the server header, clear the cached HSTS policy in each browser that has visited your site:

HSTS Preload List Removal

If your domain was submitted to the HSTS preload list, additional steps are required:

1. Remove the preload directive from your HSTS header
2. Submit a removal request at hstspreload.org/removal

Additional Security Headers

Other recommended security headers to add to your HTTPS vhost:

# Prevent MIME-type sniffing
add_header X-Content-Type-Options "nosniff" always;

# Prevent clickjacking - restrict iframe embedding
add_header X-Frame-Options "SAMEORIGIN" always;

# XSS protection (legacy browsers)
add_header X-XSS-Protection "1; mode=block" always;

# Referrer policy
add_header Referrer-Policy "strict-origin-when-cross-origin" always;

# Content Security Policy (customize per your needs)
# add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline';" always;

SSL Testing

After configuring SSL/TLS, test your setup using these tools to verify your configuration is secure and correctly implemented.

Recommended Testing Tools

• Qualys SSL Labs — The most comprehensive SSL/TLS test. Aim for an A+ rating. Tests protocol support, cipher suites, key exchange, and certificate chain.
• GlobalSign SSL Check — Verifies certificate installation and chain completeness.
• GeoCerts SSL Checker — Quick certificate validity and expiration check.

Command-Line Testing

You can also test your SSL configuration directly from the server via SSH:

# Test TLS connection and view certificate details
openssl s_client -connect domain.com:443 -tls1_2 -tlsextdebug -status

# Check certificate expiration date
echo | openssl s_client -servername domain.com -connect domain.com:443 2>/dev/null | openssl x509 -noout -dates

# Verify Nginx config before restarting
nginx -t