# Enable https NGINX

### Enable HTTPS on Nginx (Let’s Encrypt)

## 0. Introduction

### Goal

Enable HTTPS on Nginx using an existing Let’s Encrypt certificate, open the HTTPS port, and (optionally) redirect all HTTP traffic to HTTPS.

---

## 1. Prerequisites

- Nginx installed and running
- Valid TLS certificate from Let’s Encrypt
- Certificate files available under `/etc/letsencrypt/live/<domain>/`

Required files:

```
/etc/letsencrypt/live/qool.ovh/fullchain.pem
/etc/letsencrypt/live/qool.ovh/privkey.pem
```

---

## 2. Allow HTTPS Port (443)

### Add firewall rule

```
sudo ufw allow 443/tcp
```

### Enable firewall (if not active)

```
sudo ufw enable
```

### Verify

```
sudo ufw status
```

---

## 3. Configure Nginx for HTTPS

### Edit Nginx site configuration

```
sudo nano /etc/nginx/sites-available/qool.ovh
```

### HTTPS server block

```
server {
    listen 443 ssl http2;
    server_name *.qool.ovh;

    root /var/www/qool;
    index index.php index.html;

    ssl_certificate     /etc/letsencrypt/live/qool.ovh/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/qool.ovh/privkey.pem;

    ssl_protocols TLSv1.2 TLSv1.3;

    location / {
        try_files $uri $uri/ /index.php?$query_string;
    }

    location ~ \.php$ {
        include snippets/fastcgi-php.conf;
        fastcgi_pass unix:/run/php/php8.3-fpm.sock;
    }
}
```

---

## 4. Redirect HTTP to HTTPS (Recommended)

### HTTP redirect block

```
server {
    listen 80;
    server_name *.qool.ovh;
    return 301 https://$host$request_uri;
}
```

---

## 5. Apply Configuration

### Test configuration

```
sudo nginx -t
```

### Reload Nginx

```
sudo systemctl reload nginx
```

---

## 6. Verify HTTPS

### Check listening ports

```
sudo ss -tlnp | grep 443
```

### Test in browser

```
https://test.qool.ovh
```

### Test via CLI

```
curl -I https://test.qool.ovh
```

---

## Final Notes

- Port 443 must be open in the firewall
- Nginx must reference the correct certificate paths
- Certbot renews certificates automatically
- No manual changes are required after renewal
- This setup supports wildcard subdomains