How to Use Let's Encrypt with Openresty for High-performance Web Applications

Securing your high-performance web applications is essential, especially when handling sensitive data or providing services to a large user base. Let's Encrypt offers free SSL/TLS certificates, making it easier than ever to implement HTTPS. Combining Let's Encrypt with OpenResty, a powerful web platform based on Nginx, allows you to create secure, fast, and scalable web applications.

Prerequisites

A server running Linux (Ubuntu, CentOS, etc.)
OpenResty installed
Root or sudo access to the server
Domain name pointing to your server's IP address
Certbot installed for obtaining SSL certificates

Installing OpenResty

If you haven't installed OpenResty yet, follow these steps for Ubuntu:

First, add the OpenResty repository:

sudo apt-get install -y software-properties-common

sudo add-apt-repository -y ppa:openresty/ppa

Then, update and install OpenResty:

sudo apt-get update

sudo apt-get install -y openresty

Obtaining a Let's Encrypt Certificate

Use Certbot to request a free SSL certificate. Install Certbot:

sudo apt-get install -y certbot

Request a certificate for your domain:

sudo certbot certonly --webroot -w /path/to/your/webroot -d yourdomain.com

Replace /path/to/your/webroot with the document root of your site, and yourdomain.com with your actual domain name.

Configuring OpenResty for HTTPS

Edit your OpenResty configuration file, typically located at /usr/local/openresty/nginx/conf/nginx.conf or within /etc/openresty/conf/. Add the following server block:

server {
    listen 80;
    server_name yourdomain.com www.yourdomain.com;
    return 301 https://$host$request_uri;
}
server {
    listen 443 ssl;
    server_name yourdomain.com www.yourdomain.com;

    ssl_certificate /etc/letsencrypt/live/yourdomain.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/yourdomain.com/privkey.pem;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers on;
    ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256';

    location / {
        proxy_pass http://localhost:8080;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

Reloading OpenResty

After saving your configuration, test the configuration for syntax errors:

sudo openresty -t

If the test passes, reload OpenResty:

sudo systemctl reload openresty

Renewing Your Certificates

Certbot automatically renews certificates. To test renewal, run:

sudo certbot renew --dry-run

Ensure your renewal process reloads OpenResty if necessary:

You can set up a cron job to automate renewal and reload:

0 3 * * * /usr/bin/certbot renew --post-hook "systemctl reload openresty"

Conclusion

Using Let's Encrypt with OpenResty provides a secure and high-performance environment for your web applications. Automating certificate renewal ensures ongoing security without manual intervention. With these steps, you can confidently deploy HTTPS on your OpenResty-powered sites, enhancing both security and user trust.