Setup to enable HTTPS with Let’s Encrypt SSL certificates on Nginx (frontend), while Apache remains the backend.

 Assuming you've completed this guide: https://uistv-tech.blogspot.com/2025/08/guide-nginx-as-frontend-apache2-as.html 

This way:

• Clients connect securely to Nginx (443, HTTPS)

• Nginx proxies requests to Apache (8080, HTTP)

---

🔐 SSL Setup with Nginx + Apache Backend on Debian LXDE

1. Install Certbot (Let’s Encrypt Client)

On Debian:

sudo apt install certbot python3-certbot-nginx -y

---

2. Ensure Your Domain Points to Your Server

Let’s Encrypt requires a valid domain.

• Update your DNS A record so your domain (e.g., example.com) points to your server’s public IP.

• Test with:

  ping example.com
  

  It should resolve to your server IP.

---

3. Update Nginx Config for Your Domain

Edit your proxy config:

sudo nano /etc/nginx/sites-available/apache-proxy

Change it to:

server {
    listen 80;
    server_name example.com www.example.com;

    location / {
        proxy_pass http://127.0.0.1:8080;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

Save, test, and reload:

sudo nginx -t
sudo systemctl reload nginx

---

4. Obtain SSL Certificate

Now run:

sudo certbot --nginx -d example.com -d www.example.com

• Certbot will auto-configure HTTPS for your site.

• If asked:

  • Redirect all HTTP → HTTPS → Choose Yes (recommended).

---

5. Verify Auto-Renewal

Let’s Encrypt certificates last 90 days. Certbot sets up auto-renew by default.
Check with:

sudo certbot renew --dry-run

If successful, your SSL will auto-renew. ✅

---

6. (Optional) Force HTTPS (if needed)

Certbot usually adds this automatically. But in case you need to ensure all HTTP traffic redirects to HTTPS, your config will look like this:

server {
    listen 80;
    server_name example.com www.example.com;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl;
    server_name example.com www.example.com;

    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

    location / {
        proxy_pass http://127.0.0.1:8080;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

---

7. Restart Nginx

After changes:

sudo systemctl restart nginx

---

8. Final Test

• Visit 👉 https://example.com

• Browser should show a padlock (valid SSL).

• Apache backend (8080) serves the content, but users only see HTTPS.

---

✅ Now you have a secure Nginx (frontend, HTTPS) reverse proxy with Apache backend.