New Detail

#
Writen by

admin

Create an SSL Certificate for n8n Server Using Nginx

Requirements

  • A server running Ubuntu (or a similar OS that supports Certbot).

  • Nginx installed.

  • n8n installed and running.

  • A domain name pointed to the server’s IP address.

  • Ports 80 and 443 open.


1. Install Certbot

Certbot is a tool used to generate and renew SSL certificates from Let’s Encrypt.

a. Install Certbot on the host machine

sudo apt update
sudo apt install certbot

b. Verify installation

certbot --version

The result will display the version, e.g.: certbot 2.x.x.

c. Generate an SSL certificate

sudo certbot certonly --standalone -d yourdomain.com
  • --standalone tells Certbot to run a temporary web server for domain validation.

  • -d yourdomain.com is your domain name.

Certbot will ask you a few questions (such as your email for notifications). Enter the details and wait a few seconds. Once completed, the certificates will be stored in:

/etc/letsencrypt/live/yourdomain.com/

Now, copy the certificate files into the ./certs directory:

sudo mkdir -p ./certs
sudo cp /etc/letsencrypt/live/yourdomain.com/fullchain.pem ./certs/
sudo cp /etc/letsencrypt/live/yourdomain.com/privkey.pem ./certs/

Restart Nginx:

docker-compose restart nginx

d. Set up automatic renewal

Certificates need to be renewed before they expire. Steps:

  1. Renew the certificate when it has fewer than 30 days left.

  2. Copy the new certificate files into the ./certs directory.

  3. Reload Nginx inside Docker to apply the new certificate.

Create a script

nano renew_cert.sh

Paste the following content (make sure to replace yourdomain.com with your actual domain):

#!/bin/bash
# Renew certificate (only if less than 30 days left)
certbot renew --quiet
# Copy the new certificate files into ./certs
cp /etc/letsencrypt/live/yourdomain.com/fullchain.pem ./certs/
cp /etc/letsencrypt/live/yourdomain.com/privkey.pem ./certs/# Reload Nginx in the container to use the new certificates
docker-compose exec nginx nginx -s reload

Give execution permissions to the script:

chmod +x renew_cert.sh

Add the script to a cron job

Edit the cron table:

sudo crontab -e

At the end of the file, add the following line to run the script every day at 2 AM:

0 2 * * * /full/path/to/renew_cert.sh

e. Test the setup

Check if Certbot renewal works:

sudo certbot renew --dry-run

If successful, you’ll see a message like “Simulating renewal”.

Test the renewal script:

./renew_cert.sh

If no errors appear and Nginx reloads successfully, everything is working fine.