New Detail

#
Writen by

admin

Create an SSL Certificate for n8n Server Using Nginx

Requirements

  • A server running Ubuntu (or a similar OS that supports Certbot).

  • Nginx installed.

  • n8n installed and running.

  • A domain name pointed to the server’s IP address.

  • Ports 80 and 443 open.


1. Install Certbot

Certbot is a tool used to generate and renew SSL certificates from Let’s Encrypt.

a. Install Certbot on the host

sudo apt update
sudo apt install certbot

b. Verify installation

certbot --version

The result will show the version, for example: certbot 2.x.x.

c. Generate an SSL certificate

sudo certbot certonly --standalone -d yourdomain.com
  • --standalone tells Certbot to run a small temporary web server to validate your domain.

  • -d yourdomain.com is your domain name.

Certbot will ask you a few questions (such as your email for notifications). Enter the details and wait a few seconds. Once completed, the certificate will be stored at:

/etc/letsencrypt/live/yourdomain.com/

Copy the files into the ./certs directory:

sudo mkdir -p ./certs
sudo cp /etc/letsencrypt/live/yourdomain.com/fullchain.pem ./certs/
sudo cp /etc/letsencrypt/live/yourdomain.com/privkey.pem ./certs/

Restart Nginx:

docker-compose restart nginx

d. Set up automatic renewal

Steps:

  • Renew the certificate before it expires.

  • Copy the new certificates into the ./certs directory.

  • Reload Nginx inside Docker to apply the new certificates.

Create a script

nano renew_cert.sh

Paste the following content (make sure to replace the domain with your actual one):

#!/bin/bash
# Renew certificate (only if less than 30 days left)
certbot renew --quiet
# Copy the new certificates into ./certs
cp /etc/letsencrypt/live/yourdomain.com/fullchain.pem ./certs/
cp /etc/letsencrypt/live/yourdomain.com/privkey.pem ./certs/# Reload Nginx in the container to use the new certificates
docker-compose exec nginx nginx -s reload

Make the script executable:

chmod +x renew_cert.sh

Add the script to cron

Edit cron jobs:

sudo crontab -e

At the end of the file, add the following line to run the script daily at 2 AM:

0 2 * * * /full/path/to/renew_cert.sh

e. Test the script

Check if renewal works:

sudo certbot renew --dry-run

If successful, you’ll see a message like “Simulating renewal”.

Run the script manually:

./renew_cert.sh

If no errors appear and Nginx reloads successfully, everything is set up correctly.