# Setup Nginx for Odoo with SSL using Let's Encrypt

URL: https://sohaib.com/blog/setup-nginx-for-odoo-with-ssl-using-lets-encrypt
Author: Sohaib Khan
Published: May 11, 2019
Updated: Nov 27, 2025
Category: E-commerce Solutions

> OpenERP backend We are assuming you've Odoo already installed on your server, If it's not installed use my guide to install it first. How to install Odoo on Ubuntu or Debian Install Nginx and Certbot first sudo apt…

## OpenERP backend

We are assuming you've Odoo already installed on your server, If it's not installed use my guide to install it first. [How to install Odoo on Ubuntu or Debian](/how-to-install-odoo-in-debian-or-ubuntu/)

Install Nginx and Certbot first

```bash
sudo apt install certbot && nginx -y
```

```bash
sudo openssl dhparam -out /etc/ssl/certs/dhparam.pem 2048
```

```bash
mkdir -p /var/lib/letsencrypt/.well-known
chgrp www-data /var/lib/letsencrypt
chmod g+s /var/lib/letsencrypt
```

```bash
sudo nano /etc/nginx/snippets/letsencrypt.conf
```

```nginx
location ^~ /.well-known/acme-challenge/ {
  allow all;
  root /var/lib/letsencrypt/;
  default_type "text/plain";
  try_files $uri =404;
}
```

```bash
sudo nano /etc/nginx/snippets/ssl.conf
```

```plaintext
ssl_dhparam /etc/ssl/certs/dhparam.pem;

ssl_session_timeout 1d;
ssl_session_cache shared:SSL:50m;
ssl_session_tickets off;

ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers 'ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS';
ssl_prefer_server_ciphers on;

ssl_stapling on;
ssl_stapling_verify on;
resolver 8.8.8.8 8.8.4.4 valid=300s;
resolver_timeout 30s;

add_header Strict-Transport-Security "max-age=15768000; includeSubdomains; preload";
add_header X-Frame-Options SAMEORIGIN;
add_header X-Content-Type-Options nosniff;
```

```nginx
## OpenERP backend ##
upstream sohaib {
   server 127.0.0.1:8069;
}

server {
    index index.html index.htm;
    server_name YOURDOMAIN.COM;
    location / {
        proxy_pass  http://sohaib;
        proxy_next_upstream error timeout invalid_header http_500 http_502 http_503 http_504;
        proxy_redirect off;

        proxy_set_header    Host            $host;
        proxy_set_header    X-Real-IP       $remote_addr;
        proxy_set_header    X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header    X-Forwarded-Proto https;
    }

    listen 443 ssl;
    ssl_certificate /etc/letsencrypt/live/YOURDOMAIN.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/YOURDOMAIN.com/privkey.pem;
    include snippets/letsencrypt.conf;
    ssl_dhparam /etc/ssl/certs/dhparam.pem;
}

server {
    if ($host = YOURDOMAIN.COM) {
        return 301 https://$host$request_uri;
    }
    listen 80 ;
    listen [::]:80 ;
    server_name yourdomain.com;
    return 301 https://$host$request_uri;
}
```

**Let's get that Certificate**  
If you get any error by running the following command, that normally means you screw something up, Other than that, everything should be fine, but before you run the following command, make sure your domain is pointing and host is resolving.

```bash
sudo certbot certonly --agree-tos --email admin@sohaib.com --webroot -w /var/lib/letsencrypt/ -d sohaib.com -d www.sohaib.com
```

```plaintext
crontab -e
30 03 * * 0 certbot renew
```