10. SSL/TLS Automation with Certbot Let's Encrypt, HTTP/2 & Strict-Transport-Security (HSTS) • DevOps, Docker & Cloud VPS Deployment Mastery • Rishabh Ki Kaksha

DevOps, Docker & Cloud VPS Deployment Mastery › 10. SSL/TLS Automation with Certbot Let's Encrypt, HTTP/2 & Strict-Transport-Security (HSTS)

40 mins

← Prev Next →

Course Syllabus

Module 1: Linux System Administration & Kernel Performance Tuning

01. Linux OS Architecture: Kernel vs User Space, System Calls & Process Management (ps, top, htop) 02. Linux File Permissions (chmod, chown, SUID/SGID) & Sticky Bits Security 03. Networking & Diagnostics: netstat, ss, lsof, tcpdump, curl, dig & DNS Resolution

Part 1: Linux & Docker Containerization

Module 2: Containerization with Docker & Multi-Stage Builds

04. Docker Architecture: Namespaces, Cgroups, UnionFS & Docker Engine Internals 05. Dockerfile Optimization: Layer Caching, Non-Root Users & Ultra-Light Alpine Multi-Stage Builds 06. Docker Compose: Multi-Container Networking, Persistent Volumes & Environment Config 07. Docker Production Security: Read-Only Root FS, Capabilities Drop & Container Scanning

Part 2: Nginx, SSL, PM2 & Automated CI/CD

Module 3: Nginx Reverse Proxy, SSL Automation & Security Hardening

08. Nginx Masterclass: Event-Driven Non-Blocking Architecture vs Apache Multi-Threaded 09. Nginx as Reverse Proxy, Load Balancer (upstream) & Gzip/Brotli Compression Config 10. SSL/TLS Automation with Certbot Let's Encrypt, HTTP/2 & Strict-Transport-Security (HSTS) 11. Nginx Rate Limiting (limit_req), DDoS Mitigation & Security Headers Injection

Module 4: Process Management with PM2 & Systemd Services

12. Systemd Services: Creating Custom System Daemons with Automatic Restart & Logging 13. PM2 Enterprise Process Manager: Cluster Mode, Ecosystem Config & Graceful Reloads 14. Log Management & Rotation: logrotate, journalctl & Centralized Syslog Streaming

Module 5: CI/CD Automation with GitHub Actions & Zero-Downtime Deployments

15. CI/CD Foundations: Building Automated Test & Build Pipelines with GitHub Actions 16. Automated SSH Deployments: Self-Hosted Runners, Deploy Keys & Zero-Downtime Atomic Symlinks 17. Blue-Green & Canary Deployment Strategies on Cloud VPS Infrastructure

Module 6: Cloud VPS Production Hardening, Firewall (UFW) & Backups

18. Cloud VPS Hardening: Non-Root Sudo Users, SSH Key-Only Auth, Fail2ban & UFW Firewall Rules 19. Automated Database & Media Backups to Cloud Storage (AWS S3 / Cloudflare R2 / MinIO) 20. Server Health Monitoring & Alerting: Uptime Kuma, Netdata, Prometheus & Telegram Bot Webhooks

Interactive Lesson Studio

# 10. SSL/TLS Automation with Certbot Let's Encrypt, HTTP/2 & Strict-Transport-Security (HSTS)

> DevOps & Cloud VPS Notes by Rishabh - Topic 10

---

### 1. Production SSL & HTTP/2 Hardened Nginx Block 🔐

```nginx
server {
    listen 443 ssl http2;
    server_name rishabhkikaksha.boostengine.in;

ssl_certificate /etc/letsencrypt/live/rishabhkikaksha.boostengine.in/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/rishabhkikaksha.boostengine.in/privkey.pem;

# SSL Hardening:
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers on;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 1d;

# HSTS (Strict Transport Security - 2 Years):
    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
}
```

---

### 2. Automated Renewal via Systemd Timer

```bash
# Test automated dry-run renewal:
certbot renew --dry-run
```

---

### 3. Master Comparison Matrix

---

### 4. Interview Ke 3 Sawal Is Topic Se

1. **HSTS Preload list me domain add karne ka kya fayda hota hai?** -> Browser pehli baar visit karne par bhi kabhi unencrypted HTTP request nahi bhejta (Prevents SSL Stripping attacks).
2. **HTTP/2 Multiplexing kaise kaam karta hai?** -> Ek hi single TCP connection ke andar multiple independent bidirectional binary streams parallel send hoti hain bina head-of-line blocking ke.
3. **Let's Encrypt certificate validity 90 days kyu hoti hai?** -> Short certificate lifetime security hygiene improve karti hai aur compromised private keys ke exposure window ko minimize karti hai.

---
**Next Topic:** 11. Nginx Rate Limiting (limit_req), DDoS Mitigation & Security Headers Injection

Loading lesson content...

Python 3.12

Full IDE

Live Execution Terminal

Click "Execute Live" to run code.
                

Lesson Mastery AI Quiz

AI Doubt Solver

CERTIFICATE OF COMPLETION

Rishabh Gehlot

PHP 8+ & Laravel 11 Master Track