# apt-get install git dialog
# git clone https://github.com/letsencrypt/letsencrypt /opt/letsencrypt
mkdir /var/www/letsencrypt
chown -R www-data:www-data /var/www/letsencrypt
location /.well-known {
root /var/www/letsencrypt;
}
cd /opt/letsencrypt
./letsencrypt-auto certonly -a webroot --webroot-path=/var/www/letsencrypt -d example.com
Substitute example.com with your domain
ssl on;
ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_prefer_server_ciphers on;
ssl_ciphers "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 EECDH EDH+aRSA RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS !MEDIUM";
These SSL settings currently yield 'A' in https://www.ssllabs.com/ssltest/