Replace the self-signed certificate with a trusted one on nginx

Why it matters

A self-signed certificate is not vouched for by any authority browsers trust, so every visitor sees a security warning. Many API clients refuse the connection altogether.

The fix

1. Install certbot and its nginx plugin from your distribution, then request a certificate for the host. It edits the server block and sets up renewal.
2. Test and reload nginx, then check that the renewal timer is active.

sudo certbot --nginx -d example.com
sudo nginx -t && sudo systemctl reload nginx
systemctl list-timers | grep certbot

The examples use example.com. Replace it with your own domain.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the certificate chain and expiry check
• Renew the expired TLS certificate
• Fix a certificate that is not valid yet
• Renew the certificate before it expires
• Install a certificate that covers this hostname
• Use a certificate from a publicly trusted authority
• Serve the full certificate chain
• Replace the expired intermediate certificate
• Re-issue the certificate with a stronger key
• Replace the certificate that uses a broken hash
• Fix the certificate that browsers reject