How to install and secure Nginx with Lets Encrypt in Debian 10?

Updated: 11 October 2026 · Applies to: Debian 12

Debian 9 and 10 are no longer supported, so this guide now uses Debian 12 (Ubuntu 24.04 works the same way).

Install Nginx on Debian 12, secure it with a free Let's Encrypt certificate, and set basic security headers.

Install Nginx

apt update && apt install nginx
systemctl enable --now nginx

Open the firewall

ufw allow 80,443/tcp                                   # Ubuntu / Debian with UFW
firewall-cmd --permanent --add-service=http --add-service=https && firewall-cmd --reload   # AlmaLinux / Rocky

Server block

server {
    listen 80;
    server_name example.com www.example.com;
    root /var/www/example.com;
    index index.html;
}

Save it as /etc/nginx/sites-available/example.com, link it: ln -s /etc/nginx/sites-available/example.com /etc/nginx/sites-enabled/, then nginx -t && systemctl reload nginx.

Add a free SSL certificate

apt install certbot python3-certbot-nginx                     # Ubuntu / Debian
dnf install epel-release && dnf install certbot python3-certbot-nginx   # AlmaLinux / Rocky
certbot --nginx -d example.com -d www.example.com

Certbot installs a timer that renews the certificate automatically; test it with certbot renew --dry-run.

Harden

server_tokens off;                                   # in the http {} block
add_header X-Content-Type-Options nosniff;
add_header Strict-Transport-Security "max-age=31536000" always;