SSL Configuration

Overview

SSL adds encrypted WebDAV endpoints on ports 482 (open) and 483 (authenticated). Certificates are provisioned automatically via Let’s Encrypt using certbot.

Automatic Setup

Pass the --with-ssl flag during installation:

sudo ./install-debian.sh --domain files.example.com --user friendly --with-ssl

Or run the SSL setup script separately after installation:

sudo ./ssl-setup.sh --domain files.example.com --os debian
# or
sudo ./ssl-setup.sh --domain files.example.com --os centos

What the Script Does

  1. Installs snapd and certbot via snap

  2. Requests Let’s Encrypt certificates for the domain and www. subdomain

  3. Appends SSL server blocks to the Nginx configuration (ports 482, 483)

  4. Configures automatic monthly certificate renewal via cron

SSL Server Blocks

Two additional Nginx server blocks are added:

  • Port 482 — WebDAV over HTTPS, no authentication

  • Port 483 — WebDAV over HTTPS, Basic authentication

Both include security headers:

add_header Strict-Transport-Security "max-age=31536000";
add_header X-Content-Type-Options nosniff;

Certificate Locations

File Path

Full chain certificate

/etc/letsencrypt/live/<domain>/fullchain.pem

Private key

/etc/letsencrypt/live/<domain>/privkey.pem

SSL options

/etc/letsencrypt/options-ssl-nginx.conf

DH parameters

/etc/letsencrypt/ssl-dhparams.pem

Certificate Renewal

Certbot adds a cron job for automatic renewal:

0 0 1 * * certbot renew --quiet

To test renewal manually:

sudo certbot renew --dry-run

To check certbot timer status:

sudo systemctl status certbot.timer

Prerequisites

  • The domain must point to the server’s public IP (A record)

  • Port 80 must be accessible from the internet (Let’s Encrypt HTTP challenge)

  • The server must be reachable from the internet (not behind a restrictive firewall)

Verification

Test SSL WebDAV access:

# Upload via SSL (no auth)
curl -T testfile.txt https://files.example.com:482/testfile.txt

# Upload via SSL (with auth)
curl -u friendly:password -T testfile.txt https://files.example.com:483/testfile.txt

Or use the Filestash WebDAV client with: