How to install and Enable TLS on Nginx Apache

TLS 1.3 is the latest version of the Transport Layer Security protocol, it’s based on the existing 1.2 specifications with proper IETF standard: RFC 8446. It provides stronger security and higher performance improvements over its predecessors.

Requirements

Nginx version 1.13.0 or greater.
Apache version 2.4.37 or greater.
OpenSSL version 1.1.1 or greater.
A valid domain name with correctly configured DNS records.
A valid TLS certificate.

Install TLS Certificate from Let’s Encrypt

To obtain a free SSL Certificate from Let’s Encrypt, you need to install Acme.sh client and also few needed packages on Linux system as shown.

apt install -y socat git  [On Debian/Ubuntu]
dnf install -y socat git  [On RHEL/CentOS/Fedora]
mkdir /etc/letsencrypt
git clone https://github.com/Neilpang/acme.sh.git
cd acme.sh 
./acme.sh --install --home /etc/letsencrypt --accountemail 
your_email@example.com
cd ~
/etc/letsencrypt/acme.sh --issue --standalone --home /etc/letsencrypt -d 
example.com --ocsp-must-staple --keylength 2048
/etc/letsencrypt/acme.sh --issue --standalone --home /etc/letsencrypt -d example.com --ocsp-must-staple --keylength ec-256

NOTE: Replace example.com in the above command with your own domain name

Now Just you need to enable TLS 1.3 on your domain as explained below

Enable TLS 1.3 on Nginx

As I mentioned in the requirements above, that TLS 1.3 is supported starting from Nginx 1.13 version. If you are running the older Nginx version, you need to first upgrade to the latest version.

apt install nginx
yum install nginx

Check the Nginx version and the OpenSSL version against which Nginx was compiled (make sure that the nginx version is at least 1.14 and openssl version 1.1.1).

nginx -V

Simple output

nginx version: nginx/1.14.1
built by gcc 8.2.1 20180905 (Red Hat 8.2.1-3) (GCC) 
built with OpenSSL 1.1.1 FIPS  11 Sep 2018
TLS SNI support enabled

Just you need to start by enabling and verifying the Nginx installation

systemctl start nginx.service
systemctl enable nginx.service
systemctl status nginx.service

Then open the Nginx vhost configuration 

vi /etc/nginx/conf.d/example.com.conf

Note: you can edit the vhost configuration file with any editor like nano

Now locate ssl_protocols directive and append TLSv1.3 at the end of the line as shown below

server {
  listen 443 ssl http2;
  listen [::]:443 ssl http2;

  server_name example.com;

  # RSA
  ssl_certificate /etc/letsencrypt/example.com/fullchain.cer;
  ssl_certificate_key /etc/letsencrypt/example.com/example.com.key;
  # ECDSA
  ssl_certificate /etc/letsencrypt/example.com_ecc/fullchain.cer;
  ssl_certificate_key /etc/letsencrypt/example.com_ecc/example.com.key;

  ssl_protocols TLSv1.2 TLSv1.3;
  ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256';
  ssl_prefer_server_ciphers on;
}

Last step, verify the configuration and reload Nginx

nginx -t
systemctl reload nginx.service

Enable TLS 1.3 in Apache

Note: If you are running the older version of Apache, you need to first upgrade to the latest version.
Please remember apache version on the requirements list
Apache version 2.4.37 or greater

to upgrade your apache to the latest version please apply the following commands

apt install apache2
yum install httpd

Once installed, you can verify the Apache and the OpenSSL version against which Apache was compiled.

httpd -V
openssl version

Now start by enabling and verifying the Apache installation

-------------- On Debian/Ubuntu -------------- 
systemctl start apache2.service
systemctl enable apache2.service
systemctl status apache2.service

-------------- On RHEL/CentOS/Fedora --------------
systemctl start httpd.service
systemctl enable httpd.service
systemctl status httpd.service

Then open the Apache virtual host configuration file using your favorite editor.

vi /etc/httpd/conf.d/vhost.conf
OR
vi /etc/apache2/apache2.conf

and locate ssl_protocols directive and append TLSv1.3 at the end of the line as shown below.

<VirtualHost *:443>
SSLEngine On

# RSA
ssl_certificate /etc/letsencrypt/example.com/fullchain.cer;
ssl_certificate_key /etc/letsencrypt/example.com/example.com.key;
# ECDSA
ssl_certificate /etc/letsencrypt/example.com_ecc/fullchain.cer;
ssl_certificate_key /etc/letsencrypt/example.com_ecc/example.com.key;

ssl_protocols TLSv1.2 TLSv1.3
ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256';
ssl_prefer_server_ciphers on;
SSLCertificateFile /etc/letsencrypt/live/example.com/cert.pem
SSLCertificateKeyFile /etc/letsencrypt/live/example.com/privkey.pem
SSLCertificateChainFile /etc/letsencrypt/live/example.com/chain.pem

     ServerAdmin admin@example.com
     ServerName www.example.com
     ServerAlias example.com
    #DocumentRoot /data/httpd/htdocs/example.com/
    DocumentRoot /data/httpd/htdocs/example_hueman/
  # Log file locations
  LogLevel warn
  ErrorLog  /var/log/httpd/example.com/httpserror.log
  CustomLog "|/usr/sbin/rotatelogs /var/log/httpd/example.com/httpsaccess.log.%Y-%m-%d 86400" combined
</VirtualHost>

Finally, verify the configuration and reload Apache

-------------- On Debian/Ubuntu -------------- 
apache2 -t
systemctl reload apache2.service

-------------- On RHEL/CentOS/Fedora --------------
httpd -t
systemctl reload httpd.service

How to verify that your website is working with TLS

You can verify that the TLS is working by tapping your website with https like the following example:
https://www.lgvps.com
in the top bar of your browser, you will see that the connection is secured as shown in the following screenshot

that’s all you need to secure your website connection via TLS1.3.If you need help please don’t hesitate to leave a reply.
Best Regards