> For the complete documentation index, see [llms.txt](https://docs.buidlbuidl.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.buidlbuidl.com/bitcoin-node-depoloyment/install-ssl-https-certificate.md). # Install SSL/HTTPS certificate Installing the NGINX reverse proxy with an SSL certificate for Umbrel / BTCPay Server ## Prerequisites * A fully installed Umbrel node; * The BTCPayServer app is enabled; * You have a domain name configured for your website. * For this manual, I will use the following values for examples; * The home IP is **100.100.100.100;** * The internal IP (of Umbrel) is **10.10.10.10**; * The domain name is **buidlbuidl.com**; * The desired domain for BTCPay Server is **pay.buidlbuidl.com**. ## Step 1: Pointing the domain name to your home IP address Navigate to the control panel your domain owner offers. You should edit its DNS zone and add a new record: ![DNS zone editor](https://jorijn.com/content/images/2021/08/Screenshot-2021-08-12-at-15.40.51.png) {% hint style="warning" %} **Note:** The changes could take up to 24 hours to propagate throughout the internet. It would be best if you only continued with this manual when the update is visible. {% endhint %} ## Step 2: Verifying the DNS change from step 1 You can use this online tool to check if the DNS update has propagated throughout the internet. {% embed url="" %} ## Step 3: Adding a port forwarding to your local router To accept payments and issue an SSL certificate to your domain, your Umbrel should be partially reachable from the internet. Therefore, we need to open up specific ports on your internet router. The specifics depend on the make and model of your internet router. First, you need to find out what the internal IP address is of your Umbrel node using SSH. In this case, 10.10.10.10 is the internal IP address. ``` umbrel@umbrel:~ $ ip addr show wlan0 3: wlan0: mtu 1500 qdisc pfifo_fast state UP group default qlen 1000 link/ether dc:a6:32:a4:91:8c brd ff:ff:ff:ff:ff:ff inet 10.10.10.10/24 brd 192.168.121.255 scope global dynamic noprefixroute wlan0 ``` {% hint style="warning" %} **Note:** This Umbrel installation is connected using WiFi; therefore, the interface name is **wlan0**. If your Umbrel node is connected using an ethernet cable, the interface name should be **eth0**. {% endhint %} Next, create two port forwardings in your internet router. The router in this illustration uses a mobile app; ![Screenshot of (example) the router management interface](https://jorijn.com/content/images/2021/08/IMG_C79E6983FF58-1.jpeg) You need the following port forwardings: |

|

| | ----------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------- | {% hint style="info" %} If you have multiple routers behind eachother (NAT-connection) you will have to open ports on both the routers. Follow the steps below only if this involves your situation. {% endhint %} ## Step 4: Installing NGINX & Certbot Before installing, update your package repository list. ``` umbrel@umbrel:~ $ sudo apt update ``` Then, install the required components. ``` umbrel@umbrel:~ $ sudo apt install python3-acme python3-certbot python3-mock python3-openssl python3-pkg-resources python3-pyparsing python3-zope.interface python3-certbot-nginx nginx ``` The installation will fail; this is expected behavior. It is happening because Umbrel is already claiming port 80. Therefore, we need to change this in the configuration and finish the installation. ``` umbrel@umbrel:~ $ sudo sed -i 's/80 default_server/15080/g' /etc/nginx/sites-available/default ``` Then, finish the installation. ``` umbrel@umbrel:~ $ sudo apt install -f ``` After this, you should see a running NGINX welcome page on ## Step 5: Creating the BTCPay Server configuration for NGINX Create a new configuration file: ``` umbrel@umbrel:~ $ sudo nano /etc/nginx/sites-available/btcpay ``` Paste in the following contents: ``` proxy_buffer_size 128k; proxy_buffers 4 256k; proxy_busy_buffers_size 256k; client_header_buffer_size 500k; large_client_header_buffers 4 500k; http2_max_field_size 500k; http2_max_header_size 500k; map $http_upgrade $connection_upgrade { default upgrade; '' close; } server { server_name pay.buidlbuidl.com; location / { proxy_pass http://127.0.0.1:3003; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $connection_upgrade; } listen 15080; listen [::]:15080; } ``` {% hint style="warning" %} **Note:** Pay attention to changing the desired domain name in this configuration file. {% endhint %} Save the file (CTRL+O) and exit the editor (CTRL+X). Then, enable the configuration: ``` umbrel@umbrel:~ $ sudo ln -s /etc/nginx/sites-available/btcpay /etc/nginx/sites-enabled/ ``` Test the validity of the configuration using: ``` umbrel@umbrel:~ $ sudo nginx -t nginx: the configuration file /etc/nginx/nginx.conf syntax is ok nginx: configuration file /etc/nginx/nginx.conf test is successful ``` Then, reload the configuration. ``` umbrel@umbrel:~ $ sudo systemctl reload nginx.service ``` ## Step 6: Request a new SSL certificate from LetsEncrypt Request a new certificate from LetsEncrypt. ``` umbrel@umbrel:/etc/nginx/sites-enabled $ sudo certbot --nginx -d pay.buidlbuidl.com -m stein@buidlbuidl.com --agree-tos --tls-sni-01-port 15443 --http-01-port 15080 ``` {% hint style="info" %} **Note**: Make sure to replace **** and **pay.buidlbuidl.com** with your own email address and domain. {% endhint %} When Certbot asks you about redirecting, choose **1: No redirect**. ## Step 7: Manually add the HTTP-redirect Open up the configuration file again: ``` umbrel@umbrel:~ $ sudo nano /etc/nginx/sites-available/btcpay ``` Then, at the end of the file, add this server block: ``` server { if ($host = pay.buidlbuidl.com) { return 301 https://$host$request_uri; } listen 15080; listen [::]:15080; server_name pay.buidlbuidl.com; return 404; } ``` {% hint style="warning" %} **Note**: Replace the two occurrences of **pay.buidlbuidl.com**. {% endhint %} Then, validate & reload the configuration: ``` umbrel@umbrel:~ $ sudo nginx -t nginx: the configuration file /etc/nginx/nginx.conf syntax is ok nginx: configuration file /etc/nginx/nginx.conf test is successful umbrel@umbrel:~ $ sudo systemctl reload nginx.service ``` Your BTCPay Server should now be accessible using SSL at: . ![](https://553765266-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Mh4g_6AL7O4O6618VHD%2F-Mh5VLWxUZovTG1C7a3P%2F-Mh5bxvLFovcY-ihj3Zy%2FScreenshot%202021-08-14%20at%2023.43.37.png?alt=media\&token=e23ca208-dcc9-48d8-b28e-9217f874df90) ## The Pay Button BTCPay Server will now intelligently use the requesting domain and protocol to generate the example code, and you're off to accepting payments on your website. ![Screenshot of the BTCPay Server widget](https://jorijn.com/content/images/2021/08/image.png)