Enabling SSL/TLS in Odoo: Encrypting Data in Transit

# Ubuntu/Debian
sudo apt-get update
sudo apt-get install certbot python3-certbot-nginx

# Verify installation
certbot --version

# Generate certificate for domain
sudo certbot certonly --nginx -d odoo.example.com -d www.odoo.example.com

# Interactive prompts:
# - Email for renewal notifications
# - Accept terms
# - Certbot auto-configures Nginx

# Certificate stored at:
# /etc/letsencrypt/live/odoo.example.com/

/etc/letsencrypt/live/odoo.example.com/
├── cert.pem          # Certificate
├── chain.pem         # Intermediate certs
├── fullchain.pem     # cert + chain (use this!)
├── privkey.pem       # Private key (SECRET!)
└── README            # Documentation

# Redirect HTTP to HTTPS
server {
    listen 80;
    listen [::]:80;
    server_name odoo.example.com www.odoo.example.com;
    
    # Certbot validation
    location /.well-known/acme-challenge/ {
        root /var/www/certbot;
    }
    
    # Redirect all HTTP to HTTPS
    location / {
        return 301 https://$server_name$request_uri;
    }
}

# HTTPS server
server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name odoo.example.com www.odoo.example.com;
    
    # SSL certificates (from Let's Encrypt)
    ssl_certificate /etc/letsencrypt/live/odoo.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/odoo.example.com/privkey.pem;
    
    # SSL configuration (secure)
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers on;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;
    
    # HSTS (Force HTTPS always)
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
    
    # Other security headers
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header Referrer-Policy "no-referrer-when-downgrade" always;
    add_header Permissions-Policy "geolocation=(), microphone=(), camera=()" always;
    
    # Proxy to Odoo
    location / {
        proxy_pass http://127.0.0.1:8069;
        
        # Headers for Odoo
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        
        # WebSocket support
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        
        # Timeouts
        proxy_connect_timeout 60s;
        proxy_send_timeout 60s;
        proxy_read_timeout 60s;
    }
    
    # Longpolling (chat/notifications)
    location /longpolling {
        proxy_pass http://127.0.0.1:8072;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
    }
}

# Test Nginx config
sudo nginx -t

# Enable site
sudo ln -s /etc/nginx/sites-available/odoo.example.com /etc/nginx/sites-enabled/
sudo systemctl restart nginx

# Verify
curl https://odoo.example.com  # Should work

# Check certificate validity
openssl s_client -connect odoo.example.com:443

# Online SSL test
# https://www.ssllabs.com/ssltest/analyze.html?d=odoo.example.com

# Check cron job
sudo systemctl list-timers

# Look for certbot timer
# certbot.timer (runs twice daily)

# Renew all certificates
sudo certbot renew --dry-run

# In production (if needed)
sudo certbot renew

#!/bin/bash
# /usr/local/bin/renew-ssl.sh

# Renew all certificates
certbot renew --quiet

# Restart Nginx to load new certificates
systemctl restart nginx

# Log renewal
echo "SSL renewed on $(date)" >> /var/log/ssl-renewal.log

# Run script daily at 2 AM
sudo crontab -e

# Add line:
0 2 * * * /usr/local/bin/renew-ssl.sh

# 1. Install Certbot
sudo apt-get install certbot python3-certbot-nginx

# 2. Get certificate
sudo certbot certonly --nginx \
  -d odoo.example.com \
  -d www.odoo.example.com \
  --email admin@example.com \
  --agree-tos \
  --non-interactive

# 3. Configure Nginx (use config above)
sudo nano /etc/nginx/sites-available/odoo.example.com

# 4. Test Nginx
sudo nginx -t

# 5. Enable site
sudo ln -s /etc/nginx/sites-available/odoo.example.com /etc/nginx/sites-enabled/

# 6. Restart
sudo systemctl restart nginx

# 7. Verify
curl https://odoo.example.com  # Should show Odoo login page

# View all certificates
sudo certbot certificates

# Output:
# Found the following certs:
# Certificate Name: odoo.example.com
#   Serial Number: abc123
#   Key Type: RSA
#   Expiry Date: 2026-03-22
#   Auto Renewal: Enabled
#   Renewal Count: 3

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

add_header X-Frame-Options "SAMEORIGIN" always;

add_header Content-Security-Policy "default-src 'self'" always;