• Samstag, Dezember 6, 2025

Implementing SSL/TLS encryption for your Odoo 18 installation is a critical step towards securing sensitive business data, user credentials, and fostering customer confidence. This comprehensive guide provides a detailed walkthrough for setting up free SSL certificates from Let's Encrypt and configuring your Odoo instance to operate securely over HTTPS.

Why SSL/TLS is Essential for Your Odoo Environment

SSL/TLS encryption offers a multitude of benefits that are indispensable for any modern web application, especially an enterprise resource planning system like Odoo:

  • Data Protection: It encrypts all information transmitted between your users' browsers and your Odoo server, protecting it from eavesdropping and tampering during transit. This is vital for sensitive financial, customer, and operational data.
  • Authentication: SSL/TLS verifies the identity of your server to users, ensuring they are connecting to your legitimate Odoo instance and not a fraudulent site. This builds trust and prevents man-in-the-middle attacks.
  • SEO Benefits: Search engines, particularly Google, actively favor websites secured with HTTPS in their search rankings, leading to improved visibility and organic traffic.
  • Browser Trust: Modern web browsers display clear warnings for users attempting to access non-HTTPS sites, often deterring them. An HTTPS connection reassures users that their interaction with your Odoo system is secure.
  • Compliance: Adhering to industry standards and regulations such as PCI DSS (for payment card data), GDPR (General Data Protection Regulation), and various other data privacy acts often mandates the use of strong encryption like SSL/TLS.
  • Customer Confidence: Displaying a secure padlock icon and using HTTPS visibly demonstrates your commitment to security and professionalism, significantly enhancing user and customer confidence in your platform.

Prerequisites for SSL/TLS Implementation

Before proceeding with the SSL/TLS setup, ensure that the following prerequisites are met on your server:

  • Odoo 18 Installation: A functional Odoo 18 instance should already be installed, preferably on an Ubuntu 24.04 LTS operating system.
  • Nginx Reverse Proxy: Nginx must be configured as a reverse proxy for your Odoo installation. This setup typically handles traffic routing and can be further configured for SSL termination.
  • Valid Domain Name: You must have a registered domain name that is correctly pointed via DNS (A/AAAA records) to the public IP address of your server. This domain will be used for your Odoo instance.
  • Open Firewall Ports: Ensure that ports 80 (for HTTP challenges and initial setup) and 443 (for HTTPS traffic) are open in your server's firewall to allow incoming connections.
  • Root or Sudo Access: You will require root privileges or a user with sudo access to execute administrative commands on your server.

Step 1: Install Certbot and Nginx Plugin

Certbot is the recommended and official client for Let's Encrypt, designed to automate the process of obtaining and installing SSL certificates. It also includes a convenient plugin for Nginx.

First, update your package list and then install Certbot along with its Nginx integration:

sudo apt update
sudo apt install certbot python3-certbot-nginx -y

Once the installation is complete, verify that Certbot is correctly installed and accessible by checking its version:

certbot --version

Step 2: Prepare Your Nginx Configuration for SSL

It's crucial to ensure that your Nginx configuration includes the correct domain name for your Odoo instance. This allows Certbot to properly identify and configure the SSL certificate for the specified domain.

Open your Nginx server block configuration file, typically located at /etc/nginx/sites-available/odoo18 (replace odoo18 with your actual file name if different):

sudo nano /etc/nginx/sites-available/odoo18

Your server block should initially listen on port 80 and declare your domain names:

server {
    listen 80;
    server_name your-domain.com www.your-domain.com;
    
    # Your existing Odoo reverse proxy configuration
    include /etc/nginx/snippets/odoo-proxy.conf;
}

After making any changes, it's good practice to test the Nginx configuration for syntax errors and then reload the service to apply the changes:

sudo nginx -t
sudo systemctl reload nginx

Step 3: Obtain and Install Your SSL Certificate with Certbot

With Nginx prepared, you can now run Certbot to automatically obtain and install a free SSL certificate from Let's Encrypt. The Nginx plugin for Certbot will handle the configuration modifications required.

Execute the following command, making sure to replace your-domain.com and www.your-domain.com with your actual domain names:

sudo certbot --nginx -d your-domain.com -d www.your-domain.com

Certbot will guide you through a series of prompts:

  1. You will be asked to enter an email address. This email will be used for urgent renewal notices and security warnings related to your certificates.
  2. Review and agree to the Let's Encrypt Terms of Service.
  3. You may be prompted to choose whether to share your email address with the Electronic Frontier Foundation (EFF), which is optional.
  4. Finally, Certbot will ask how you'd like to handle HTTP traffic. Select option 2 to automatically redirect all incoming HTTP traffic to HTTPS, ensuring all connections are secure.

Step 4: Verify Your SSL Installation

Certbot automatically modifies your Nginx configuration file to enable HTTPS and implement the chosen redirection. It's important to review these changes to understand how your server is now configured.

Open your Nginx configuration file again:

sudo nano /etc/nginx/sites-available/odoo18

You should now observe new server blocks and configuration directives added by Certbot, similar to the following:

server {
    server_name your-domain.com www.your-domain.com;
    
    listen 443 ssl http2; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/your-domain.com/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/your-domain.com/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
    
    include /etc/nginx/snippets/odoo-proxy.conf;
}

server {
    if ($host = www.your-domain.com) {
        return 301 https://$server_name$request_uri;
    } # managed by Certbot

    if ($host = your-domain.com) {
        return 301 https://$server_name$request_uri;
    } # managed by Certbot

    listen 80;
    server_name your-domain.com www.your-domain.com;
    return 404; # managed by Certbot
}

The first server block now handles HTTPS traffic on port 443, referencing the newly acquired SSL certificates. The second block redirects all HTTP traffic from port 80 to the secure HTTPS version of your site.

Step 5: Enhance Your SSL Configuration for Optimal Security

To further bolster the security and performance of your SSL/TLS setup, it is highly recommended to implement a custom SSL configuration. This involves specifying modern protocols, strong ciphers, and security headers.

Create a new Nginx snippet specifically for SSL parameters:

sudo nano /etc/nginx/snippets/ssl-params.conf

Add the following content to this file. This configuration prioritizes modern, secure TLS protocols and ciphers, enhances session management, and includes important security headers like HSTS:

# Modern SSL configuration
ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers off;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;

# SSL optimization
ssl_session_timeout 1d;
ssl_session_cache shared:SSL:10m;
ssl_session_tickets off;

# OCSP stapling
ssl_stapling on;
ssl_stapling_verify on;
resolver 8.8.8.8 8.8.4.4 valid=300s;
resolver_timeout 5s;

# Security headers
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";
add_header X-Frame-Options "SAMEORIGIN";
add_header X-Content-Type-Options "nosniff";
add_header X-XSS-Protection "1; mode=block";
add_header Referrer-Policy "no-referrer-when-downgrade";

After creating this snippet, you'll need to include it in your main Nginx server block for HTTPS. Modify your /etc/nginx/sites-available/odoo18 file again, adding the include statement within the server block that listens on port 443, ideally after the existing include /etc/letsencrypt/options-ssl-nginx.conf; line.

sudo nano /etc/nginx/sites-available/odoo18

The updated HTTPS server block should look something like this:

server {
    server_name your-domain.com www.your-domain.com;
    
    listen 443 ssl http2; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/your-domain.com/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/your-domain.com/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    include /etc/nginx/snippets/ssl-params.conf; # Include your custom SSL parameters
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
    
    include /etc/nginx/snippets/odoo-proxy.conf;
}

Remember to test your Nginx configuration and reload the service after making these changes:

sudo nginx -t
sudo systemctl reload nginx

Automatic Certificate Renewal

Let's Encrypt certificates are valid for 90 days. Certbot automates the renewal process. You can test the renewal mechanism with a dry run:

sudo certbot renew --dry-run

If the dry run is successful, your certificates will automatically renew before they expire, typically via a systemd timer or a cron job installed by Certbot.

Conclusion

By following these steps, you have successfully secured your Odoo 18 installation with SSL/TLS encryption using free certificates from Let's Encrypt and Nginx. This implementation significantly enhances the security of your Odoo platform, protects user data, boosts your search engine ranking, and builds greater trust with your users. Regular verification of your SSL certificate and Nginx configuration is recommended to ensure continuous secure operation.

Zurück