• E Enjte, Janar 29, 2026

Implementing SSL/TLS encryption for your Odoo 18 installation is a critical step in safeguarding sensitive business data, protecting user credentials, and building unwavering customer trust. This comprehensive guide provides a detailed walkthrough on how to set up free SSL certificates using Let's Encrypt and configure HTTPS, ensuring a secure and reliable environment for your Odoo instance. By following these steps, you will establish an encrypted connection that protects data in transit and signals your commitment to security.

The Indispensable Role of SSL/TLS in Odoo Security

SSL/TLS encryption is not merely a technical configuration; it is a fundamental pillar of modern web security, offering a multitude of benefits for your Odoo platform:

  • Robust Data Protection: All information exchanged between your users' browsers and your Odoo server, including financial data, customer details, and login credentials, is encrypted, making it unreadable to unauthorized parties. This safeguards against eavesdropping and man-in-the-middle attacks.
  • Server Authentication: SSL/TLS verifies the identity of your server to users, assuring them they are connecting to your legitimate Odoo instance and not a fraudulent site. This prevents phishing attempts and builds user confidence.
  • Significant SEO Advantages: Search engines, particularly Google, prioritize secure HTTPS websites in their search rankings. Implementing SSL can lead to improved visibility and organic traffic to your Odoo portal.
  • Browser Trust and User Experience: Modern web browsers prominently display warnings for websites not using HTTPS, potentially deterring visitors. A padlock icon and "Secure" label in the address bar reassure users, encouraging interaction and trust.
  • Regulatory Compliance: Many industry standards and data protection regulations, such as PCI DSS (for processing payments) and GDPR (for handling personal data), mandate the use of SSL/TLS encryption. Adhering to these requirements is crucial for legal and ethical operations.
  • Enhanced Customer Confidence: Demonstrating a clear commitment to security through HTTPS reflects professionalism and reliability, significantly boosting customer confidence and fostering a positive brand image.

Essential Prerequisites for a Seamless Setup

Before proceeding with the SSL/TLS configuration, ensure your environment meets the following requirements to guarantee a smooth and successful installation:

  • Odoo 18 Installation: A fully functional Odoo 18 instance must be installed, preferably on an Ubuntu 24.04 LTS server.
  • Nginx as a Reverse Proxy: Your Odoo setup should have Nginx configured as a reverse proxy. This is essential for handling web requests and directing them to your Odoo application, as well as for managing SSL termination.
  • Validated Domain Name: You need a registered domain name (e.g., your-domain.com) that correctly points to the public IP address of your Odoo server via DNS A records.
  • Open Firewall Ports: Ensure that both HTTP (port 80) and HTTPS (port 443) are open in your server's firewall to allow incoming web traffic for certificate issuance and secure browsing.
  • Administrative Access: You must have root privileges or sudo access to your server to perform system-level installations and configuration changes.

Step 1: Installing Certbot - The Let's Encrypt Client

Certbot is the official client provided by Let's Encrypt, designed to automate the process of obtaining and installing SSL/TLS certificates. This tool streamlines what would otherwise be a complex manual procedure.

Begin by updating your package list and installing Certbot along with its Nginx plugin:

sudo apt update
sudo apt install certbot python3-certbot-nginx -y

After the installation is complete, you can verify that Certbot has been successfully installed and is ready for use by checking its version:

certbot --version

Step 2: Preparing Your Nginx Configuration for SSL

Before obtaining your SSL certificate, it's crucial to ensure your Nginx configuration file is correctly set up for your domain. Certbot will automatically modify this file, but it needs to recognize your domain first.

Open your Odoo Nginx server block configuration. Typically, this file is located at /etc/nginx/sites-available/odoo18 (or similar, depending on your setup):

sudo nano /etc/nginx/sites-available/odoo18

Within this file, verify that your server block includes the listen 80; directive and correctly specifies your domain name(s) using the server_name directive, as shown in the example below:

server {
    listen 80;
    server_name your-domain.com www.your-domain.com;
    
    # Your existing Odoo proxy configuration
    include /etc/nginx/snippets/odoo-proxy.conf;
}

Once you've confirmed or made any necessary adjustments, it's vital to test the Nginx configuration for syntax errors and then reload Nginx to apply the changes:

sudo nginx -t
sudo systemctl reload nginx

A successful test will indicate that the configuration is syntactically correct, and reloading ensures Nginx uses the updated settings.

Step 3: Obtaining and Installing Your SSL Certificate with Certbot

With Certbot installed and Nginx prepared, you can now proceed to obtain and automatically install your free SSL/TLS certificate from Let's Encrypt. Execute the following command, replacing your-domain.com with your actual domain name:

sudo certbot --nginx -d your-domain.com -d www.your-domain.com

Certbot will guide you through a series of prompts:

  1. Email Address: Enter a valid email address. This is used for urgent renewal notices and security warnings.
  2. Terms of Service: You will be asked to agree to the Let's Encrypt Terms of Service.
  3. EFF Sharing: Choose whether to share your email address with the Electronic Frontier Foundation (EFF), which supports Let's Encrypt (this is optional).
  4. HTTPS Redirection: When prompted, select option 2 to redirect all HTTP traffic to HTTPS. This is highly recommended as it ensures all visitors access the secure version of your Odoo site, preventing insecure connections.

Upon successful completion, Certbot will communicate with the Let's Encrypt servers, obtain your certificate, and automatically configure Nginx to use it.

Step 4: Verifying the SSL Installation and Nginx Configuration

After Certbot completes its process, it automatically modifies your Nginx configuration file to enable HTTPS. It's a good practice to review these changes to understand how your server is now configured for secure communication.

Re-open your Nginx configuration file for Odoo:

sudo nano /etc/nginx/sites-available/odoo18

You should observe new server blocks and directives that Certbot has added. Specifically, a new server block listening on port 443 with ssl directives will be present, pointing to your newly obtained certificate files. Additionally, a block for port 80 will be configured to redirect all incoming HTTP requests to their HTTPS equivalents. This ensures that your Odoo application is always accessed securely.

server {
    server_name your-domain.com www.your-domain.com;
    
    listen 443 ssl http2; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/your-domain.com/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/your-domain.com/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
    
    include /etc/nginx/snippets/odoo-proxy.conf;
}

server {
    if ($host = www.your-domain.com) {
        return 301 https://$server_name$request_uri;
    } # managed by Certbot

    if ($host = your-domain.com) {
        return 301 https://$server_name$request_uri;
    } # managed by Certbot

    listen 80;
    server_name your-domain.com www.your-domain.com;
    return 404; # managed by Certbot
}

Verify that these changes are present and that the paths to your SSL certificate and key files are correct.

Step 5: Enhancing Your SSL Configuration for Optimal Security

While Certbot provides a secure default configuration, you can further harden your Odoo's SSL security by implementing custom SSL parameters. This involves specifying preferred protocols, ciphers, and security headers to protect against various vulnerabilities.

Create a new Nginx snippet specifically for advanced SSL parameters:

sudo nano /etc/nginx/snippets/ssl-params.conf

Add the following content to this file. This configuration prioritizes modern, strong encryption protocols and ciphers, enhances SSL session management, and enables OCSP stapling for faster certificate validation. It also includes the Strict-Transport-Security header, which instructs browsers to only interact with your site over HTTPS, even if a user tries to access it via HTTP.

# Modern SSL configuration: Prioritizes strong encryption algorithms and secure protocols.
ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers off;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;

# SSL optimization: Improves performance and security of SSL sessions.
ssl_session_timeout 1d;
ssl_session_cache shared:SSL:10m;
ssl_session_tickets off;

# OCSP stapling: Reduces overhead and improves privacy by allowing the server to provide certificate revocation status.
ssl_stapling on;
ssl_stapling_verify on;
resolver 8.8.8.8 8.8.4.4 valid=300s;
resolver_timeout 5s;

# Security headers: Enhances browser security and prevents certain types of attacks.
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";
add_header X-Frame-Options "SAMEORIGIN";
add_header X-Content-Type-Options "nosniff";
add_header X-XSS-Protection "1; mode=block";
add_header Referrer-Policy "no-referrer-when-downgrade";

After saving the ssl-params.conf file, you need to include it in your Nginx SSL server block. Open your odoo18 Nginx configuration again:

sudo nano /etc/nginx/sites-available/odoo18

Inside the server block that listens on 443 ssl, add the include directive for your new snippet. Ensure it is placed after the Certbot-managed SSL directives but before the odoo-proxy.conf include.

server {
    server_name your-domain.com www.your-domain.com;
    
    listen 443 ssl http2; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/your-domain.com/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/your-domain.com/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
    
    # Include your custom SSL parameters for enhanced security
    include /etc/nginx/snippets/ssl-params.conf;
    
    include /etc/nginx/snippets/odoo-proxy.conf;
}

Finally, test your Nginx configuration and reload the service to apply these enhanced security settings:

sudo nginx -t
sudo systemctl reload nginx

Automatic Certificate Renewal

Let's Encrypt certificates are valid for 90 days. Certbot automatically sets up a cron job or systemd timer to renew your certificates before they expire. You can test the renewal process manually at any time:

sudo certbot renew --dry-run

This command simulates the renewal process without actually saving any renewed certificates, allowing you to check for potential issues.

Conclusion

By following this comprehensive guide, you have successfully implemented SSL/TLS encryption for your Odoo 18 instance using free Let's Encrypt certificates and Nginx. Your Odoo platform is now equipped with enhanced security, protecting sensitive data, building user trust, and benefiting from improved search engine visibility. Regularly monitor your certificate renewals and stay updated with best practices to maintain a robust and secure online presence.

Kthehu