Secure Odoo 18 with SSL/TLS: Complete HTTPS Setup Guide

Implementing robust SSL/TLS encryption for your Odoo 18 installation is paramount for safeguarding sensitive business data, securing user credentials, and fostering invaluable customer trust. This comprehensive guide will meticulously walk you through the process of setting up free SSL certificates using the widely recognized Let's Encrypt service and then configuring HTTPS for your Odoo instance running on Ubuntu 24.04 LTS with Nginx as a reverse proxy. By following these steps, you will significantly enhance the security posture of your Odoo environment, ensuring secure communication and adherence to modern web standards.

Why SSL/TLS is Essential for Odoo

Adopting SSL/TLS encryption for your Odoo instance offers a multitude of benefits, extending beyond mere data protection:

• Data Protection: SSL/TLS encrypts all data transmitted between your users' browsers and your Odoo server, effectively preventing eavesdropping and data tampering by malicious entities. This ensures the confidentiality and integrity of all exchanged information, from financial records to customer details.
• Server Authentication: This technology verifies the identity of your Odoo server to users, assuring them they are connecting to the legitimate server and not a fraudulent impostor. This critical authentication prevents sophisticated man-in-the-middle attacks.
• Enhanced SEO Rankings: Search engines like Google actively prioritize and boost the rankings of HTTPS-enabled websites in their search results. Adopting SSL can lead to improved visibility, better search engine optimization, and increased organic traffic for your Odoo portal.
• Browser Trust and Security Indicators: Modern web browsers display prominent security indicators (such as a padlock icon) for HTTPS sites, while actively warning users about insecure, non-HTTPS connections. Implementing SSL prevents these unsettling warnings and builds essential trust with your users.
• Regulatory Compliance: Many industry regulations and data protection standards, such as PCI DSS (for payment processing), GDPR (General Data Protection Regulation), and HIPAA, mandate the use of SSL/TLS encryption for handling sensitive data. Securing your Odoo instance with SSL ensures compliance with these critical requirements.
• Increased Customer Confidence: Displaying a secure HTTPS connection instantly communicates professionalism and a strong commitment to data security to your customers and partners, reinforcing their confidence in your services and brand reputation.

Prerequisites for SSL/TLS Setup

Before commencing with the SSL/TLS setup for your Odoo 18 instance, please ensure that the following essential prerequisites are fully met on your server:

• Odoo 18 Installation: You must have a functional Odoo 18 instance already installed and running on Ubuntu 24.04 LTS. This guide assumes your Odoo setup is operational.
• Nginx Reverse Proxy: Nginx should be properly configured to act as a reverse proxy for your Odoo application. If you haven't set this up yet, please refer to our dedicated Nginx configuration guide for Odoo to ensure this foundational step is complete.
• A Valid Domain Name: A fully qualified domain name (FQDN) that correctly resolves and points to the public IP address of your server. Examples include your-domain.com or odoo.your-company.com.
• Open Firewall Ports: Ensure that both port 80 (primarily for Let's Encrypt's HTTP challenge) and port 443 (for secure HTTPS traffic) are open in your server's firewall to allow incoming connections from the internet.
• Administrative Access: You must possess either root privileges or a user account with sudo access to execute administrative commands and modify system configurations on your Ubuntu server.

Step 1: Install Certbot

Certbot is the official client for Let's Encrypt, designed to automate the process of obtaining and installing SSL/TLS certificates. It simplifies certificate management significantly.

sudo apt update
sudo apt install certbot python3-certbot-nginx -y

After the installation is complete, it's good practice to verify that Certbot has been installed successfully and is accessible on your system by checking its version:

certbot --version

Step 2: Prepare Your Nginx Configuration

Before obtaining the SSL certificate, it's crucial to ensure your Nginx configuration is correctly set up to include your domain name. This allows Certbot to verify domain ownership and configure SSL.

Open your Odoo 18 Nginx configuration file. The default location is typically:

sudo nano /etc/nginx/sites-available/odoo18

Within this file, your server block should explicitly define your domain name (or names) and listen on port 80, similar to the following example:

server {
    listen 80;
    server\_name your-domain.com www.your-domain.com;
    
    # Your existing Nginx configuration for Odoo should be included here
    include /etc/nginx/snippets/odoo-proxy.conf;
}

After making any changes to the Nginx configuration, always test for syntax errors and then reload the Nginx service to apply them:

sudo nginx -t
sudo systemctl reload nginx

Step 3: Obtain Your SSL Certificate Using Certbot

With Nginx correctly configured, you can now run Certbot to obtain and automatically install your free SSL/TLS certificate from Let's Encrypt. The --nginx plugin handles Nginx integration.

sudo certbot --nginx -d your-domain.com -d www.your-domain.com

During this process, Certbot will guide you through a series of prompts:

1. Email Address: Enter a valid email address. This is used for urgent renewal notices and security warnings.
2. Terms of Service: Read and agree to the Let's Encrypt Terms of Service.
3. EFF Sharing: You may choose whether to share your email address with the Electronic Frontier Foundation (EFF), which supports Certbot's development (this is optional).
4. HTTPS Redirection: Select option 2 to redirect all incoming HTTP traffic to HTTPS. This ensures all connections to your Odoo instance are secure by default.

Step 4: Verify SSL Installation

Upon successful completion, Certbot will automatically modify your Nginx configuration file to include the new SSL certificate details. It's important to review these changes to understand how your server is now configured.

Re-open your Odoo 18 Nginx configuration file:

sudo nano /etc/nginx/sites-available/odoo18

You should now observe a modified configuration that includes new listen 443 ssl directives, paths to your SSL certificate and key files, and an HTTP-to-HTTPS redirection block, similar to the following:

server {
    server\_name your-domain.com www.your-domain.com;
    
    listen 443 ssl http2; # managed by Certbot
    ssl\_certificate /etc/letsencrypt/live/your-domain.com/fullchain.pem; # managed by Certbot
    ssl\_certificate\_key /etc/letsencrypt/live/your-domain.com/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl\_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
    
    include /etc/nginx/snippets/odoo-proxy.conf;
}

server {
    if ($host = www.your-domain.com) {
        return 301 https://$server\_name$request\_uri;
    } # managed by Certbot

    if ($host = your-domain.com) {
        return 301 https://$server\_name$request\_uri;
    } # managed by Certbot

    listen 80;
    server\_name your-domain.com www.your-domain.com;
    return 404; # managed by Certbot
}

This configuration ensures that all traffic is securely served over HTTPS and that any attempts to access the site via HTTP are automatically redirected.

Step 5: Enhance SSL Configuration for Improved Security

While Certbot provides a secure default configuration, you can further enhance your SSL security by implementing a more robust set of SSL parameters. Create a new Nginx snippet for these advanced settings:

sudo nano /etc/nginx/snippets/ssl-params.conf

Add the following content to the ssl-params.conf file. These settings strengthen encryption, optimize session handling, enable OCSP stapling for faster certificate validation, and include essential security headers like Strict-Transport-Security (HSTS).

# Modern SSL configuration
ssl\_protocols TLSv1.2 TLSv1.3;
ssl\_prefer\_server\_ciphers off;
ssl\_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;

# SSL optimization
ssl\_session\_timeout 1d;
ssl\_session\_cache shared:SSL:10m;
ssl\_session\_tickets off;

# OCSP stapling
ssl\_stapling on;
ssl\_stapling\_verify on;
resolver 8.8.8.8 8.8.4.4 valid=300s;
resolver\_timeout 5s;

# Security headers
add\_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";

After saving this file, remember to include it in your main Nginx server block for HTTPS (within the server { listen 443 ssl ... } block), typically by adding include /etc/nginx/snippets/ssl-params.conf; right after include /etc/letsencrypt/options-ssl-nginx.conf;. Then, test and reload Nginx.