自宅サーバーをHTTPS化する！NginxリバースプロキシとLet’s Encryptで無料SSL証明書を取得する方法

インターネット (外部クライアント)
    ↓ https://xxxx.tplinkdns.com
HGW → Deco（二重NAT越え：前の記事で設定済み）
    ↓ ポート443/80
NUCBox G3 Plus (192.168.68.xxx)
  └─ Nginx（リバースプロキシ）
       ├─ listen 443 ssl  ← Let's Encrypt証明書
       │    ├─ /          → 静的ファイル (/srv/nginx/public/html)
       │    ├─ /liff/     → LINEミニアプリ静的ファイル
       │    ├─ /external/ → Flask API (127.0.0.1:8000/api/)
       │    ├─ /webhooks/ → GoogleHome Webhook (127.0.0.1:8000/webhooks/)
       │    └─ /grafana/  → Grafana (127.0.0.1:3000/)
       ├─ listen 80       ← HTTP→HTTPSリダイレクト (外部向け)
       └─ listen 80       ← LAN内向けサーバー (192.168.68.xxx のみ)
            ├─ /          → 静的ファイル (/srv/nginx/private)
            ├─ /internal/ → Flask内部API (127.0.0.1:8000/internal/)
            └─ /grafana/  → Grafana (127.0.0.1:3000/) ※LAN限定

# モバイル回線からHTTPアクセスでNginxのデフォルトページが返ることを確認
curl -v http://xxxx.tplinkdns.com

sudo apt update
sudo apt install -y nginx

sudo systemctl status nginx
# active (running) と表示されればOK

# 自動起動を有効にする
sudo systemctl enable nginx

# snapd のインストールと更新
sudo apt install -y snapd
sudo snap install core
sudo snap refresh core

# Certbot のインストール
sudo snap install --classic certbot

# certbot コマンドへのシンボリックリンク作成
sudo ln -s /snap/bin/certbot /usr/bin/certbot

server {
    listen 80;
    server_name xxxx.tplinkdns.com;

    location / {
        root /srv/nginx/public/html;
        index index.html index.htm;
    }
}

# 設定ファイルの構文チェック
sudo nginx -t

# Nginx の再起動
sudo systemctl reload nginx

sudo certbot --nginx -d xxxx.tplinkdns.com

Saving debug log to /var/log/letsencrypt/letsencrypt.log
Enter email address (used for urgent renewal and security notices)
 (Enter 'c' to cancel): your-email@example.com   # メールアドレスを入力

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Please read the Terms of Service at

404 Page not found
Let's Encrypt is a free, automated, and open Certificate Authority brought to you by the nonprofit Internet Security Res...
letsencrypt.org You must agree
in order to register with the ACME server. Do you agree?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: Y   # Yを入力

...（中略）...

Successfully received certificate.
Certificate is saved at: /etc/letsencrypt/live/xxxx.tplinkdns.com/fullchain.pem
Key is saved at:         /etc/letsencrypt/live/xxxx.tplinkdns.com/privkey.pem
This certificate expires on 2026-08-28.

Deploying certificate to VirtualHost /etc/nginx/conf.d/default.conf
Redirecting all traffic on port 80 to ssl in /etc/nginx/conf.d/default.conf

# 自動更新のドライランテスト
sudo certbot renew --dry-run

# ログフォーマット定義（リモートIP・ユーザーエージェント等を記録）
log_format detailed '$remote_addr - $remote_user [$time_local] "$request" '
                    '$status $body_bytes_sent "$http_referer" '
                    '"$http_user_agent" "$http_x_forwarded_for"';

# ===================================================
# 外部向けHTTPSサーバー (DDNS経由)
# ===================================================
server {
    listen 443 ssl;
    server_name xxxx.tplinkdns.com;

    # SSL証明書（Let's Encrypt Certbot管理）
    ssl_certificate /etc/letsencrypt/live/xxxx.tplinkdns.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/xxxx.tplinkdns.com/privkey.pem;
    include /etc/letsencrypt/options-ssl-nginx.conf;
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;

    access_log /srv/nginx/log/access.log detailed;
    error_log  /srv/nginx/log/error.log;

    # / ルートディレクトリ（外部向け静的ファイル）
    location / {
        root  /srv/nginx/public/html;
        index index.html index.htm;
        limit_except GET HEAD { deny all; }
        autoindex off;
        disable_symlinks if_not_owner from=/srv/nginx/public/html;
        add_header X-Frame-Options "DENY" always;
        add_header X-Content-Type-Options "nosniff" always;
        add_header X-XSS-Protection "1; mode=block" always;
        add_header Referrer-Policy "strict-origin-when-cross-origin" always;
        add_header Content-Security-Policy "default-src 'self'; script-src 'self'; connect-src 'self'; img-src 'self' data:; style-src 'self' 'unsafe-inline';" always;
        add_header Cache-Control "no-store, no-cache, must-revalidate, proxy-revalidate";
    }

    # /liff/ : LINEミニアプリ専用（LINE SDNのスクリプト読み込みを許可）
    location /liff/ {
        alias /srv/nginx/public/liff/;
        index index.html;
        limit_except GET HEAD { deny all; }
        autoindex off;
        add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' blob: https://static.line-scdn.net https://*.line.me; ..." always;
        access_log /srv/nginx/log/liff_access.log detailed;
    }

    # /external/ : 外部向けAPI（Flaskアプリへプロキシ）
    location /external/ {
        proxy_pass http://127.0.0.1:8000/api/;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_cache_bypass $http_upgrade;
        proxy_set_header Authorization $http_authorization;
        access_log /srv/nginx/log/api.log detailed;
    }

    # /webhooks/ : GoogleHome用Webhook
    location /webhooks/ {
        proxy_pass http://127.0.0.1:8000/webhooks/;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_cache_bypass $http_upgrade;
    }

    # /grafana/ : Grafana外部アクセス
    location /grafana/ {
        proxy_pass http://127.0.0.1:3000/;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_cache_bypass $http_upgrade;
    }

    error_page 500 502 503 504 /50x.html;
    location = /50x.html { root /usr/share/nginx/html; }
}

# ===================================================
# HTTP→HTTPSリダイレクト（外部向け）
# ===================================================
server {
    listen 80;
    server_name xxxx.tplinkdns.com;
    return 301 https://$host$request_uri;
}

# ===================================================
# LAN内向けサーバー（IPアクセス、LAN限定）
# ===================================================
server {
    listen 80;
    server_name 192.168.68.xxx;
    root /srv/nginx/private;

    location / {
        index index.html index.htm;
        autoindex on;
    }

    location /internal/ {
        proxy_pass http://127.0.0.1:8000/internal/;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        allow 192.168.68.0/24;
        deny all;
        access_log /srv/nginx/log/webapi_internal.log detailed;
    }

    location /grafana/ {
        proxy_pass http://127.0.0.1:3000/;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        allow 192.168.68.0/24;
        deny all;
    }
}

# 構文チェック
sudo nginx -t
# nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
# nginx: configuration file /etc/nginx/nginx.conf test is successful

# 設定の反映（サービスを止めずにリロード）
sudo systemctl reload nginx

sudo mkdir -p /srv/nginx/log
sudo mkdir -p /srv/nginx/public/html
sudo mkdir -p /srv/nginx/public/liff
sudo mkdir -p /srv/nginx/private
sudo chown -R www-data:www-data /srv/nginx

proxy_set_header X-Real-IP $remote_addr;
# → バックエンド（Flask等）に実際のクライアントIPを伝える

proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
# → プロキシを経由した場合のクライアントIP履歴を伝える

proxy_set_header X-Forwarded-Proto $scheme;
# → バックエンドに元のプロトコル（https）を伝える

proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
# → WebSocket接続のアップグレードをサポートする（Grafana等で必要）

allow 192.168.68.0/24;   # LAN内（192.168.68.xxx）のみ許可
deny all;                 # その他は全て拒否

# HTTP→HTTPSリダイレクトの確認（301が返ればOK）
curl -v http://xxxx.tplinkdns.com
# < HTTP/1.1 301 Moved Permanently
# < Location: https://xxxx.tplinkdns.com/

# HTTPS接続確認（200が返ればOK）
curl -v https://xxxx.tplinkdns.com

# SSL証明書の検証を無視して接続テスト（証明書エラーのデバッグ時）
curl -vk https://xxxx.tplinkdns.com

# レスポンスヘッダーのみ確認（セキュリティヘッダーの確認）
curl -I https://xxxx.tplinkdns.com

HTTP/2 200
x-frame-options: DENY
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
content-security-policy: default-src 'self'; ...

# SSL証明書の詳細確認
echo | openssl s_client -connect xxxx.tplinkdns.com:443 2>/dev/null | openssl x509 -noout -text | grep -E "(Subject:|Issuer:|Not Before|Not After)"

        Issuer: C=US, O=Let's Encrypt, CN=R10
        Not Before: May 30 00:00:00 2026 GMT
        Not After : Aug 28 00:00:00 2026 GMT
        Subject: CN=xxxx.tplinkdns.com

# 証明書の有効期限のみ確認
echo | openssl s_client -connect xxxx.tplinkdns.com:443 2>/dev/null | openssl x509 -noout -enddate
# notAfter=Aug 28 00:00:00 2026 GMT