{"id":35528,"date":"2025-11-30T19:40:57","date_gmt":"2025-11-30T16:40:57","guid":{"rendered":"https:\/\/fatihsoysal.com\/blog\/?p=35528"},"modified":"2025-11-30T19:40:57","modified_gmt":"2025-11-30T16:40:57","slug":"nginxi-debian-9-uzerinde-lets-encrypt-ile-guvenli-hale-getirme","status":"publish","type":"post","link":"https:\/\/fatihsoysal.com\/blog\/nginxi-debian-9-uzerinde-lets-encrypt-ile-guvenli-hale-getirme\/","title":{"rendered":"Nginx’i Debian 9 \u00dczerinde Let’s Encrypt ile G\u00fcvenli Hale Getirme"},"content":{"rendered":"

<\/p>\n

Nginx’i Debian 9 \u00dczerinde Let’s Encrypt ile G\u00fcvenli Hale Getirme<\/h2>\n

G\u00fcn\u00fcm\u00fcz dijital d\u00fcnyas\u0131nda web sitelerinin g\u00fcvenli\u011fi, kullan\u0131c\u0131 gizlili\u011fi, veri b\u00fct\u00fcnl\u00fc\u011f\u00fc ve arama motoru s\u0131ralamalar\u0131 i\u00e7in vazge\u00e7ilmez bir \u00f6neme sahiptir. HTTPS (Hypertext Transfer Protocol Secure), web trafi\u011fini \u015fifreleyerek bu g\u00fcvenli\u011fi sa\u011flayan temel protokold\u00fcr. HTTPS kullanmak, bir web sitesinin kimli\u011fini do\u011frular, kullan\u0131c\u0131lar\u0131n taray\u0131c\u0131lar\u0131 ile sunucu aras\u0131ndaki t\u00fcm ileti\u015fimi \u015fifreler ve b\u00f6ylece araya girme (man-in-the-middle) sald\u0131r\u0131lar\u0131n\u0131, veri s\u0131z\u0131nt\u0131lar\u0131n\u0131 ve kurcalamalar\u0131 engeller. Nginx, y\u00fcksek performans\u0131, \u00f6l\u00e7eklenebilirli\u011fi ve esnekli\u011fi sayesinde en pop\u00fcler web sunucular\u0131ndan biridir. Let’s Encrypt ise, herkesin \u00fccretsiz, otomatik ve a\u00e7\u0131k bir \u015fekilde SSL\/TLS sertifikalar\u0131 almas\u0131n\u0131 sa\u011flayan, kar amac\u0131 g\u00fctmeyen bir sertifika yetkilisidir (CA). Bu makalede, Debian 9 (Stretch) i\u015fletim sistemi \u00fczerinde \u00e7al\u0131\u015fan bir Nginx web sunucusunu Let’s Encrypt ile nas\u0131l g\u00fcvenli hale getirece\u011finizi ad\u0131m ad\u0131m detayl\u0131 bir \u015fekilde a\u00e7\u0131klayaca\u011f\u0131z.<\/p>\n

Debian 9, art\u0131k ya\u015fam d\u00f6ng\u00fcs\u00fcn\u00fcn sonuna gelmi\u015f olsa da, bir\u00e7ok sunucuda hala aktif olarak kullan\u0131lmaktad\u0131r. Bu nedenle, bu platform \u00fczerindeki g\u00fcvenlik uygulamalar\u0131n\u0131 anlamak ve do\u011fru bir \u015fekilde yap\u0131land\u0131rmak hala \u00f6nemini korumaktad\u0131r. Bu rehber, Nginx kurulumundan ba\u015flayarak, Let’s Encrypt istemcisi Certbot’un kurulumuna, SSL sertifikas\u0131 edinme ve Nginx’i HTTPS trafi\u011fi i\u00e7in yap\u0131land\u0131rma ad\u0131mlar\u0131na kadar her \u015feyi kapsayacakt\u0131r. Ayr\u0131ca, otomatik sertifika yenileme ve web sitenizin g\u00fcvenli\u011fini art\u0131rmak i\u00e7in ek ipu\u00e7lar\u0131 da sunulacakt\u0131r.<\/p>\n

\u00d6n Ko\u015fullar<\/h3>\n

Bu rehbere ba\u015flamadan \u00f6nce, a\u015fa\u011f\u0131daki \u00f6n ko\u015fullar\u0131n yerine getirildi\u011finden emin olman\u0131z gerekmektedir:<\/p>\n

* Debian 9 (Stretch) Sunucusu:<\/strong> \u00c7al\u0131\u015f\u0131r durumda bir Debian 9 sunucusuna sahip olmal\u0131s\u0131n\u0131z. T\u00fcm komutlar bu i\u015fletim sistemi s\u00fcr\u00fcm\u00fc i\u00e7in test edilmi\u015ftir.
\n* Nginx Kurulumu:<\/strong> Sunucunuzda Nginx web sunucusu kurulu ve temel bir web sitesini HTTP \u00fczerinden (port 80) sunuyor olmal\u0131d\u0131r. E\u011fer kurulu de\u011filse, ilk ad\u0131mda kurulumu ger\u00e7ekle\u015ftirece\u011fiz.
\n* Alan Ad\u0131:<\/strong> Sunucunuzun IP adresine y\u00f6nlendirilmi\u015f kay\u0131tl\u0131 bir alan ad\u0131n\u0131z (\u00f6rne\u011fin, example.com<\/code>) olmal\u0131d\u0131r. Let’s Encrypt sertifikalar\u0131 IP adresleri i\u00e7in de\u011fil, alan adlar\u0131 i\u00e7in verilir. Alan ad\u0131n\u0131z\u0131n hem ana s\u00fcr\u00fcm\u00fc (example.com<\/code>) hem de www<\/code> alt alan\u0131 (www.example.com<\/code>) sunucunuzun IP adresine A kayd\u0131 veya CNAME kayd\u0131 ile y\u00f6nlendirilmi\u015f olmal\u0131d\u0131r.
\n* SSH Eri\u015fimi:<\/strong> Sunucuya SSH \u00fczerinden root ayr\u0131cal\u0131klar\u0131yla veya sudo<\/code> yetkisine sahip bir kullan\u0131c\u0131yla eri\u015fiminiz olmal\u0131d\u0131r.
\n* G\u00fcvenlik Duvar\u0131 (UFW):<\/strong> Sunucunuzda bir g\u00fcvenlik duvar\u0131 (\u00f6rne\u011fin, UFW) etkinse, hem HTTP (port 80) hem de HTTPS (port 443) trafi\u011fine izin verildi\u011finden emin olmal\u0131s\u0131n\u0131z.<\/p>\n

Bu \u00f6n ko\u015fullar\u0131 sa\u011flad\u0131ktan sonra, Nginx sunucunuzu Let’s Encrypt ile g\u00fcvenli hale getirme i\u015flemine ba\u015flayabiliriz.<\/p>\n

Nginx Kurulumu ve Temel Yap\u0131land\u0131rma<\/h3>\n

E\u011fer Nginx sunucunuz zaten kurulu ve alan ad\u0131n\u0131z i\u00e7in yap\u0131land\u0131r\u0131lm\u0131\u015fsa, bu ad\u0131m\u0131 atlayabilir ve do\u011frudan Certbot kurulumuna ge\u00e7ebilirsiniz. Aksi takdirde, a\u015fa\u011f\u0131daki ad\u0131mlar\u0131 izleyerek Nginx’i kurun ve temel bir yap\u0131land\u0131rma yap\u0131n.<\/p>\n

Nginx Kurulumu<\/h4>\n

\u0130lk olarak, sistem paket listesini g\u00fcncelleyelim ve Nginx’i kural\u0131m:<\/p>\n

sudo apt update\nsudo apt install nginx<\/code><\/pre>\n
Kurulum tamamland\u0131ktan sonra, Nginx servisinin otomatik olarak ba\u015flamas\u0131 ve her sistem ba\u015flang\u0131c\u0131nda etkinle\u015ftirilmesi gerekir. Durumunu kontrol edelim:<\/p>\n
sudo systemctl start nginx\nsudo systemctl enable nginx\nsudo systemctl status nginx<\/code><\/pre>\n
systemctl status nginx<\/code> komutu \u00e7\u0131kt\u0131s\u0131nda active (running)<\/code> ibaresini g\u00f6rmelisiniz.<\/p>\n
\u015eimdi g\u00fcvenlik duvar\u0131 ayarlar\u0131n\u0131 yapal\u0131m. Debian’da yayg\u0131n olarak kullan\u0131lan g\u00fcvenlik duvar\u0131 UFW’dir. E\u011fer UFW kurulu ve etkin de\u011filse, kurup etkinle\u015ftirebilirsiniz:<\/p>\n
sudo apt install ufw\nsudo ufw enable<\/code><\/pre>\n
Uyar\u0131:<\/strong> ufw enable<\/code> komutunu \u00e7al\u0131\u015ft\u0131rmadan \u00f6nce SSH portuna (genellikle 22) izin verdi\u011finizden emin olun, aksi takdirde sunucuya eri\u015fiminiz kesilebilir: sudo ufw allow ssh<\/code>.<\/p>\n
Nginx i\u00e7in gerekli portlar\u0131 a\u00e7al\u0131m:<\/p>\n
sudo ufw allow 'Nginx HTTP'  # Port 80\nsudo ufw allow 'Nginx HTTPS' # Port 443\nsudo ufw reload              # G\u00fcvenlik duvar\u0131 kurallar\u0131n\u0131 yeniden y\u00fckle\nsudo ufw status              # Kurallar\u0131 kontrol et<\/code><\/pre>\n
sudo ufw status<\/code> \u00e7\u0131kt\u0131s\u0131nda Nginx HTTP<\/code> ve Nginx HTTPS<\/code> profillerinin ALLOW<\/code> olarak listelendi\u011fini g\u00f6rmelisiniz. Art\u0131k web taray\u0131c\u0131n\u0131zdan sunucunuzun IP adresini ziyaret etti\u011finizde varsay\u0131lan Nginx “Welcome” sayfas\u0131n\u0131 g\u00f6rmeniz gerekir.<\/p>\n
Alan Ad\u0131 i\u00e7in Nginx Sunucu Blo\u011fu Yap\u0131land\u0131rma<\/h4>\n
Nginx, farkl\u0131 alan adlar\u0131 i\u00e7in “sunucu bloklar\u0131” (server blocks) kullanarak birden fazla web sitesini tek bir sunucuda bar\u0131nd\u0131rman\u0131za olanak tan\u0131r. Alan ad\u0131n\u0131z i\u00e7in bir sunucu blo\u011fu olu\u015ftural\u0131m. example.com<\/code> yerine kendi alan ad\u0131n\u0131z\u0131 kullanmay\u0131 unutmay\u0131n.<\/p>\n
Yeni bir yap\u0131land\u0131rma dosyas\u0131 olu\u015ftural\u0131m:<\/p>\n
sudo nano \/etc\/nginx\/sites-available\/example.com<\/code><\/pre>\n
Dosyan\u0131n i\u00e7ine a\u015fa\u011f\u0131daki temel yap\u0131land\u0131rmay\u0131 ekleyin:<\/p>\n
server {\n    listen 80;\n    listen [::]:80;\n\n    root \/var\/www\/example.com; # Web sitenizin dosyalar\u0131n\u0131n bulundu\u011fu dizin\n    index index.html index.htm index.nginx-debian.html;\n\n    server_name example.com www.example.com; # Alan ad\u0131n\u0131z\n\n    location \/ {\n        try_files $uri $uri\/ =404;\n    }\n}<\/code><\/pre>\n
*   listen 80;<\/code>: Nginx’in HTTP trafi\u011fi i\u00e7in 80 numaral\u0131 portu dinlemesini sa\u011flar.
\n*   root \/var\/www\/example.com;<\/code>: Web sitenizin k\u00f6k dizinini belirtir. Bu dizini olu\u015fturman\u0131z gerekecektir.
\n*   index ...;<\/code>: Varsay\u0131lan dizin dosyalar\u0131n\u0131 belirtir.
\n*   server_name example.com www.example.com;<\/code>: Bu sunucu blo\u011funun hangi alan adlar\u0131 i\u00e7in ge\u00e7erli oldu\u011funu tan\u0131mlar.
\n*   location \/ { ... };<\/code>: Gelen isteklerin nas\u0131l i\u015flenece\u011fini belirler. try_files<\/code> direktifi, dosya veya dizin bulunamazsa 404 hatas\u0131 d\u00f6nd\u00fcr\u00fcr.<\/p>\n
\u015eimdi web sitenizin k\u00f6k dizinini olu\u015ftural\u0131m ve i\u00e7ine basit bir index.html<\/code> dosyas\u0131 ekleyelim:<\/p>\n
sudo mkdir -p \/var\/www\/example.com\nsudo nano \/var\/www\/example.com\/index.html<\/code><\/pre>\n
index.html<\/code> i\u00e7ine basit bir HTML i\u00e7eri\u011fi ekleyin:<\/p>\n
\n\n\n    Ho\u015f Geldiniz!<\/title>\n<\/head>\n<body>\n    \n    <p>Nginx sunucunuz ba\u015far\u0131yla yap\u0131land\u0131r\u0131ld\u0131.<\/p>\n<\/body>\n<\/html><\/code><\/pre>\n<p>Nginx’in bu yeni sunucu blo\u011funu kullanabilmesi i\u00e7in, <code>sites-available<\/code> dizinindeki yap\u0131land\u0131rma dosyas\u0131ndan <code>sites-enabled<\/code> dizinine bir sembolik ba\u011f (symlink) olu\u015fturmam\u0131z gerekir:<\/p>\n<pre><code class=\"language-bash\">sudo ln -s \/etc\/nginx\/sites-available\/example.com \/etc\/nginx\/sites-enabled\/<\/code><\/pre>\n<p>Varsay\u0131lan Nginx sunucu blo\u011funu devre d\u0131\u015f\u0131 b\u0131rakmak iyi bir uygulamad\u0131r:<\/p>\n<pre><code class=\"language-bash\">sudo rm \/etc\/nginx\/sites-enabled\/default<\/code><\/pre>\n<p>Nginx yap\u0131land\u0131rmas\u0131nda herhangi bir s\u00f6zdizimi hatas\u0131 olup olmad\u0131\u011f\u0131n\u0131 kontrol edelim:<\/p>\n<pre><code class=\"language-bash\">sudo nginx -t<\/code><\/pre>\n<p>E\u011fer \u00e7\u0131kt\u0131 <code>test is successful<\/code> benzeri bir mesaj i\u00e7eriyorsa, her \u015fey yolundad\u0131r. \u015eimdi Nginx servisini yeniden y\u00fckleyerek de\u011fi\u015fiklikleri uygulayal\u0131m:<\/p>\n<pre><code class=\"language-bash\">sudo systemctl reload nginx<\/code><\/pre>\n<p>Art\u0131k web taray\u0131c\u0131n\u0131zdan alan ad\u0131n\u0131z\u0131 (<code>http:\/\/example.com<\/code>) ziyaret etti\u011finizde, olu\u015fturdu\u011funuz <code>index.html<\/code> dosyas\u0131n\u0131n i\u00e7eri\u011fini g\u00f6rmelisiniz. Bu, Nginx’in d\u00fczg\u00fcn \u00e7al\u0131\u015ft\u0131\u011f\u0131n\u0131 ve alan ad\u0131n\u0131z i\u00e7in yap\u0131land\u0131r\u0131ld\u0131\u011f\u0131n\u0131 do\u011frular.<\/p>\n<h3>Certbot Kurulumu (Let’s Encrypt \u0130stemcisi)<\/h3>\n<p>Let’s Encrypt sertifikalar\u0131n\u0131 sunucunuzda otomatik olarak almak ve y\u00f6netmek i\u00e7in Certbot adl\u0131 bir istemciye ihtiyac\u0131m\u0131z var. Certbot, Let’s Encrypt’in ACME (Automated Certificate Management Environment) protokol\u00fc ile etkile\u015fime girerek sertifika alma, yenileme ve Nginx gibi web sunucular\u0131n\u0131 otomatik olarak yap\u0131land\u0131rma i\u015flemlerini basitle\u015ftirir.<\/p>\n<h4>Certbot Nedir?<\/h4>\n<p>Certbot, EFF (Electronic Frontier Foundation) taraf\u0131ndan geli\u015ftirilen ve Let’s Encrypt sertifikalar\u0131n\u0131 Linux sunucular\u0131nda kolayca alman\u0131z\u0131 ve y\u00f6netmenizi sa\u011flayan bir yaz\u0131l\u0131md\u0131r. \u00c7e\u015fitli web sunucular\u0131 (Nginx, Apache) i\u00e7in eklentilere sahiptir ve bu eklentiler sayesinde sunucu yap\u0131land\u0131rmas\u0131n\u0131 otomatik olarak g\u00fcncelleyebilir.<\/p>\n<h4>Certbot Kurulumu<\/h4>\n<p>Debian 9 (Stretch) i\u00e7in Certbot’un en g\u00fcncel s\u00fcr\u00fcm\u00fcn\u00fc y\u00fcklemek i\u00e7in <code>stretch-backports<\/code> deposunu etkinle\u015ftirmemiz gerekebilir. Bu depolar, daha yeni yaz\u0131l\u0131m paketlerini eski Debian s\u00fcr\u00fcmlerine ta\u015f\u0131r.<\/p>\n<p>\u0130lk olarak, <code>stretch-backports<\/code> deposunu <code>sources.list<\/code> dosyan\u0131za ekleyin:<\/p>\n<pre><code class=\"language-bash\">echo \"deb http:\/\/deb.debian.org\/debian stretch-backports main contrib non-free\" | sudo tee \/etc\/apt\/sources.list.d\/stretch-backports.list\nsudo apt update<\/code><\/pre>\n<p>\u015eimdi, Nginx eklentisiyle birlikte Certbot’u <code>backports<\/code> deposundan y\u00fckleyebiliriz:<\/p>\n<pre><code class=\"language-bash\">sudo apt install python-certbot-nginx -t stretch-backports<\/code><\/pre>\n<p>Bu komut, Certbot’un kendisini ve Nginx ile entegrasyonu sa\u011flayan eklentiyi kuracakt\u0131r. Kurulum tamamland\u0131ktan sonra, Certbot’un do\u011fru bir \u015fekilde kuruldu\u011funu do\u011frulamak i\u00e7in s\u00fcr\u00fcm\u00fcn\u00fc kontrol edebilirsiniz:<\/p>\n<pre><code class=\"language-bash\">certbot --version<\/code><\/pre>\n<p>E\u011fer komut bir s\u00fcr\u00fcm numaras\u0131 d\u00f6nd\u00fcr\u00fcyorsa, Certbot ba\u015far\u0131yla kurulmu\u015ftur.<\/p>\n<h3>Let’s Encrypt SSL Sertifikas\u0131 Alma<\/h3>\n<p>Certbot y\u00fcklendikten sonra, alan ad\u0131n\u0131z i\u00e7in bir SSL sertifikas\u0131 almak i\u00e7in kullanabiliriz. Certbot’un Nginx eklentisi, bu s\u00fcreci olduk\u00e7a basitle\u015ftirir.<\/p>\n<h4>Otomatik Y\u00f6ntem (Nginx Eklentisi ile)<\/h4>\n<p>Certbot’un Nginx eklentisi, sertifikay\u0131 alman\u0131n yan\u0131 s\u0131ra Nginx yap\u0131land\u0131rman\u0131z\u0131 otomatik olarak HTTPS’ye y\u00f6nlendirecek \u015fekilde g\u00fcncelleyebilir. Bu, \u00e7o\u011fu kullan\u0131c\u0131 i\u00e7in en kolay ve \u00f6nerilen y\u00f6ntemdir.<\/p>\n<p>A\u015fa\u011f\u0131daki komutu \u00e7al\u0131\u015ft\u0131r\u0131n, <code>example.com<\/code> ve <code>www.example.com<\/code> yerine kendi alan adlar\u0131n\u0131z\u0131 yaz\u0131n:<\/p>\n<pre><code class=\"language-bash\">sudo certbot --nginx -d example.com -d www.example.com<\/code><\/pre>\n<p>Bu komutu \u00e7al\u0131\u015ft\u0131rd\u0131ktan sonra, Certbot size birka\u00e7 soru soracakt\u0131r:<\/p>\n<p>1.  <strong>E-posta Adresi:<\/strong> Sertifika bildirimleri ve acil durumlar i\u00e7in bir e-posta adresi girmeniz istenecektir. Bu adres, sertifikalar\u0131n\u0131z\u0131n s\u00fcresi dolmadan \u00f6nce size uyar\u0131lar g\u00f6ndermek i\u00e7in kullan\u0131l\u0131r.<br \/>\n2.  <strong>Hizmet \u015eartlar\u0131:<\/strong> Let’s Encrypt’in hizmet \u015fartlar\u0131n\u0131 kabul etmeniz gerekecektir. <code>A<\/code> (Agree) yaz\u0131p Enter’a bas\u0131n.<br \/>\n3.  <strong>EFF Haber B\u00fclteni:<\/strong> EFF’in haber b\u00fcltenine abone olmak isteyip istemedi\u011finiz sorulacakt\u0131r. <code>Y<\/code> (Yes) veya <code>N<\/code> (No) se\u00e7ene\u011fini belirleyin.<br \/>\n4.  <strong>HTTP Trafi\u011fini HTTPS’ye Y\u00f6nlendirme:<\/strong> Certbot, HTTP trafi\u011fini otomatik olarak HTTPS’ye y\u00f6nlendirmek isteyip istemedi\u011finizi soracakt\u0131r. Genellikle bu \u00f6nerilir.<br \/>\n    *   <code>1: No redirect<\/code> (Y\u00f6nlendirme yapma)<br \/>\n    *   <code>2: Redirect<\/code> (T\u00fcm HTTP isteklerini HTTPS’ye y\u00f6nlendir)<br \/>\n    Se\u00e7enek <code>2<\/code>‘yi se\u00e7meniz \u015fiddetle tavsiye edilir.<\/p>\n<p>Bu ad\u0131mlar\u0131 tamamlad\u0131ktan sonra, Certbot sertifikalar\u0131 alacak, Nginx yap\u0131land\u0131rman\u0131z\u0131 g\u00fcncelleyecek ve size ba\u015far\u0131l\u0131 bir mesaj g\u00f6sterecektir. Mesajda sertifikalar\u0131n\u0131z\u0131n nerede sakland\u0131\u011f\u0131 (genellikle <code>\/etc\/letsencrypt\/live\/example.com\/<\/code>) ve ne zaman sona erece\u011fi belirtilecektir.<\/p>\n<p>\u015eimdi web taray\u0131c\u0131n\u0131zdan alan ad\u0131n\u0131z\u0131 (<code>https:\/\/example.com<\/code>) ziyaret etti\u011finizde, taray\u0131c\u0131n\u0131z\u0131n adres \u00e7ubu\u011funda bir kilit simgesi g\u00f6rmelisiniz. Bu, sitenizin art\u0131k g\u00fcvenli bir HTTPS ba\u011flant\u0131s\u0131 \u00fczerinden sunuldu\u011fu anlam\u0131na gelir. E\u011fer HTTP’den HTTPS’ye y\u00f6nlendirmeyi se\u00e7tiyseniz, <code>http:\/\/example.com<\/code> adresini ziyaret etti\u011finizde otomatik olarak <code>https:\/\/example.com<\/code> adresine y\u00f6nlendirileceksiniz.<\/p>\n<h4>Manuel Y\u00f6ntem (Webroot Eklentisi ile)<\/h4>\n<p>Baz\u0131 durumlarda, Certbot’un Nginx eklentisini kullanmak istemeyebilir veya kullanamayabilirsiniz (\u00f6rne\u011fin, Nginx yap\u0131land\u0131rman\u0131z \u00e7ok \u00f6zel oldu\u011funda veya sadece sertifikay\u0131 almak isteyip yap\u0131land\u0131rmay\u0131 manuel yapmak istedi\u011finizde). Bu durumda, <code>webroot<\/code> eklentisini kullanarak sadece sertifikay\u0131 alabilirsiniz.<\/p>\n<p>\u0130lk olarak, Nginx sunucu blo\u011funuzda Certbot’un ge\u00e7ici dosyalar\u0131n\u0131 yerle\u015ftirece\u011fi bir dizine eri\u015fime izin verdi\u011finizden emin olun. Bu genellikle web sitenizin k\u00f6k dizini alt\u0131nda <code>.well-known\/acme-challenge<\/code> \u015feklindedir.<\/p>\n<pre><code class=\"language-nginx\">server {\n    listen 80;\n    listen [::]:80;\n\n    root \/var\/www\/example.com;\n    index index.html index.htm index.nginx-debian.html;\n\n    server_name example.com www.example.com;\n\n    location ~ \/.well-known\/acme-challenge {\n        allow all;\n        root \/var\/www\/example.com; # Sertifika do\u011frulama dosyalar\u0131n\u0131n bulundu\u011fu k\u00f6k dizin\n    }\n\n    location \/ {\n        try_files $uri $uri\/ =404;\n    }\n}<\/code><\/pre>\n<p>Nginx yap\u0131land\u0131rmas\u0131n\u0131 kaydedin, test edin ve yeniden y\u00fckleyin:<\/p>\n<pre><code class=\"language-bash\">sudo nginx -t\nsudo systemctl reload nginx<\/code><\/pre>\n<p>\u015eimdi sertifikay\u0131 <code>webroot<\/code> eklentisi ile al\u0131n:<\/p>\n<pre><code class=\"language-bash\">sudo certbot certonly --webroot -w \/var\/www\/example.com -d example.com -d www.example.com<\/code><\/pre>\n<p>Burada <code>-w<\/code> parametresi, Certbot’un ACME do\u011frulama dosyalar\u0131n\u0131 yerle\u015ftirece\u011fi web k\u00f6k dizinini belirtir. Bu komut, \u00f6nceki otomatik y\u00f6ntemde oldu\u011fu gibi e-posta ve hizmet \u015fartlar\u0131 sorular\u0131n\u0131 soracakt\u0131r. Ba\u015far\u0131l\u0131 olursa, sertifika dosyalar\u0131n\u0131z <code>\/etc\/letsencrypt\/live\/example.com\/<\/code> dizinine kaydedilecektir.<\/p>\n<p>Bu y\u00f6ntemle sertifikay\u0131 ald\u0131ktan sonra, Nginx’i HTTPS kullanacak \u015fekilde manuel olarak yap\u0131land\u0131rman\u0131z gerekecektir.<\/p>\n<h3>Nginx’i HTTPS Kullanacak \u015eekilde Yap\u0131land\u0131rma<\/h3>\n<p>E\u011fer Certbot’u <code>--nginx<\/code> eklentisiyle kulland\u0131ysan\u0131z, Nginx yap\u0131land\u0131rman\u0131z zaten g\u00fcncellenmi\u015f olmal\u0131d\u0131r. Ancak, <code>certonly<\/code> y\u00f6ntemini kulland\u0131ysan\u0131z veya mevcut yap\u0131land\u0131rmay\u0131 kontrol etmek ve daha da g\u00fc\u00e7lendirmek istiyorsan\u0131z, bu b\u00f6l\u00fcmdeki ad\u0131mlar\u0131 izleyin.<\/p>\n<h4>Otomatik Yap\u0131land\u0131rma Kontrol\u00fc<\/h4>\n<p>Certbot’un <code>--nginx<\/code> eklentisi, <code>\/etc\/nginx\/sites-available\/example.com<\/code> dosyan\u0131z\u0131 (veya ilgili sunucu blo\u011fu dosyan\u0131z\u0131) otomatik olarak g\u00fcnceller. Bu dosyay\u0131 a\u00e7arak Certbot’un yapt\u0131\u011f\u0131 de\u011fi\u015fiklikleri g\u00f6rebilirsiniz:<\/p>\n<pre><code class=\"language-bash\">sudo nano \/etc\/nginx\/sites-available\/example.com<\/code><\/pre>\n<p>\u0130\u00e7erisinde a\u015fa\u011f\u0131daki gibi bir yap\u0131land\u0131rma g\u00f6rmelisiniz:<\/p>\n<pre><code class=\"language-nginx\">server {\n    listen 80;\n    listen [::]:80;\n    server_name example.com www.example.com;\n    return 301 https:\/\/$host$request_uri; # HTTP'den HTTPS'ye y\u00f6nlendirme\n}\n\nserver {\n    listen 443 ssl;\n    listen [::]:443 ssl;\n    server_name example.com www.example.com;\n\n    root \/var\/www\/example.com;\n    index index.html index.htm index.nginx-debian.html;\n\n    ssl_certificate \/etc\/letsencrypt\/live\/example.com\/fullchain.pem;\n    ssl_certificate_key \/etc\/letsencrypt\/live\/example.com\/privkey.pem;\n\n    include \/etc\/letsencrypt\/options-ssl-nginx.conf; # Certbot'un varsay\u0131lan SSL ayarlar\u0131\n    ssl_dhparam \/etc\/letsencrypt\/ssl-dhparams.pem;   # Diffie-Hellman parametreleri\n\n    location \/ {\n        try_files $uri $uri\/ =404;\n    }\n}<\/code><\/pre>\n<p>Bu yap\u0131land\u0131rma, HTTP trafi\u011fini HTTPS’ye y\u00f6nlendiren bir <code>server<\/code> blo\u011fu ve HTTPS trafi\u011fini dinleyen, SSL sertifikalar\u0131n\u0131 kullanan ayr\u0131 bir <code>server<\/code> blo\u011fu i\u00e7erir. <code>include \/etc\/letsencrypt\/options-ssl-nginx.conf;<\/code> sat\u0131r\u0131, Certbot’un g\u00fc\u00e7l\u00fc SSL\/TLS ayarlar\u0131n\u0131 otomatik olarak y\u00fcklemesini sa\u011flar. <code>ssl_dhparam<\/code> direktifi ise Diffie-Hellman parametrelerini kullanarak Perfect Forward Secrecy’yi (PFS) etkinle\u015ftirir.<\/p>\n<h4>Manuel Yap\u0131land\u0131rma<\/h4>\n<p>E\u011fer <code>certonly<\/code> ile sertifikay\u0131 ald\u0131ysan\u0131z, yukar\u0131daki yap\u0131land\u0131rmay\u0131 manuel olarak sunucu blo\u011funuza eklemeniz gerekecektir.<\/p>\n<p>\u0130lk olarak, Diffie-Hellman parametrelerini olu\u015fturman\u0131z gerekir. Bu, g\u00fcvenli\u011fi art\u0131rmak i\u00e7in \u00f6nemlidir ve bir kerelik bir i\u015flemdir:<\/p>\n<pre><code class=\"language-bash\">sudo openssl dhparam -out \/etc\/ssl\/certs\/dhparam.pem 2048<\/code><\/pre>\n<p>Bu komut biraz zaman alabilir.<\/p>\n<p>\u015eimdi sunucu blo\u011fu dosyan\u0131z\u0131 a\u00e7\u0131n:<\/p>\n<pre><code class=\"language-bash\">sudo nano \/etc\/nginx\/sites-available\/example.com<\/code><\/pre>\n<p>Dosyan\u0131n i\u00e7eri\u011fini a\u015fa\u011f\u0131daki gibi g\u00fcncelleyin. Mevcut HTTP blo\u011funuzu HTTPS’ye y\u00f6nlendirecek \u015fekilde de\u011fi\u015ftirin ve yeni bir HTTPS blo\u011fu ekleyin:<\/p>\n<pre><code class=\"language-nginx\"># HTTP'den HTTPS'ye y\u00f6nlendirme\nserver {\n    listen 80;\n    listen [::]:80;\n    server_name example.com www.example.com;\n    return 301 https:\/\/$host$request_uri;\n}\n\n<h2>HTTPS sunucu blo\u011fu<\/h2>\nserver {\n    listen 443 ssl http2; # HTTP\/2 deste\u011fi ekleyelim\n    listen [::]:443 ssl http2;\n\n    server_name example.com www.example.com;\n\n    root \/var\/www\/example.com;\n    index index.html index.htm index.nginx-debian.html;\n\n    # Let's Encrypt sertifika yollar\u0131\n    ssl_certificate \/etc\/letsencrypt\/live\/example.com\/fullchain.pem;\n    ssl_certificate_key \/etc\/letsencrypt\/live\/example.com\/privkey.pem;\n\n    # G\u00fc\u00e7l\u00fc SSL\/TLS ayarlar\u0131\n    ssl_protocols TLSv1.2 TLSv1.3; # Yaln\u0131zca g\u00fcvenli protokolleri kullan\n    ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384';\n    ssl_prefer_server_ciphers on;\n    ssl_session_cache shared:SSL:10m;\n    ssl_session_timeout 1d;\n    ssl_session_tickets off;\n    ssl_dhparam \/etc\/ssl\/certs\/dhparam.pem; # Olu\u015fturdu\u011fumuz DH parametreleri\n    ssl_stapling on; # OCSP Stapling etkinle\u015ftirme\n    ssl_stapling_verify on;\n    ssl_trusted_certificate \/etc\/letsencrypt\/live\/example.com\/chain.pem; # Zincir sertifikas\u0131\n    resolver 8.8.8.8 8.8.4.4 valid=300s; # DNS \u00e7\u00f6z\u00fcmleyici (Google DNS)\n    resolver_timeout 5s;\n\n    # HSTS (HTTP Strict Transport Security)\n    add_header Strict-Transport-Security \"max-age=63072000; includeSubDomains; preload\";\n\n    location \/ {\n        try_files $uri $uri\/ =404;\n    }\n}<\/code><\/pre>\n<p>Yukar\u0131daki yap\u0131land\u0131rmada birka\u00e7 \u00f6nemli nokta bulunmaktad\u0131r:<\/p>\n<p>*   <code>listen 443 ssl http2;<\/code>: HTTPS i\u00e7in 443 numaral\u0131 portu dinler ve HTTP\/2 protokol\u00fcn\u00fc etkinle\u015ftirir. HTTP\/2, performans\u0131 art\u0131r\u0131r.<br \/>\n*   <code>ssl_certificate<\/code> ve <code>ssl_certificate_key<\/code>: Let’s Encrypt taraf\u0131ndan sa\u011flanan sertifika ve \u00f6zel anahtar dosyalar\u0131n\u0131n yollar\u0131n\u0131 belirtir.<br \/>\n*   <code>ssl_protocols<\/code> ve <code>ssl_ciphers<\/code>: Yaln\u0131zca g\u00fcvenli ve modern SSL\/TLS protokollerini ve \u015fifreleme paketlerini kullan\u0131r. Eski ve zay\u0131f protokolleri (TLSv1.0, TLSv1.1) ve \u015fifreleri devre d\u0131\u015f\u0131 b\u0131rakmak g\u00fcvenlik i\u00e7in kritik \u00f6neme sahiptir.<br \/>\n*   <code>ssl_dhparam<\/code>: Daha \u00f6nce olu\u015fturdu\u011fumuz Diffie-Hellman parametre dosyas\u0131n\u0131 kullan\u0131r.<br \/>\n*   <code>ssl_stapling on;<\/code> ve ilgili direktifler: OCSP Stapling’i etkinle\u015ftirir. Bu, taray\u0131c\u0131lar\u0131n sertifika iptal durumunu do\u011frudan sunucudan almas\u0131n\u0131 sa\u011flayarak performans\u0131 art\u0131r\u0131r ve gizlili\u011fi iyile\u015ftirir.<br \/>\n*   <code>add_header Strict-Transport-Security ...<\/code>: HSTS (HTTP Strict Transport Security) ba\u015fl\u0131\u011f\u0131n\u0131 ekler. Bu, taray\u0131c\u0131lara belirli bir s\u00fcre boyunca (burada 2 y\u0131l) sitenize yaln\u0131zca HTTPS \u00fczerinden eri\u015fmeleri gerekti\u011fini bildirir. Bu, ilk HTTP iste\u011finde bile MITM sald\u0131r\u0131lar\u0131n\u0131 \u00f6nlemeye yard\u0131mc\u0131 olur. <code>preload<\/code> direktifi, sitenizi HSTS preload listesine eklemenizi sa\u011flar, ancak bunu yapmadan \u00f6nce HSTS’nin uzun vadeli etkilerini anlad\u0131\u011f\u0131n\u0131zdan emin olun.<\/p>\n<p>Yap\u0131land\u0131rma dosyas\u0131n\u0131 kaydettikten sonra, Nginx yap\u0131land\u0131rmas\u0131n\u0131 test edin ve yeniden y\u00fckleyin:<\/p>\n<pre><code class=\"language-bash\">sudo nginx -t\nsudo systemctl reload nginx<\/code><\/pre>\n<p>\u015eimdi taray\u0131c\u0131n\u0131zdan alan ad\u0131n\u0131z\u0131 <code>https:\/\/example.com<\/code> olarak ziyaret etti\u011finizde, sitenizin g\u00fcvenli bir ba\u011flant\u0131 \u00fczerinden \u00e7al\u0131\u015ft\u0131\u011f\u0131n\u0131 g\u00f6rmelisiniz.<\/p>\n<h3>Sertifika Yenileme \u0130\u015flemi<\/h3>\n<p>Let’s Encrypt sertifikalar\u0131 90 g\u00fcn boyunca ge\u00e7erlidir. Bu k\u0131sa s\u00fcre, g\u00fcvenlik a\u00e7\u0131klar\u0131n\u0131n ortaya \u00e7\u0131kmas\u0131 durumunda sertifikalar\u0131n h\u0131zl\u0131 bir \u015fekilde de\u011fi\u015ftirilebilmesini sa\u011flar. Ancak, bu ayn\u0131 zamanda sertifikalar\u0131n d\u00fczenli olarak yenilenmesi gerekti\u011fi anlam\u0131na gelir. Certbot, bu yenileme i\u015flemini otomatikle\u015ftirir.<\/p>\n<h4>Let’s Encrypt Sertifika \u00d6mr\u00fc<\/h4>\n<p>Certbot, sertifikalar\u0131n s\u00fcresi dolmadan \u00f6nce otomatik olarak yenilenmesini sa\u011flamak i\u00e7in bir <code>cron<\/code> i\u015fi veya <code>systemd<\/code> zamanlay\u0131c\u0131s\u0131 olu\u015fturur. Bu i\u015flem genellikle sertifikan\u0131n s\u00fcresi dolmadan 30 g\u00fcn \u00f6nce \u00e7al\u0131\u015f\u0131r.<\/p>\n<h4>Otomatik Yenileme<\/h4>\n<p><code>python-certbot-nginx<\/code> paketiyle Certbot’u kurdu\u011funuzda, otomatik yenileme i\u00e7in bir <code>systemd<\/code> zamanlay\u0131c\u0131s\u0131 veya <code>cron<\/code> i\u015fi otomatik olarak kurulur. Bu, genellikle g\u00fcnde iki kez \u00e7al\u0131\u015f\u0131r ve s\u00fcresi dolmak \u00fczere olan herhangi bir sertifikay\u0131 yeniler.<\/p>\n<p>Yenileme mekanizmas\u0131n\u0131n d\u00fczg\u00fcn \u00e7al\u0131\u015ft\u0131\u011f\u0131n\u0131 test etmek i\u00e7in a\u015fa\u011f\u0131daki komutu kullanabilirsiniz:<\/p>\n<pre><code class=\"language-bash\">sudo certbot renew --dry-run<\/code><\/pre>\n<p>Bu komut, ger\u00e7ek bir yenileme i\u015flemi yapmadan yenileme s\u00fcrecini sim\u00fcle eder. E\u011fer \u00e7\u0131kt\u0131 <code>Congratulations, all renewals passed the dry run.<\/code> benzeri bir mesaj i\u00e7eriyorsa, otomatik yenilemenin d\u00fczg\u00fcn \u00e7al\u0131\u015faca\u011f\u0131n\u0131 varsayabiliriz.<\/p>\n<p>Ger\u00e7ek bir yenileme i\u015flemi s\u0131ras\u0131nda Certbot, sertifikalar\u0131 ba\u015far\u0131yla yeniledikten sonra Nginx servisini otomatik olarak yeniden y\u00fckleyerek yeni sertifikalar\u0131n devreye girmesini sa\u011flar. Bu sayede manuel m\u00fcdahaleye gerek kalmaz.<\/p>\n<h3>G\u00fcvenli\u011fi Art\u0131r\u0131c\u0131 Ek Ad\u0131mlar<\/h3>\n<p>SSL\/TLS sertifikas\u0131 kurmak, web sitenizin g\u00fcvenli\u011fini sa\u011flaman\u0131n ilk ad\u0131m\u0131d\u0131r. Ancak, genel g\u00fcvenli\u011fi daha da art\u0131rmak i\u00e7in alabilece\u011finiz ek \u00f6nlemler vard\u0131r.<\/p>\n<h4>HSTS (HTTP Strict Transport Security) Uygulama<\/h4>\n<p>Daha \u00f6nce manuel yap\u0131land\u0131rma b\u00f6l\u00fcm\u00fcnde bahsetti\u011fimiz HSTS, taray\u0131c\u0131lara sitenize yaln\u0131zca HTTPS \u00fczerinden eri\u015fmeleri gerekti\u011fini bildiren bir g\u00fcvenlik mekanizmas\u0131d\u0131r. Bu, kullan\u0131c\u0131lar\u0131n yanl\u0131\u015fl\u0131kla HTTP s\u00fcr\u00fcm\u00fcne eri\u015fmesini veya bir sald\u0131rgan\u0131n onlar\u0131 HTTP’ye d\u00fc\u015f\u00fcrmesini engeller.<\/p>\n<p>Nginx sunucu blo\u011funuzun HTTPS k\u0131sm\u0131na (port 443 dinleyen blok) a\u015fa\u011f\u0131daki sat\u0131r\u0131 ekleyin:<\/p>\n<pre><code class=\"language-nginx\">add_header Strict-Transport-Security \"max-age=63072000; includeSubDomains; preload\";<\/code><\/pre>\n<p>*   <code>max-age<\/code>: Taray\u0131c\u0131n\u0131n bu kural\u0131 hat\u0131rlayaca\u011f\u0131 saniye cinsinden s\u00fcreyi belirtir (63072000 saniye = 2 y\u0131l).<br \/>\n*   <code>includeSubDomains<\/code>: T\u00fcm alt alan adlar\u0131n\u0131n da bu kurala tabi olmas\u0131n\u0131 sa\u011flar.<br \/>\n*   <code>preload<\/code>: Sitenizi HSTS preload listesine eklemek i\u00e7in bir iste\u011fe izin verir. Bu, sitenizin ziyaret edilmeden \u00f6nce bile taray\u0131c\u0131lar\u0131n HSTS’yi uygulamas\u0131n\u0131 sa\u011flar. Ancak, bu geri d\u00f6n\u00fc\u015f\u00fc olmayan bir ad\u0131md\u0131r ve dikkatli bir \u015fekilde d\u00fc\u015f\u00fcn\u00fclmelidir.<\/p>\n<h4>OCSP Stapling Etkinle\u015ftirme<\/h4>\n<p>OCSP (Online Certificate Status Protocol) Stapling, bir sunucunun kendi sertifikas\u0131n\u0131n iptal durumunu do\u011frudan sertifika yetkilisinden al\u0131p, bu bilgiyi istemcilere (taray\u0131c\u0131lara) TLS el s\u0131k\u0131\u015fmas\u0131 s\u0131ras\u0131nda sunmas\u0131d\u0131r. Bu, taray\u0131c\u0131lar\u0131n sertifika yetkilisine ayr\u0131 bir istek g\u00f6ndermesine gerek kalmad\u0131\u011f\u0131 i\u00e7in performans\u0131 art\u0131r\u0131r ve kullan\u0131c\u0131 gizlili\u011fini iyile\u015ftirir.<\/p>\n<p>HTTPS sunucu blo\u011funuza a\u015fa\u011f\u0131daki sat\u0131rlar\u0131 ekleyin (e\u011fer Certbot otomatik olarak eklemediyse):<\/p>\n<pre><code class=\"language-nginx\">ssl_stapling on;\nssl_stapling_verify on;\nssl_trusted_certificate \/etc\/letsencrypt\/live\/example.com\/chain.pem; # Let's Encrypt zincir sertifikas\u0131\nresolver 8.8.8.8 8.8.4.4 valid=300s; # G\u00fcvenilir DNS \u00e7\u00f6z\u00fcmleyicileri (Google DNS)\nresolver_timeout 5s;<\/code><\/pre>\n<p><code>ssl_trusted_certificate<\/code> direktifi, Certbot’un olu\u015fturdu\u011fu <code>chain.pem<\/code> dosyas\u0131n\u0131 i\u015faret etmelidir. <code>resolver<\/code> direktifi ise Nginx’in OCSP yan\u0131tlar\u0131n\u0131 alabilmesi i\u00e7in kullanaca\u011f\u0131 bir DNS sunucusunu belirtir.<\/p>\n<h4>SSL\/TLS Protokol ve \u015eifreleme Ayarlar\u0131<\/h4>\n<p>Daha \u00f6nce manuel yap\u0131land\u0131rmada verdi\u011fimiz SSL\/TLS ayarlar\u0131, g\u00fcncel g\u00fcvenlik standartlar\u0131n\u0131 kar\u015f\u0131lamak i\u00e7in tasarlanm\u0131\u015ft\u0131r. Ancak, bu ayarlar\u0131 anlamak ve gelecekteki g\u00fcvenlik geli\u015fmelerine g\u00f6re g\u00fcncellemek \u00f6nemlidir.<\/p>\n<p>*   <strong><code>ssl_protocols TLSv1.2 TLSv1.3;<\/code><\/strong>: Yaln\u0131zca TLSv1.2 ve TLSv1.3 gibi g\u00fc\u00e7l\u00fc ve modern protokolleri kullan\u0131n. TLSv1.0 ve TLSv1.1 gibi eski protokoller bilinen g\u00fcvenlik a\u00e7\u0131klar\u0131na sahiptir ve m\u00fcmk\u00fcnse devre d\u0131\u015f\u0131 b\u0131rak\u0131lmal\u0131d\u0131r.<br \/>\n*   <strong><code>ssl_ciphers '...'<\/code>: <\/strong> G\u00fcvenli ve modern \u015fifreleme paketlerini tercih edin. ECDHE ve DHE tabanl\u0131 \u015fifreler, Perfect Forward Secrecy (PFS) sa\u011flad\u0131klar\u0131 i\u00e7in \u00f6nerilir. AES-GCM ve ChaCha20-Poly1305 gibi modern \u015fifreleme algoritmalar\u0131n\u0131 kullan\u0131n.<br \/>\n*   <strong><code>ssl_prefer_server_ciphers on;<\/code><\/strong>: Sunucunun, istemcinin tercihleri yerine kendi \u015fifreleme paketi listesini kullanmas\u0131n\u0131 sa\u011flar. Bu, sunucunun her zaman en g\u00fcvenli \u015fifrelemeyi se\u00e7mesini garanti eder.<br \/>\n*   <strong><code>ssl_session_cache<\/code> ve <code>ssl_session_timeout<\/code><\/strong>: TLS oturumlar\u0131n\u0131 \u00f6nbelle\u011fe alarak sonraki ba\u011flant\u0131larda el s\u0131k\u0131\u015fma s\u00fcresini k\u0131salt\u0131r.<br \/>\n*   <strong><code>ssl_session_tickets off;<\/code><\/strong>: TLS oturum biletlerinin kullan\u0131m\u0131n\u0131 devre d\u0131\u015f\u0131 b\u0131rak\u0131r. Bu, baz\u0131 durumlarda g\u00fcvenlik zafiyetlerine yol a\u00e7abildi\u011fi i\u00e7in \u00f6nerilir.<\/p>\n<p>Bu ayarlar\u0131 Nginx ana yap\u0131land\u0131rma dosyan\u0131zdaki (<code>\/etc\/nginx\/nginx.conf<\/code> i\u00e7indeki <code>http<\/code> blo\u011fu) veya her sunucu blo\u011funuzdaki <code>server<\/code> blo\u011fu i\u00e7ine ekleyebilirsiniz.<\/p>\n<h4>Gereksiz Nginx Bilgilerini Gizleme<\/h4>\n<p>Nginx’in varsay\u0131lan olarak s\u00fcr\u00fcm numaras\u0131n\u0131 HTTP yan\u0131t ba\u015fl\u0131klar\u0131nda g\u00f6stermesini engellemek, olas\u0131 sald\u0131rganlar\u0131n sunucunuzdaki bilinen g\u00fcvenlik a\u00e7\u0131klar\u0131n\u0131 hedeflemesini zorla\u015ft\u0131rabilir.<\/p>\n<p><code>\/etc\/nginx\/nginx.conf<\/code> dosyas\u0131ndaki <code>http<\/code> blo\u011funa a\u015fa\u011f\u0131daki sat\u0131r\u0131 ekleyin:<\/p>\n<pre><code class=\"language-nginx\">server_tokens off;<\/code><\/pre>\n<p>Bu de\u011fi\u015fikli\u011fi yapt\u0131ktan sonra Nginx’i yeniden y\u00fcklemeyi unutmay\u0131n: <code>sudo systemctl reload nginx<\/code>.<\/p>\n<h4>G\u00fcncel Debian ve Nginx S\u00fcr\u00fcmlerini Kullanma<\/h4>\n<p>Bu rehber Debian 9 i\u00e7in yaz\u0131lm\u0131\u015f olsa da, genel bir en iyi uygulama olarak her zaman i\u015fletim sisteminizin ve kulland\u0131\u011f\u0131n\u0131z t\u00fcm yaz\u0131l\u0131mlar\u0131n (Nginx, Certbot vb.) en g\u00fcncel, desteklenen s\u00fcr\u00fcmlerini kullanman\u0131z \u015fiddetle tavsiye edilir. G\u00fcncel s\u00fcr\u00fcmler, bilinen g\u00fcvenlik a\u00e7\u0131klar\u0131na kar\u015f\u0131 yamalar, performans iyile\u015ftirmeleri ve yeni \u00f6zellikler i\u00e7erir. Debian 9 art\u0131k resmi olarak desteklenmemektedir, bu nedenle m\u00fcmk\u00fcnse daha yeni bir Debian s\u00fcr\u00fcm\u00fcne (\u00f6rne\u011fin Debian 11 veya 12) y\u00fckseltmeyi d\u00fc\u015f\u00fcnmelisiniz.<\/p>\n<h3>Kurulumu Test Etme<\/h3>\n<p>T\u00fcm yap\u0131land\u0131rmalar\u0131 tamamlad\u0131ktan sonra, web sitenizin g\u00fcvenli\u011fini ve performans\u0131n\u0131 test etmek \u00f6nemlidir.<\/p>\n<p>1.  <strong>Taray\u0131c\u0131dan Eri\u015fim:<\/strong> Alan ad\u0131n\u0131z\u0131 <code>https:\/\/example.com<\/code> olarak ziyaret edin. Taray\u0131c\u0131n\u0131z\u0131n adres \u00e7ubu\u011funda ye\u015fil bir kilit simgesi veya “G\u00fcvenli” ibaresi g\u00f6rmelisiniz. HTTP \u00fczerinden (<code>http:\/\/example.com<\/code>) eri\u015fmeye \u00e7al\u0131\u015ft\u0131\u011f\u0131n\u0131zda otomatik olarak HTTPS’ye y\u00f6nlendirildi\u011finizden emin olun.<br \/>\n2.  <strong>SSL Labs Testi:<\/strong> Qualys SSL Labs’\u0131n \u00fccretsiz SSL Sunucu Test arac\u0131n\u0131 kullanarak sunucunuzun SSL\/TLS yap\u0131land\u0131rmas\u0131n\u0131n kalitesini kontrol edebilirsiniz: <code>https:\/\/www.ssllabs.com\/ssltest\/<\/code>. Alan ad\u0131n\u0131z\u0131 girin ve testi \u00e7al\u0131\u015ft\u0131r\u0131n. \u0130yi yap\u0131land\u0131r\u0131lm\u0131\u015f bir sunucu genellikle “A” veya “A+” derecesi almal\u0131d\u0131r. Bu test, kulland\u0131\u011f\u0131n\u0131z protokolleri, \u015fifreleri, HSTS ve OCSP Stapling gibi ek g\u00fcvenlik \u00f6zelliklerini detayl\u0131 olarak raporlayacakt\u0131r.<br \/>\n3.  <strong>Certbot Yenileme Testi:<\/strong> Otomatik yenileme mekanizmas\u0131n\u0131n d\u00fczg\u00fcn \u00e7al\u0131\u015ft\u0131\u011f\u0131ndan emin olmak i\u00e7in daha \u00f6nce bahsetti\u011fimiz <code>sudo certbot renew --dry-run<\/code> komutunu d\u00fczenli olarak \u00e7al\u0131\u015ft\u0131rmay\u0131 d\u00fc\u015f\u00fcnebilirsiniz.<\/p>\n<p>Bu testler, yap\u0131land\u0131rman\u0131z\u0131n do\u011fru oldu\u011funu ve web sitenizin g\u00fcvenli bir \u015fekilde sunuldu\u011funu do\u011frulaman\u0131za yard\u0131mc\u0131 olacakt\u0131r.<\/p>\n<h3>Sonu\u00e7<\/h3>\n<p>Nginx’i Let’s Encrypt ile g\u00fcvenli hale getirmek, modern web siteleri i\u00e7in temel bir gerekliliktir. Bu makalede, Debian 9 i\u015fletim sistemi \u00fczerinde Nginx kurulumundan ba\u015flayarak, Let’s Encrypt sertifikalar\u0131n\u0131 Certbot arac\u0131l\u0131\u011f\u0131yla edinme, Nginx’i HTTPS trafi\u011fi i\u00e7in yap\u0131land\u0131rma ve otomatik yenileme s\u00fcre\u00e7lerini detayl\u0131 bir \u015fekilde inceledik. Ayr\u0131ca, HSTS, OCSP Stapling ve g\u00fc\u00e7l\u00fc SSL\/TLS \u015fifreleme ayarlar\u0131 gibi ek g\u00fcvenlik \u00f6nlemlerini de ele ald\u0131k.<\/p>\n<p>Bu ad\u0131mlar\u0131 takip ederek, web sitenizin g\u00fcvenli\u011fini art\u0131racak, kullan\u0131c\u0131lar\u0131n\u0131z\u0131n gizlili\u011fini koruyacak ve arama motoru s\u0131ralamalar\u0131n\u0131z \u00fczerinde olumlu bir etki yaratacaks\u0131n\u0131z. Unutmay\u0131n ki siber g\u00fcvenlik s\u00fcrekli geli\u015fen bir aland\u0131r; bu nedenle, sunucunuzu ve yaz\u0131l\u0131mlar\u0131n\u0131z\u0131 d\u00fczenli olarak g\u00fcncellemeli, g\u00fcvenlik yamalar\u0131n\u0131 uygulamal\u0131 ve en iyi uygulamalar\u0131 takip etmelisiniz. Bu rehber, Nginx tabanl\u0131 web sitenizi g\u00fcvenli bir ba\u015flang\u0131\u00e7 noktas\u0131na getirmenize yard\u0131mc\u0131 olacakt\u0131r.<\/body><\/p>\n","protected":false},"excerpt":{"rendered":"Nginx’i Debian 9 \u00dczerinde Let’s Encrypt ile G\u00fcvenli Hale Getirme\nG\u00fcn\u00fcm\u00fcz dijital d\u00fcnyas\u0131nda web sitelerinin g\u00fcvenli\u011fi, kullan\u0131c\u0131 gizlili\u011f","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"csco_page_header_type":"","csco_page_load_nextpost":"","csco_page_subscribe_form":"","csco_page_contact_form":"","footnotes":""},"categories":[241],"tags":[],"class_list":{"0":"post-35528","1":"post","2":"type-post","3":"status-publish","4":"format-standard","6":"category-linux","7":"cs-entry","8":"cs-video-wrap"},"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v20.5 (Yoast SEO v25.3.1) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Nginx'i Debian 9 \u00dczerinde Let's Encrypt ile G\u00fcvenli Hale Getirme - Kodlar\u0131n Gizemli D\u00fcnyas\u0131<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/fatihsoysal.com\/blog\/nginxi-debian-9-uzerinde-lets-encrypt-ile-guvenli-hale-getirme\/\" \/>\n<meta property=\"og:locale\" content=\"tr_TR\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Nginx'i Debian 9 \u00dczerinde Let's Encrypt ile G\u00fcvenli Hale Getirme\" \/>\n<meta property=\"og:description\" content=\"Nginx'i Debian 9 \u00dczerinde Let's Encrypt ile G\u00fcvenli Hale Getirme G\u00fcn\u00fcm\u00fcz dijital d\u00fcnyas\u0131nda web sitelerinin g\u00fcvenli\u011fi, kullan\u0131c\u0131 gizlili\u011f\" \/>\n<meta property=\"og:url\" content=\"https:\/\/fatihsoysal.com\/blog\/nginxi-debian-9-uzerinde-lets-encrypt-ile-guvenli-hale-getirme\/\" \/>\n<meta property=\"og:site_name\" content=\"Kodlar\u0131n Gizemli D\u00fcnyas\u0131\" \/>\n<meta property=\"article:published_time\" content=\"2025-11-30T16:40:57+00:00\" \/>\n<meta name=\"author\" content=\"Fatih Soysal\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Yazan:\" \/>\n\t<meta name=\"twitter:data1\" content=\"Fatih Soysal\" \/>\n\t<meta name=\"twitter:label2\" content=\"Tahmini okuma s\u00fcresi\" \/>\n\t<meta name=\"twitter:data2\" content=\"21 dakika\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/nginxi-debian-9-uzerinde-lets-encrypt-ile-guvenli-hale-getirme\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/nginxi-debian-9-uzerinde-lets-encrypt-ile-guvenli-hale-getirme\/\"},\"author\":{\"name\":\"Fatih Soysal\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"headline\":\"Nginx’i Debian 9 \u00dczerinde Let’s Encrypt ile G\u00fcvenli Hale Getirme\",\"datePublished\":\"2025-11-30T16:40:57+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/nginxi-debian-9-uzerinde-lets-encrypt-ile-guvenli-hale-getirme\/\"},\"wordCount\":3408,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"articleSection\":[\"Linux\"],\"inLanguage\":\"tr\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/fatihsoysal.com\/blog\/nginxi-debian-9-uzerinde-lets-encrypt-ile-guvenli-hale-getirme\/#respond\"]}],\"copyrightYear\":\"2025\",\"copyrightHolder\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#organization\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/nginxi-debian-9-uzerinde-lets-encrypt-ile-guvenli-hale-getirme\/\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/nginxi-debian-9-uzerinde-lets-encrypt-ile-guvenli-hale-getirme\/\",\"name\":\"Nginx'i Debian 9 \u00dczerinde Let's Encrypt ile G\u00fcvenli Hale Getirme - Kodlar\u0131n Gizemli D\u00fcnyas\u0131\",\"isPartOf\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#website\"},\"datePublished\":\"2025-11-30T16:40:57+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/nginxi-debian-9-uzerinde-lets-encrypt-ile-guvenli-hale-getirme\/#breadcrumb\"},\"inLanguage\":\"tr\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/fatihsoysal.com\/blog\/nginxi-debian-9-uzerinde-lets-encrypt-ile-guvenli-hale-getirme\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/nginxi-debian-9-uzerinde-lets-encrypt-ile-guvenli-hale-getirme\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Anasayfa\",\"item\":\"https:\/\/fatihsoysal.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Nginx’i Debian 9 \u00dczerinde Let’s Encrypt ile G\u00fcvenli Hale Getirme\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#website\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/\",\"name\":\"Fatihsoysal.com\",\"description\":\"Blog - Yaz\u0131l\u0131m D\u00fcnyas\u0131 Tecr\u00fcbelerim\",\"publisher\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/fatihsoysal.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"tr\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\",\"name\":\"Fatih Soysal\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"tr\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png\",\"contentUrl\":\"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png\",\"width\":512,\"height\":512,\"caption\":\"Fatih Soysal\"},\"logo\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/\"},\"description\":\"Kullan\u0131m ve kodlama m\u00fckemmeliyetini odak alan uygulamalar olu\u015fturma deneyimine sahip, profesyonel olarak 15+ y\u0131l \u00fczeri deneyime sahip bir yaz\u0131l\u0131m m\u00fchendisi.\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/author\/fatihsoysal\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Nginx'i Debian 9 \u00dczerinde Let's Encrypt ile G\u00fcvenli Hale Getirme - Kodlar\u0131n Gizemli D\u00fcnyas\u0131","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/fatihsoysal.com\/blog\/nginxi-debian-9-uzerinde-lets-encrypt-ile-guvenli-hale-getirme\/","og_locale":"tr_TR","og_type":"article","og_title":"Nginx'i Debian 9 \u00dczerinde Let's Encrypt ile G\u00fcvenli Hale Getirme","og_description":"Nginx'i Debian 9 \u00dczerinde Let's Encrypt ile G\u00fcvenli Hale Getirme G\u00fcn\u00fcm\u00fcz dijital d\u00fcnyas\u0131nda web sitelerinin g\u00fcvenli\u011fi, kullan\u0131c\u0131 gizlili\u011f","og_url":"https:\/\/fatihsoysal.com\/blog\/nginxi-debian-9-uzerinde-lets-encrypt-ile-guvenli-hale-getirme\/","og_site_name":"Kodlar\u0131n Gizemli D\u00fcnyas\u0131","article_published_time":"2025-11-30T16:40:57+00:00","author":"Fatih Soysal","twitter_card":"summary_large_image","twitter_misc":{"Yazan:":"Fatih Soysal","Tahmini okuma s\u00fcresi":"21 dakika"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/fatihsoysal.com\/blog\/nginxi-debian-9-uzerinde-lets-encrypt-ile-guvenli-hale-getirme\/#article","isPartOf":{"@id":"https:\/\/fatihsoysal.com\/blog\/nginxi-debian-9-uzerinde-lets-encrypt-ile-guvenli-hale-getirme\/"},"author":{"name":"Fatih Soysal","@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"headline":"Nginx’i Debian 9 \u00dczerinde Let’s Encrypt ile G\u00fcvenli Hale Getirme","datePublished":"2025-11-30T16:40:57+00:00","mainEntityOfPage":{"@id":"https:\/\/fatihsoysal.com\/blog\/nginxi-debian-9-uzerinde-lets-encrypt-ile-guvenli-hale-getirme\/"},"wordCount":3408,"commentCount":0,"publisher":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"articleSection":["Linux"],"inLanguage":"tr","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/fatihsoysal.com\/blog\/nginxi-debian-9-uzerinde-lets-encrypt-ile-guvenli-hale-getirme\/#respond"]}],"copyrightYear":"2025","copyrightHolder":{"@id":"https:\/\/fatihsoysal.com\/blog\/#organization"}},{"@type":"WebPage","@id":"https:\/\/fatihsoysal.com\/blog\/nginxi-debian-9-uzerinde-lets-encrypt-ile-guvenli-hale-getirme\/","url":"https:\/\/fatihsoysal.com\/blog\/nginxi-debian-9-uzerinde-lets-encrypt-ile-guvenli-hale-getirme\/","name":"Nginx'i Debian 9 \u00dczerinde Let's Encrypt ile G\u00fcvenli Hale Getirme - Kodlar\u0131n Gizemli D\u00fcnyas\u0131","isPartOf":{"@id":"https:\/\/fatihsoysal.com\/blog\/#website"},"datePublished":"2025-11-30T16:40:57+00:00","breadcrumb":{"@id":"https:\/\/fatihsoysal.com\/blog\/nginxi-debian-9-uzerinde-lets-encrypt-ile-guvenli-hale-getirme\/#breadcrumb"},"inLanguage":"tr","potentialAction":[{"@type":"ReadAction","target":["https:\/\/fatihsoysal.com\/blog\/nginxi-debian-9-uzerinde-lets-encrypt-ile-guvenli-hale-getirme\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/fatihsoysal.com\/blog\/nginxi-debian-9-uzerinde-lets-encrypt-ile-guvenli-hale-getirme\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Anasayfa","item":"https:\/\/fatihsoysal.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Nginx’i Debian 9 \u00dczerinde Let’s Encrypt ile G\u00fcvenli Hale Getirme"}]},{"@type":"WebSite","@id":"https:\/\/fatihsoysal.com\/blog\/#website","url":"https:\/\/fatihsoysal.com\/blog\/","name":"Fatihsoysal.com","description":"Blog - Yaz\u0131l\u0131m D\u00fcnyas\u0131 Tecr\u00fcbelerim","publisher":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/fatihsoysal.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"tr"},{"@type":["Person","Organization"],"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1","name":"Fatih Soysal","image":{"@type":"ImageObject","inLanguage":"tr","@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png","contentUrl":"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png","width":512,"height":512,"caption":"Fatih Soysal"},"logo":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/"},"description":"Kullan\u0131m ve kodlama m\u00fckemmeliyetini odak alan uygulamalar olu\u015fturma deneyimine sahip, profesyonel olarak 15+ y\u0131l \u00fczeri deneyime sahip bir yaz\u0131l\u0131m m\u00fchendisi.","url":"https:\/\/fatihsoysal.com\/blog\/author\/fatihsoysal\/"}]}},"yoast_meta":{"yoast_wpseo_title":"","yoast_wpseo_metadesc":"","yoast_wpseo_canonical":""},"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/35528","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/comments?post=35528"}],"version-history":[{"count":1,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/35528\/revisions"}],"predecessor-version":[{"id":35529,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/35528\/revisions\/35529"}],"wp:attachment":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/media?parent=35528"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/categories?post=35528"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/tags?post=35528"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}