{"id":36125,"date":"2025-12-08T16:40:51","date_gmt":"2025-12-08T13:40:51","guid":{"rendered":"https:\/\/fatihsoysal.com\/blog\/?p=36125"},"modified":"2025-12-08T16:40:51","modified_gmt":"2025-12-08T13:40:51","slug":"nginxi-rocky-linux-9-uzerinde-lets-encrypt-ile-guvenli-hale-getirme","status":"publish","type":"post","link":"https:\/\/fatihsoysal.com\/blog\/nginxi-rocky-linux-9-uzerinde-lets-encrypt-ile-guvenli-hale-getirme\/","title":{"rendered":"Nginx’i Rocky Linux 9 \u00dczerinde Let’s Encrypt ile G\u00fcvenli Hale Getirme"},"content":{"rendered":"

<\/p>\n

Nginx’i Rocky Linux 9 \u00dczerinde Let’s Encrypt ile G\u00fcvenli Hale Getirme<\/h2>\n

Rocky Linux 9, kararl\u0131 ve g\u00fcvenilir bir i\u015fletim sistemi platformu sunarken, Nginx ise y\u00fcksek performansl\u0131 ve esnek bir web sunucusu olarak modern web uygulamalar\u0131n\u0131n temelini olu\u015fturur. G\u00fcn\u00fcm\u00fczde internet g\u00fcvenli\u011fi, web siteleri ve uygulamalar\u0131 i\u00e7in vazge\u00e7ilmez bir \u00f6ncelik haline gelmi\u015ftir. Kullan\u0131c\u0131 verilerinin korunmas\u0131, arama motoru s\u0131ralamalar\u0131 ve genel kullan\u0131c\u0131 g\u00fcveni a\u00e7\u0131s\u0131ndan SSL\/TLS \u015fifrelemesi kritik bir rol oynamaktad\u0131r. Let’s Encrypt, bu \u015fifrelemeyi \u00fccretsiz, otomatik ve a\u00e7\u0131k bir sertifika yetkilisi (CA) arac\u0131l\u0131\u011f\u0131yla herkes i\u00e7in eri\u015filebilir k\u0131larak web g\u00fcvenli\u011finde devrim yaratm\u0131\u015ft\u0131r. Bu makalede, Nginx web sunucunuzu Rocky Linux 9 \u00fczerinde Let’s Encrypt ile nas\u0131l g\u00fcvenli hale getirece\u011finizi ad\u0131m ad\u0131m detayl\u0131 bir \u015fekilde inceleyece\u011fiz. Bu rehber, temel kurulumdan geli\u015fmi\u015f g\u00fcvenlik ayarlar\u0131na kadar t\u00fcm s\u00fcre\u00e7leri kapsayacakt\u0131r.<\/p>\n

Giri\u015f: Web G\u00fcvenli\u011finin \u00d6nemi ve Ara\u00e7lar\u0131m\u0131z<\/h3>\n

\u0130nternet \u00fczerindeki veri ak\u0131\u015f\u0131n\u0131n gizlili\u011fini ve b\u00fct\u00fcnl\u00fc\u011f\u00fcn\u00fc sa\u011flamak, g\u00fcn\u00fcm\u00fcz dijital d\u00fcnyas\u0131nda hayati bir zorunluluktur. SSL (Secure Sockets Layer) ve onun daha modern ve g\u00fcvenli halefi olan TLS (Transport Layer Security) protokolleri, istemci (taray\u0131c\u0131) ile sunucu aras\u0131ndaki ileti\u015fimi \u015fifreleyerek bu g\u00fcvenli\u011fi sa\u011flar. Bir web sitesi HTTPS (Hypertext Transfer Protocol Secure) kulland\u0131\u011f\u0131nda, taray\u0131c\u0131n\u0131n adres \u00e7ubu\u011funda genellikle bir kilit simgesi belirir ve bu, ba\u011flant\u0131n\u0131n g\u00fcvenli oldu\u011funu g\u00f6sterir. Bu durum, hassas bilgilerin (kullan\u0131c\u0131 adlar\u0131, \u015fifreler, kredi kart\u0131 bilgileri vb.) k\u00f6t\u00fc niyetli ki\u015filer taraf\u0131ndan ele ge\u00e7irilmesini engeller. Ayr\u0131ca, arama motorlar\u0131 (\u00f6zellikle Google), HTTPS kullanan siteleri s\u0131ralamada \u00f6nceliklendirme e\u011filimindedir, bu da SEO a\u00e7\u0131s\u0131ndan da bir avantaj sa\u011flar.<\/p>\n

Nginx, hafif yap\u0131s\u0131, y\u00fcksek e\u015fzamanl\u0131 ba\u011flant\u0131lar\u0131 i\u015fleme yetene\u011fi ve esnek yap\u0131land\u0131rma se\u00e7enekleri sayesinde d\u00fcnya genelinde en pop\u00fcler web sunucular\u0131ndan biridir. Ters proxy, y\u00fck dengeleyici ve HTTP \u00f6nbelle\u011fi olarak da kullan\u0131labilir. Rocky Linux 9, CentOS’un miras\u0131n\u0131 s\u00fcrd\u00fcren kurumsal d\u00fczeyde bir i\u015fletim sistemi olarak, kararl\u0131l\u0131k ve uzun s\u00fcreli destek sunar. Let’s Encrypt ise, Internet Security Research Group (ISRG) taraf\u0131ndan sa\u011flanan, web siteleri i\u00e7in \u00fccretsiz SSL\/TLS sertifikalar\u0131 sunan otomatik bir sertifika yetkilisidir. Certbot arac\u0131, Let’s Encrypt sertifikalar\u0131n\u0131n al\u0131nmas\u0131n\u0131 ve yenilenmesini b\u00fcy\u00fck \u00f6l\u00e7\u00fcde basitle\u015ftirir. Bu \u00fc\u00e7 g\u00fc\u00e7l\u00fc bile\u015feni bir araya getirerek, web sitenizi Rocky Linux 9 \u00fczerinde hem performansl\u0131 hem de g\u00fcvenli bir \u015fekilde bar\u0131nd\u0131rabilirsiniz.<\/p>\n

\u00d6n Ko\u015fullar<\/h3>\n

Bu rehbere ba\u015flamadan \u00f6nce, a\u015fa\u011f\u0131daki \u00f6n ko\u015fullar\u0131n yerine getirildi\u011finden emin olmal\u0131s\u0131n\u0131z:<\/p>\n

Rocky Linux 9 Kurulu Sunucu<\/h4>\n

* Rocky Linux 9 i\u015fletim sisteminin kurulu ve g\u00fcncel bir sunucusuna sahip olman\u0131z gerekmektedir. T\u00fcm paketlerin g\u00fcncel oldu\u011fundan emin olmak i\u00e7in a\u015fa\u011f\u0131daki komutu \u00e7al\u0131\u015ft\u0131r\u0131n:<\/p>\n

sudo dnf update -y<\/code><\/pre>\n
Root veya Sudo Ayr\u0131cal\u0131klar\u0131na Sahip Kullan\u0131c\u0131<\/h4>\n
*   Sunucunuzda root kullan\u0131c\u0131s\u0131 olarak veya sudo<\/code> ayr\u0131cal\u0131klar\u0131na sahip bir kullan\u0131c\u0131 olarak oturum a\u00e7m\u0131\u015f olman\u0131z gerekmektedir. Bu rehberdeki t\u00fcm komutlar, aksi belirtilmedik\u00e7e, sudo<\/code> ile \u00e7al\u0131\u015ft\u0131r\u0131lacakt\u0131r.<\/p>\n
Alan Ad\u0131 (Domain Name) ve DNS Yap\u0131land\u0131rmas\u0131<\/h4>\n
*   Web siteniz i\u00e7in kay\u0131tl\u0131 bir alan ad\u0131na (\u00f6rne\u011fin, example.com<\/code>) sahip olmal\u0131s\u0131n\u0131z.
\n*   Alan ad\u0131n\u0131z\u0131n DNS kay\u0131tlar\u0131n\u0131n (A veya AAAA kay\u0131tlar\u0131), sunucunuzun genel IP adresine do\u011fru \u015fekilde i\u015faret etti\u011finden emin olun. Let’s Encrypt sertifika do\u011frulama s\u00fcrecinde bu kay\u0131tlar\u0131 kullanacakt\u0131r. \u00d6rne\u011fin, example.com<\/code> ve www.example.com<\/code> adreslerinin sunucunuzun IP adresine y\u00f6nlendirilmesi gerekmektedir. DNS de\u011fi\u015fikliklerinin yay\u0131lmas\u0131 biraz zaman alabilir (genellikle birka\u00e7 dakika ile birka\u00e7 saat aras\u0131nda).<\/p>\n
Nginx’in Kurulu ve \u00c7al\u0131\u015f\u0131r Durumda Olmas\u0131<\/h4>\n
*   Nginx web sunucusunun sunucunuzda kurulu ve yap\u0131land\u0131r\u0131lm\u0131\u015f olmas\u0131 gerekmektedir. E\u011fer Nginx kurulu de\u011filse, sonraki ad\u0131mlarda kurulumunu ger\u00e7ekle\u015ftirece\u011fiz.
\n*   Nginx’in varsay\u0131lan HTTP (80) portunda web sitenizi ba\u015far\u0131yla sunabiliyor olmas\u0131 gerekmektedir.<\/p>\n
G\u00fcvenlik Duvar\u0131 (Firewall) Ayarlar\u0131<\/h4>\n
*   Sunucunuzun g\u00fcvenlik duvar\u0131n\u0131n (firewalld), HTTP (80) ve HTTPS (443) portlar\u0131na gelen trafi\u011fe izin verdi\u011finden emin olun. Let’s Encrypt, sertifika do\u011frulama i\u00e7in 80 numaral\u0131 portu kullan\u0131r, HTTPS ise 443 numaral\u0131 port \u00fczerinden hizmet verir.<\/p>\n
Ad\u0131m 1: Nginx Kurulumu ve Temel Yap\u0131land\u0131rma (Gerekliyse)<\/h3>\n
E\u011fer Nginx sunucunuzda kurulu de\u011filse, bu ad\u0131m\u0131 takip ederek kurulumunu ve temel yap\u0131land\u0131rmas\u0131n\u0131 yapabilirsiniz. Zaten kuruluysa, bu ad\u0131m\u0131 atlayabilirsiniz.<\/p>\n
Nginx’in Kurulu Olup Olmad\u0131\u011f\u0131n\u0131 Kontrol Etme<\/h4>\n
Nginx’in sisteminizde kurulu olup olmad\u0131\u011f\u0131n\u0131 kontrol etmek i\u00e7in a\u015fa\u011f\u0131daki komutu kullan\u0131n:<\/p>\n
sudo systemctl status nginx<\/code><\/pre>\n
E\u011fer Nginx kurulu de\u011filse veya \u00e7al\u0131\u015fm\u0131yorsa, \u00e7\u0131kt\u0131da bir hata mesaj\u0131 veya “Unit nginx.service could not be found.” gibi bir ifade g\u00f6receksiniz.<\/p>\n
Nginx Kurulumu<\/h4>\n
Rocky Linux 9’da Nginx, varsay\u0131lan DNF (Dandified YUM) depolar\u0131nda mevcuttur.<\/p>\n
sudo dnf install nginx -y<\/code><\/pre>\n
Kurulum tamamland\u0131ktan sonra, Nginx servisini ba\u015flat\u0131n ve sistem ba\u015flang\u0131c\u0131nda otomatik olarak \u00e7al\u0131\u015facak \u015fekilde etkinle\u015ftirin:<\/p>\n
sudo systemctl start nginx\nsudo systemctl enable nginx<\/code><\/pre>\n
\u015eimdi Nginx’in durumunu tekrar kontrol ederek \u00e7al\u0131\u015ft\u0131\u011f\u0131ndan emin olun:<\/p>\n
sudo systemctl status nginx<\/code><\/pre>\n
\u00c7\u0131kt\u0131da “active (running)” ifadesini g\u00f6rmelisiniz.<\/p>\n
G\u00fcvenlik Duvar\u0131 Ayarlar\u0131 (Firewalld)<\/h4>\n
Rocky Linux 9, varsay\u0131lan olarak firewalld<\/code> g\u00fcvenlik duvar\u0131n\u0131 kullan\u0131r. Nginx’in d\u0131\u015far\u0131dan eri\u015filebilir olmas\u0131 i\u00e7in HTTP ve HTTPS portlar\u0131n\u0131 g\u00fcvenlik duvar\u0131nda a\u00e7man\u0131z gerekir.<\/p>\n
sudo firewall-cmd --permanent --add-service=http\nsudo firewall-cmd --permanent --add-service=https\nsudo firewall-cmd --reload<\/code><\/pre>\n
Bu komutlar, HTTP (port 80) ve HTTPS (port 443) servislerine kal\u0131c\u0131 olarak izin verir ve de\u011fi\u015fiklikleri etkinle\u015ftirmek i\u00e7in g\u00fcvenlik duvar\u0131n\u0131 yeniden y\u00fckler.<\/p>\n
Basit Bir Nginx Sunucu Blo\u011fu Olu\u015fturma (HTTP i\u00e7in)<\/h4>\n
Let’s Encrypt sertifikas\u0131 almadan \u00f6nce, Nginx’in alan ad\u0131n\u0131z i\u00e7in do\u011fru \u015fekilde yap\u0131land\u0131r\u0131ld\u0131\u011f\u0131ndan ve HTTP \u00fczerinden hizmet verdi\u011finden emin olmal\u0131s\u0131n\u0131z. Nginx yap\u0131land\u0131rma dosyalar\u0131 genellikle \/etc\/nginx\/nginx.conf<\/code> ana dosyas\u0131nda veya \/etc\/nginx\/conf.d\/<\/code> dizinindeki .conf<\/code> uzant\u0131l\u0131 dosyalarda bulunur.<\/p>\n
Yeni bir sunucu blo\u011fu olu\u015fturmak i\u00e7in \/etc\/nginx\/conf.d\/<\/code> dizininde alan ad\u0131n\u0131zla ilgili bir dosya olu\u015fturun, \u00f6rne\u011fin example.com.conf<\/code>:<\/p>\n
sudo nano \/etc\/nginx\/conf.d\/example.com.conf<\/code><\/pre>\n
Dosyan\u0131n i\u00e7ine a\u015fa\u011f\u0131daki temel HTTP yap\u0131land\u0131rmas\u0131n\u0131 ekleyin (kendi alan ad\u0131n\u0131zla de\u011fi\u015ftirin):<\/p>\n
server {\n    listen 80;\n    listen [::]:80;\n    server_name example.com www.example.com;\n    root \/usr\/share\/nginx\/html; # veya web sitenizin dosyalar\u0131n\u0131n bulundu\u011fu dizin\n    index index.html index.htm;\n\n    location \/ {\n        try_files $uri $uri\/ =404;\n    }\n}<\/code><\/pre>\n
*   listen 80;<\/code>: Nginx’in IPv4 \u00fczerinden 80 numaral\u0131 portu dinlemesini sa\u011flar.
\n*   listen [::]:80;<\/code>: Nginx’in IPv6 \u00fczerinden 80 numaral\u0131 portu dinlemesini sa\u011flar.
\n*   server_name example.com www.example.com;<\/code>: Alan ad\u0131n\u0131z\u0131 ve iste\u011fe ba\u011fl\u0131 olarak “www” alt alan ad\u0131n\u0131z\u0131 belirtir.
\n*   root \/usr\/share\/nginx\/html;<\/code>: Web sitenizin k\u00f6k dizinini belirtir. Bu dizinde basit bir index.html<\/code> dosyas\u0131 olu\u015fturarak Nginx’in \u00e7al\u0131\u015ft\u0131\u011f\u0131n\u0131 test edebilirsiniz.
\n*   index index.html index.htm;<\/code>: Dizin istendi\u011finde aranacak varsay\u0131lan dosyalar\u0131 belirtir.
\n*   location \/ { ... }<\/code>: Gelen isteklerin nas\u0131l i\u015flenece\u011fini tan\u0131mlar. Bu \u00f6rnekte, dosya bulunamazsa 404 hatas\u0131 d\u00f6nd\u00fcr\u00fcr.<\/p>\n
Basit bir index.html<\/code> dosyas\u0131 olu\u015fturarak test edebilirsiniz:<\/p>\n
echo \"\" | sudo tee \/usr\/share\/nginx\/html\/index.html<\/code><\/pre>\n
Nginx Yap\u0131land\u0131rmas\u0131n\u0131 Test Etme ve Yeniden Y\u00fckleme<\/h4>\n
Yap\u0131land\u0131rma dosyas\u0131nda herhangi bir hata olup olmad\u0131\u011f\u0131n\u0131 kontrol etmek i\u00e7in:<\/p>\n
sudo nginx -t<\/code><\/pre>\n
E\u011fer “test is successful” mesaj\u0131n\u0131 g\u00f6r\u00fcrseniz, Nginx yap\u0131land\u0131rmas\u0131n\u0131 yeniden y\u00fckleyerek de\u011fi\u015fiklikleri uygulay\u0131n:<\/p>\n
sudo systemctl reload nginx<\/code><\/pre>\n
\u015eimdi bir web taray\u0131c\u0131s\u0131 a\u00e7\u0131n ve alan ad\u0131n\u0131za (\u00f6rne\u011fin, http:\/\/example.com<\/code>) giderek Nginx’in HTTP \u00fczerinden d\u00fczg\u00fcn \u00e7al\u0131\u015ft\u0131\u011f\u0131n\u0131 do\u011frulay\u0131n. Web sayfan\u0131z\u0131 g\u00f6rmelisiniz.<\/p>\n
Ad\u0131m 2: Certbot Kurulumu<\/h3>\n
Certbot, Let’s Encrypt sertifikalar\u0131n\u0131 almay\u0131 ve y\u00f6netmeyi kolayla\u015ft\u0131ran bir istemci yaz\u0131l\u0131m\u0131d\u0131r. Rocky Linux 9 \u00fczerinde Certbot’u kurmak i\u00e7in EPEL (Extra Packages for Enterprise Linux) deposunu etkinle\u015ftirmemiz gerekebilir.<\/p>\n
EPEL Deposunu Etkinle\u015ftirme<\/h4>\n
EPEL deposu, RHEL tabanl\u0131 sistemler i\u00e7in ek paketler sa\u011flar. Certbot genellikle bu depoda bulunur.<\/p>\n
sudo dnf install epel-release -y<\/code><\/pre>\n
Depo etkinle\u015ftirildikten sonra, sistem paket listesini g\u00fcncelleyin:<\/p>\n
sudo dnf update -y<\/code><\/pre>\n
Certbot ve Nginx Eklentisini Kurma<\/h4>\n
\u015eimdi Certbot’u ve Nginx ile entegrasyonu sa\u011flayan python3-certbot-nginx<\/code> eklentisini kurun:<\/p>\n
sudo dnf install certbot python3-certbot-nginx -y<\/code><\/pre>\n
Bu komut, Certbot’un kendisini ve Nginx yap\u0131land\u0131rmas\u0131n\u0131 otomatik olarak d\u00fczenlemesine olanak tan\u0131yan eklentiyi y\u00fckleyecektir.<\/p>\n
Ad\u0131m 3: SSL Sertifikas\u0131 Alma<\/h3>\n
Certbot’u kurduktan sonra, Let’s Encrypt’ten SSL sertifikas\u0131 almak i\u00e7in kullanabiliriz. Certbot’un Nginx eklentisi, bu s\u00fcreci b\u00fcy\u00fck \u00f6l\u00e7\u00fcde otomatikle\u015ftirir.<\/p>\n
Certbot ile Sertifika Alma Komutu<\/h4>\n
A\u015fa\u011f\u0131daki komutu kullanarak Certbot’u \u00e7al\u0131\u015ft\u0131r\u0131n. example.com<\/code> ve www.example.com<\/code> yerine kendi alan adlar\u0131n\u0131z\u0131 girin:<\/p>\n
sudo certbot --nginx -d example.com -d www.example.com<\/code><\/pre>\n
Bu komutu \u00e7al\u0131\u015ft\u0131rd\u0131\u011f\u0131n\u0131zda, Certbot sizi bir dizi soruyla y\u00f6nlendirecektir:<\/p>\n
1.  E-posta Adresi:<\/strong> Let’s Encrypt’ten \u00f6nemli bildirimler (\u00f6rne\u011fin, sertifika yenileme hat\u0131rlat\u0131c\u0131lar\u0131) almak i\u00e7in ge\u00e7erli bir e-posta adresi girmeniz istenecektir.
\n2.  Hizmet \u015eartlar\u0131:<\/strong> Let’s Encrypt’in hizmet \u015fartlar\u0131n\u0131 kabul etmeniz gerekecektir. Okuyup onaylay\u0131n.
\n3.  EFF (Electronic Frontier Foundation) Haber B\u00fclteni:<\/strong> \u0130ste\u011fe ba\u011fl\u0131 olarak EFF haber b\u00fcltenine abone olup olmak istemedi\u011finiz sorulacakt\u0131r.
\n4.  Nginx Yap\u0131land\u0131rmas\u0131:<\/strong> Certbot, Nginx yap\u0131land\u0131rman\u0131z\u0131 analiz edecek ve hangi server<\/code> bloklar\u0131n\u0131n alan adlar\u0131n\u0131zla e\u015fle\u015fti\u011fini bulacakt\u0131r. Genellikle, do\u011fru server_name<\/code> direktifini i\u00e7eren server<\/code> blo\u011funu otomatik olarak alg\u0131lar.
\n5.  HTTP’den HTTPS’ye Y\u00f6nlendirme:<\/strong> Certbot, HTTP trafi\u011fini otomatik olarak HTTPS’ye y\u00f6nlendirip y\u00f6nlendirmeyece\u011finizi soracakt\u0131r. “2: Redirect”<\/strong> se\u00e7ene\u011fini se\u00e7meniz \u015fiddetle tavsiye edilir. Bu, sitenize HTTP \u00fczerinden gelen t\u00fcm isteklerin g\u00fcvenli HTTPS ba\u011flant\u0131s\u0131na y\u00f6nlendirilmesini sa\u011flar.<\/p>\n
T\u00fcm sorular\u0131 yan\u0131tlad\u0131ktan sonra, Certbot alan adlar\u0131n\u0131z i\u00e7in bir sertifika alacak, Nginx yap\u0131land\u0131rman\u0131z\u0131 g\u00fcncelleyecek ve HTTP’den HTTPS’ye y\u00f6nlendirmeyi ayarlayacakt\u0131r. Ba\u015far\u0131l\u0131 bir kurulumun ard\u0131ndan a\u015fa\u011f\u0131daki gibi bir \u00e7\u0131kt\u0131 g\u00f6rmelisiniz:<\/p>\n
Successfully received certificate.\nSuccessfully deployed certificate for example.com to \/etc\/nginx\/conf.d\/example.com.conf\nSuccessfully deployed certificate for www.example.com to \/etc\/nginx\/conf.d\/example.com.conf\nCongratulations! You have successfully enabled HTTPS on https:\/\/example.com and https:\/\/www.example.com\n\nIMPORTANT NOTES:\n - Congratulations! Your certificate and chain have been saved at:\n   \/etc\/letsencrypt\/live\/example.com\/fullchain.pem\n   Your key file has been saved at:\n   \/etc\/letsencrypt\/live\/example.com\/privkey.pem\n   Your certificate will expire on 2024-XX-XX. To obtain a new or\n   tweaked version of this certificate in the future, simply run\n   certbot renew\n   ...<\/code><\/pre>\n
Bu \u00e7\u0131kt\u0131, sertifikan\u0131z\u0131n ba\u015far\u0131yla al\u0131nd\u0131\u011f\u0131n\u0131 ve Nginx’e da\u011f\u0131t\u0131ld\u0131\u011f\u0131n\u0131 g\u00f6sterir. Sertifika dosyalar\u0131n\u0131n nerede sakland\u0131\u011f\u0131n\u0131 ve son kullanma tarihini de belirtir.<\/p>\n
Ad\u0131m 4: Nginx Yap\u0131land\u0131rmas\u0131n\u0131 Do\u011frulama<\/h3>\n
Certbot’un Nginx yap\u0131land\u0131rman\u0131zda yapt\u0131\u011f\u0131 de\u011fi\u015fiklikleri kontrol etmek ve sitenizin art\u0131k HTTPS \u00fczerinden eri\u015filebilir oldu\u011funu do\u011frulamak \u00f6nemlidir.<\/p>\n
Certbot’un Yapt\u0131\u011f\u0131 De\u011fi\u015fiklikleri Kontrol Etme<\/h4>\n
Certbot, \/etc\/nginx\/conf.d\/example.com.conf<\/code> dosyan\u0131z\u0131 veya ilgili server<\/code> blo\u011funuzu otomatik olarak g\u00fcncelleyecektir. Dosyay\u0131 a\u00e7arak de\u011fi\u015fiklikleri inceleyebilirsiniz:<\/p>\n
sudo nano \/etc\/nginx\/conf.d\/example.com.conf<\/code><\/pre>\n
A\u015fa\u011f\u0131daki gibi bir yap\u0131land\u0131rma g\u00f6rmelisiniz:<\/p>\n
server {\n    listen 80;\n    listen [::]:80;\n    server_name example.com www.example.com;\n    return 301 https:\/\/$host$request_uri; # HTTP'den HTTPS'ye y\u00f6nlendirme\n}\n\nserver {\n    listen 443 ssl http2; # HTTP\/2 deste\u011fi eklenebilir\n    listen [::]:443 ssl http2;\n    server_name example.com www.example.com;\n\n    ssl_certificate \/etc\/letsencrypt\/live\/example.com\/fullchain.pem;\n    ssl_certificate_key \/etc\/letsencrypt\/live\/example.com\/privkey.pem;\n    include \/etc\/letsencrypt\/options-ssl-nginx.conf;\n    ssl_dhparam \/etc\/letsencrypt\/ssl-dhparams.pem; # DH parametresi\n\n    root \/usr\/share\/nginx\/html;\n    index index.html index.htm;\n\n    location \/ {\n        try_files $uri $uri\/ =404;\n    }\n}<\/code><\/pre>\n
G\u00f6rd\u00fc\u011f\u00fcn\u00fcz gibi, Certbot iki server<\/code> blo\u011fu olu\u015fturmu\u015ftur:
\n1.  \u0130lk blok, 80 numaral\u0131 porttan gelen t\u00fcm HTTP isteklerini 301 kal\u0131c\u0131 y\u00f6nlendirmesiyle HTTPS’ye y\u00f6nlendirir.
\n2.  \u0130kinci blok, 443 numaral\u0131 portta HTTPS trafi\u011fini dinler, Let’s Encrypt sertifika ve anahtar dosyalar\u0131n\u0131 kullan\u0131r ve Certbot taraf\u0131ndan olu\u015fturulan ek SSL ayarlar\u0131n\u0131 (options-ssl-nginx.conf<\/code>) i\u00e7erir.<\/p>\n
Taray\u0131c\u0131dan Eri\u015fimi Kontrol Etme<\/h4>\n
Bir web taray\u0131c\u0131s\u0131 a\u00e7\u0131n ve alan ad\u0131n\u0131za https:\/\/example.com<\/code> veya http:\/\/example.com<\/code> adresinden gitmeyi deneyin. Her iki durumda da sitenizin g\u00fcvenli HTTPS ba\u011flant\u0131s\u0131 \u00fczerinden y\u00fcklenmesi ve adres \u00e7ubu\u011funda bir kilit simgesi g\u00f6rmeniz gerekir.<\/p>\n
SSL Labs gibi Ara\u00e7larla Sertifika Kalitesini Test Etme<\/h4>\n
Sertifika kurulumunuzun ve SSL yap\u0131land\u0131rman\u0131z\u0131n ne kadar g\u00fcvenli oldu\u011funu anlamak i\u00e7in SSL Labs’\u0131n SSL Test arac\u0131n\u0131 kullanabilirsiniz. Taray\u0131c\u0131n\u0131zdan https:\/\/www.ssllabs.com\/ssltest\/<\/code> adresine gidin, alan ad\u0131n\u0131z\u0131 girin ve testi ba\u015flat\u0131n. Bu ara\u00e7, sertifika zincirini, protokol deste\u011fini, \u015fifreleme algoritmalar\u0131n\u0131 ve di\u011fer g\u00fcvenlik ayarlar\u0131n\u0131 analiz ederek size bir not (A+ en y\u00fcksek) verecektir.<\/p>\n
Ad\u0131m 5: Otomatik Yenileme<\/h3>\n
Let’s Encrypt sertifikalar\u0131 90 g\u00fcn ge\u00e7erlidir. Bu, g\u00fcvenlik a\u00e7\u0131s\u0131ndan iyi bir uygulama olsa da, sertifikalar\u0131n d\u00fczenli olarak yenilenmesi gerekti\u011fi anlam\u0131na gelir. Neyse ki, Certbot bu s\u00fcreci tamamen otomatikle\u015ftirir.<\/p>\n
Certbot’un Otomatik Yenileme Cron \u0130\u015fi<\/h4>\n
Certbot’u kurdu\u011funuzda, sisteminize otomatik olarak bir cron i\u015fi veya systemd zamanlay\u0131c\u0131s\u0131 eklenir. Bu i\u015f, sertifikalar\u0131n\u0131z\u0131n s\u00fcresi dolmadan \u00f6nce otomatik olarak yenilenmesini sa\u011flar. Genellikle g\u00fcnde iki kez \u00e7al\u0131\u015f\u0131r ve s\u00fcresi dolmak \u00fczere olan sertifikalar\u0131 kontrol eder. E\u011fer bir sertifikan\u0131n s\u00fcresi 30 g\u00fcn i\u00e7inde dolacaksa, Certbot onu yenilemeye \u00e7al\u0131\u015f\u0131r.<\/p>\n
Yenileme i\u015finin varl\u0131\u011f\u0131n\u0131 kontrol etmek i\u00e7in:<\/p>\n
sudo systemctl list-timers certbot*<\/code><\/pre>\n
veya cron i\u015fleri i\u00e7in:<\/p>\n
sudo cat \/etc\/crontab\nsudo ls \/etc\/cron.d\/<\/code><\/pre>\n
Genellikle certbot.timer<\/code> veya \/etc\/cron.d\/certbot<\/code> gibi bir giri\u015f g\u00f6rmelisiniz.<\/p>\n
Yenileme Test Etme Komutu<\/h4>\n
Otomatik yenileme s\u00fcrecinin d\u00fczg\u00fcn \u00e7al\u0131\u015f\u0131p \u00e7al\u0131\u015fmad\u0131\u011f\u0131n\u0131 test etmek i\u00e7in “dry run” modunu kullanabilirsiniz:<\/p>\n
sudo certbot renew --dry-run<\/code><\/pre>\n
Bu komut, ger\u00e7ek bir yenileme i\u015flemi yapmadan sertifikalar\u0131n ba\u015far\u0131yla yenilenip yenilenemeyece\u011fini sim\u00fcle eder. E\u011fer test ba\u015far\u0131l\u0131 olursa, \u00e7\u0131kt\u0131da “The dry run was successful.” mesaj\u0131n\u0131 g\u00f6rmelisiniz. Herhangi bir hata durumunda, sorun giderme i\u00e7in \u00e7\u0131kt\u0131y\u0131 dikkatlice inceleyin.<\/p>\n
Yenileme Sonras\u0131 Nginx’in Yeniden Y\u00fcklenmesini Sa\u011flama<\/h4>\n
Certbot’un Nginx eklentisi kullan\u0131ld\u0131\u011f\u0131nda, sertifika yenileme i\u015flemi ba\u015far\u0131l\u0131 oldu\u011funda Nginx servisini otomatik olarak yeniden y\u00fckler veya yeniden ba\u015flat\u0131r. Bu, Nginx’in yeni sertifikalar\u0131 hemen kullanmaya ba\u015flamas\u0131n\u0131 sa\u011flar. Bu nedenle, genellikle ek bir yap\u0131land\u0131rmaya gerek yoktur.<\/p>\n
Ad\u0131m 6: Ek G\u00fcvenlik Ayarlar\u0131 (\u0130ste\u011fe Ba\u011fl\u0131 ama \u00d6nemli)<\/h3>\n
Nginx ve Let’s Encrypt ile temel g\u00fcvenli\u011fi sa\u011flad\u0131ktan sonra, web sunucunuzun g\u00fcvenli\u011fini daha da art\u0131rmak i\u00e7in baz\u0131 ek yap\u0131land\u0131rmalar yapman\u0131z \u00f6nerilir. Bu ayarlar, sitenizin SSL Labs notunu y\u00fckseltmenize ve daha sa\u011flam bir g\u00fcvenlik duru\u015fu sergilemenize yard\u0131mc\u0131 olacakt\u0131r.<\/p>\n
Bu ayarlar genellikle Certbot taraf\u0131ndan olu\u015fturulan \/etc\/letsencrypt\/options-ssl-nginx.conf<\/code> dosyas\u0131nda bulunur veya Nginx sunucu blo\u011funuza do\u011frudan eklenebilir.<\/p>\n
sudo nano \/etc\/nginx\/conf.d\/example.com.conf<\/code><\/pre>\n
veya<\/p>\n
sudo nano \/etc\/letsencrypt\/options-ssl-nginx.conf<\/code><\/pre>\n
HTTP Strict Transport Security (HSTS)<\/h4>\n
HSTS, taray\u0131c\u0131lara web sitenize her zaman HTTPS \u00fczerinden ba\u011flanmalar\u0131n\u0131 s\u00f6yleyen bir g\u00fcvenlik politikas\u0131 mekanizmas\u0131d\u0131r. Bu, kullan\u0131c\u0131lar\u0131n yanl\u0131\u015fl\u0131kla veya k\u00f6t\u00fc niyetli bir sald\u0131r\u0131 sonucunda sitenizin \u015fifrelenmemi\u015f HTTP s\u00fcr\u00fcm\u00fcne eri\u015fmesini \u00f6nler.<\/p>\n
Nginx yap\u0131land\u0131rman\u0131za HSTS ba\u015fl\u0131\u011f\u0131n\u0131 eklemek i\u00e7in server<\/code> blo\u011funuzun listen 443 ssl;<\/code> k\u0131sm\u0131na a\u015fa\u011f\u0131daki sat\u0131r\u0131 ekleyin:<\/p>\n
add_header Strict-Transport-Security \"max-age=63072000; includeSubDomains; preload\";<\/code><\/pre>\n
*   max-age<\/code>: Taray\u0131c\u0131n\u0131n bu politikay\u0131 ne kadar s\u00fcreyle hat\u0131rlayaca\u011f\u0131n\u0131 saniye cinsinden belirtir (63072000 saniye = 2 y\u0131l).
\n*   includeSubDomains<\/code>: Bu politikan\u0131n t\u00fcm alt alan adlar\u0131 i\u00e7in de ge\u00e7erli olmas\u0131n\u0131 sa\u011flar.
\n*   preload<\/code>: Sitenizin HSTS \u00f6n y\u00fckleme listesine eklenmesine izin verir. Bu liste, taray\u0131c\u0131lar\u0131n sitenize ilk ba\u011flant\u0131lar\u0131nda bile HTTPS kullanmas\u0131n\u0131 sa\u011flar. \u00d6n y\u00fckleme i\u00e7in https:\/\/hstspreload.org\/<\/code> adresini ziyaret edebilirsiniz.<\/p>\n
\u00d6nemli:<\/strong> HSTS’yi etkinle\u015ftirmeden \u00f6nce t\u00fcm alt alan adlar\u0131n\u0131z\u0131n da HTTPS \u00fczerinden eri\u015filebilir oldu\u011fundan emin olun, aksi takdirde eri\u015fim sorunlar\u0131 ya\u015fanabilir.<\/p>\n
OCSP Stapling<\/h4>\n
OCSP (Online Certificate Status Protocol) Stapling, bir sunucunun kendi sertifikas\u0131n\u0131n ge\u00e7erlili\u011fini do\u011frulayan bir OCSP yan\u0131t\u0131n\u0131 do\u011frudan istemciye (taray\u0131c\u0131ya) g\u00f6ndermesini sa\u011flayan bir mekanizmad\u0131r. Bu, taray\u0131c\u0131n\u0131n sertifika yetkilisine (CA) ayr\u0131 bir istek g\u00f6ndermesine gerek kalmadan sertifika durumunu h\u0131zl\u0131 bir \u015fekilde do\u011frulamas\u0131na olanak tan\u0131r, b\u00f6ylece gizlilik artar ve ba\u011flant\u0131 h\u0131z\u0131 iyile\u015fir.<\/p>\n
OCSP Stapling’i etkinle\u015ftirmek i\u00e7in Nginx yap\u0131land\u0131rman\u0131za (genellikle 443 portunu dinleyen server<\/code> blo\u011funun i\u00e7ine) a\u015fa\u011f\u0131daki sat\u0131rlar\u0131 ekleyin:<\/p>\n
ssl_stapling on;\nssl_stapling_verify on;\nssl_trusted_certificate \/etc\/letsencrypt\/live\/example.com\/chain.pem; # CA zincir dosyas\u0131\nresolver 8.8.8.8 8.8.4.4 valid=300s; # G\u00fcvenilir bir DNS \u00e7\u00f6z\u00fcmleyici\nresolver_timeout 5s;<\/code><\/pre>\n
*   ssl_stapling on;<\/code>: OCSP Stapling’i etkinle\u015ftirir.
\n*   ssl_stapling_verify on;<\/code>: OCSP yan\u0131t\u0131n\u0131n ge\u00e7erlili\u011fini do\u011frular.
\n*   ssl_trusted_certificate<\/code>: CA zincir dosyas\u0131n\u0131n yolunu belirtir. Let’s Encrypt i\u00e7in bu genellikle chain.pem<\/code> dosyas\u0131d\u0131r.
\n*   resolver<\/code>: Nginx’in OCSP sunucusunun IP adresini \u00e7\u00f6z\u00fcmlemek i\u00e7in kullanaca\u011f\u0131 DNS sunucular\u0131n\u0131 belirtir. Google DNS (8.8.8.8, 8.8.4.4) yayg\u0131n olarak kullan\u0131l\u0131r.<\/p>\n
G\u00fc\u00e7l\u00fc \u015eifreleme Algoritmalar\u0131 ve TLS Protokolleri<\/h4>\n
Zay\u0131f veya eski \u015fifreleme algoritmalar\u0131 ve TLS protokolleri, sald\u0131r\u0131lara kar\u015f\u0131 sitenizi savunmas\u0131z b\u0131rakabilir. Yaln\u0131zca modern ve g\u00fcvenli TLS protokollerini (TLSv1.2 ve TLSv1.3) kullanmal\u0131 ve g\u00fc\u00e7l\u00fc \u015fifreleme paketlerini tercih etmelisiniz.<\/p>\n
Certbot’un varsay\u0131lan options-ssl-nginx.conf<\/code> dosyas\u0131 genellikle iyi bir ba\u015flang\u0131\u00e7 noktas\u0131 sunar. Ancak, bunu daha da optimize edebilirsiniz.<\/p>\n
ssl_protocols TLSv1.2 TLSv1.3;\nssl_prefer_server_ciphers on;\nssl_ciphers \"ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384\";\nssl_session_timeout 1d;\nssl_session_cache shared:SSL:10m;\nssl_session_tickets off;<\/code><\/pre>\n
*   ssl_protocols<\/code>: Yaln\u0131zca TLSv1.2 ve TLSv1.3’\u00fc etkinle\u015ftirir. TLSv1.0 ve TLSv1.1 gibi eski protokolleri devre d\u0131\u015f\u0131 b\u0131rak\u0131r.
\n*   ssl_prefer_server_ciphers on;<\/code>: Sunucunun kendi \u015fifreleme tercihlerini kullanmas\u0131n\u0131 sa\u011flar.
\n*   ssl_ciphers<\/code>: G\u00fc\u00e7l\u00fc ve modern \u015fifreleme paketlerini listeler. Bu liste zamanla de\u011fi\u015febilir, bu y\u00fczden en g\u00fcncel tavsiyeler i\u00e7in Mozilla SSL Configuration Generator gibi kaynaklar\u0131 kontrol etmek iyi bir fikirdir.
\n*   ssl_session_timeout<\/code>: SSL oturum \u00f6nbelle\u011finin zaman a\u015f\u0131m\u0131n\u0131 ayarlar.
\n*   ssl_session_cache<\/code>: SSL oturumlar\u0131n\u0131 \u00f6nbelle\u011fe almak i\u00e7in payla\u015f\u0131lan bir \u00f6nbellek tan\u0131mlar.
\n*   ssl_session_tickets off;<\/code>: G\u00fcvenlik nedenleriyle SSL oturum biletlerini devre d\u0131\u015f\u0131 b\u0131rak\u0131r.<\/p>\n
Diffie-Hellman Parametresi Olu\u015fturma:<\/strong>
\nM\u00fckemmel ileri gizlili\u011fi (Perfect Forward Secrecy – PFS) sa\u011flamak i\u00e7in \u00f6zel bir Diffie-Hellman (DH) parametresi olu\u015fturman\u0131z \u00f6nerilir. Certbot bunu genellikle otomatik olarak yapar (ssl_dhparam \/etc\/letsencrypt\/ssl-dhparams.pem;<\/code>), ancak manuel olarak olu\u015fturmak isterseniz:<\/p>\n
sudo openssl dhparam -out \/etc\/nginx\/ssl\/dhparam.pem 2048 # veya 4096 daha g\u00fcvenli<\/code><\/pre>\n
Bu komut 2048 bitlik bir DH parametresi olu\u015fturur. Daha y\u00fcksek g\u00fcvenlik i\u00e7in 4096 bit kullanabilirsiniz, ancak bu i\u015flem daha uzun s\u00fcrebilir. Olu\u015fturduktan sonra, Nginx yap\u0131land\u0131rman\u0131zda bu dosyay\u0131 kullanmas\u0131n\u0131 sa\u011flay\u0131n:<\/p>\n
ssl_dhparam \/etc\/nginx\/ssl\/dhparam.pem;<\/code><\/pre>\n
HTTP\/2 Deste\u011fi<\/h4>\n
HTTP\/2, web performans\u0131n\u0131 \u00f6nemli \u00f6l\u00e7\u00fcde art\u0131ran daha yeni bir HTTP protokol\u00fcd\u00fcr. Nginx, SSL\/TLS ile birlikte HTTP\/2’yi destekler.<\/p>\n
Nginx yap\u0131land\u0131rman\u0131zda listen 443 ssl;<\/code> sat\u0131r\u0131n\u0131 listen 443 ssl http2;<\/code> olarak de\u011fi\u015ftirerek HTTP\/2’yi etkinle\u015ftirebilirsiniz:<\/p>\n
server {\n    listen 443 ssl http2;\n    listen [::]:443 ssl http2;\n    # ... di\u011fer SSL\/TLS ayarlar\u0131 ...\n}<\/code><\/pre>\n
T\u00fcm bu ek g\u00fcvenlik ayarlar\u0131n\u0131 yapt\u0131ktan sonra, Nginx yap\u0131land\u0131rman\u0131z\u0131 test edin ve yeniden y\u00fckleyin:<\/p>\n
sudo nginx -t\nsudo systemctl reload nginx<\/code><\/pre>\n
Ard\u0131ndan, SSL Labs testini tekrar \u00e7al\u0131\u015ft\u0131rarak sitenizin notunun y\u00fckseldi\u011fini ve t\u00fcm g\u00fcvenlik \u00f6nlemlerinin do\u011fru \u015fekilde uyguland\u0131\u011f\u0131n\u0131 do\u011frulay\u0131n.<\/p>\n
Sorun Giderme<\/h3>\n
Kurulum veya yenileme s\u0131ras\u0131nda \u00e7e\u015fitli sorunlarla kar\u015f\u0131la\u015fabilirsiniz. \u0130\u015fte yayg\u0131n sorunlar ve \u00e7\u00f6z\u00fcm \u00f6nerileri:<\/p>\n
Yayg\u0131n Hatalar<\/h4>\n
*   DNS Sorunlar\u0131:<\/strong> “Could not find a matching domain” veya “DNS problem” gibi hatalar, alan ad\u0131n\u0131z\u0131n sunucunuzun IP adresine do\u011fru \u015fekilde i\u015faret etmedi\u011fini g\u00f6sterir. DNS kay\u0131tlar\u0131n\u0131z\u0131 kontrol edin ve yay\u0131lma s\u00fcresini bekleyin.
\n*   G\u00fcvenlik Duvar\u0131 (Firewall) Sorunlar\u0131:<\/strong> “Connection refused” veya “Timeout” gibi hatalar, 80 veya 443 numaral\u0131 portlar\u0131n g\u00fcvenlik duvar\u0131nda kapal\u0131 oldu\u011funu g\u00f6sterebilir. sudo firewall-cmd --list-all<\/code> komutuyla firewalld ayarlar\u0131n\u0131z\u0131 kontrol edin.
\n*   Nginx Yap\u0131land\u0131rma Hatalar\u0131:<\/strong> Certbot, Nginx yap\u0131land\u0131rman\u0131zda bir hata bulursa sertifika alamaz veya da\u011f\u0131tamaz. sudo nginx -t<\/code> komutunu kullanarak Nginx yap\u0131land\u0131rma dosyan\u0131zdaki hatalar\u0131 kontrol edin.
\n*   “Too many requests” Hatas\u0131:<\/strong> Let’s Encrypt’in belirli bir s\u00fcre i\u00e7inde alabilece\u011finiz sertifika say\u0131s\u0131yla ilgili h\u0131z limitleri vard\u0131r. Genellikle bu, deneme-yan\u0131lma ile \u00e7ok fazla sertifika almaya \u00e7al\u0131\u015f\u0131ld\u0131\u011f\u0131nda ortaya \u00e7\u0131kar. Birka\u00e7 saat bekleyip tekrar deneyin.<\/p>\n
Certbot G\u00fcnl\u00fcklerini \u0130nceleme<\/h4>\n
Certbot’un i\u015flem g\u00fcnl\u00fckleri, sorunlar\u0131n k\u00f6kenini anlamak i\u00e7in \u00e7ok de\u011ferlidir. G\u00fcnl\u00fckler genellikle \/var\/log\/letsencrypt\/<\/code> dizininde bulunur.<\/p>\n
sudo tail -f \/var\/log\/letsencrypt\/letsencrypt.log<\/code><\/pre>\n
Bu komut, en son g\u00fcnl\u00fck giri\u015flerini ger\u00e7ek zamanl\u0131 olarak g\u00f6sterir.<\/p>\n
Nginx G\u00fcnl\u00fcklerini \u0130nceleme<\/h4>\n
Nginx’in hata ve eri\u015fim g\u00fcnl\u00fckleri de sorun giderme i\u00e7in \u00f6nemlidir. Bu dosyalar genellikle \/var\/log\/nginx\/<\/code> dizinindedir.<\/p>\n
sudo tail -f \/var\/log\/nginx\/error.log\nsudo tail -f \/var\/log\/nginx\/access.log<\/code><\/pre>\n
Sertifika Yenileme Sorunlar\u0131<\/h4>\n
E\u011fer otomatik yenileme ba\u015far\u0131s\u0131z olursa, Certbot size e-posta ile bildirim g\u00f6nderecektir (e\u011fer kurulum s\u0131ras\u0131nda bir e-posta adresi verdiyseniz). Yenileme sorunlar\u0131 genellikle DNS, g\u00fcvenlik duvar\u0131 veya Nginx yap\u0131land\u0131rma de\u011fi\u015fikliklerinden kaynaklan\u0131r. sudo certbot renew --dry-run<\/code> komutunu kullanarak sorunun nedenini belirlemeye \u00e7al\u0131\u015f\u0131n ve g\u00fcnl\u00fckleri inceleyin.<\/p>\n
Sonu\u00e7<\/h3>\n
Bu kapsaml\u0131 rehberde, Rocky Linux 9 i\u015fletim sistemi \u00fczerinde Nginx web sunucunuzu Let’s Encrypt ile nas\u0131l g\u00fcvenli hale getirece\u011finizi ad\u0131m ad\u0131m \u00f6\u011frendiniz. Nginx kurulumundan ba\u015flayarak, Certbot’u kullanarak \u00fccretsiz SSL\/TLS sertifikalar\u0131 almay\u0131, Nginx yap\u0131land\u0131rmas\u0131n\u0131 g\u00fcncellemeyi, otomatik yenilemeyi ayarlamay\u0131 ve hatta HSTS, OCSP Stapling, g\u00fc\u00e7l\u00fc \u015fifreleme algoritmalar\u0131 ve HTTP\/2 gibi ek g\u00fcvenlik \u00f6nlemlerini uygulamay\u0131 ele ald\u0131k.<\/p>\n
Web sitenizi HTTPS ile g\u00fcvence alt\u0131na almak, kullan\u0131c\u0131lar\u0131n\u0131z\u0131n gizlili\u011fini ve verilerinin b\u00fct\u00fcnl\u00fc\u011f\u00fcn\u00fc koruman\u0131n yan\u0131 s\u0131ra, arama motoru s\u0131ralamalar\u0131n\u0131z\u0131 iyile\u015ftirmek ve sitenize olan g\u00fcveni art\u0131rmak i\u00e7in kritik \u00f6neme sahiptir. Let’s Encrypt ve Certbot sayesinde, bu s\u00fcre\u00e7 art\u0131k herkes i\u00e7in eri\u015filebilir ve y\u00f6netilebilir hale gelmi\u015ftir. Bu ad\u0131mlar\u0131 takip ederek, Rocky Linux 9 sunucunuzda g\u00fc\u00e7l\u00fc, g\u00fcvenli ve performansl\u0131 bir web deneyimi sunabilirsiniz. Unutmay\u0131n ki g\u00fcvenlik s\u00fcrekli bir s\u00fcre\u00e7tir; sertifikalar\u0131n\u0131z\u0131 g\u00fcncel tutmak, yaz\u0131l\u0131mlar\u0131n\u0131z\u0131 yamalamak ve g\u00fcvenlik ayarlar\u0131n\u0131z\u0131 d\u00fczenli olarak g\u00f6zden ge\u00e7irmek her zaman iyi bir uygulamad\u0131r.<\/body><\/p>\n","protected":false},"excerpt":{"rendered":"Nginx’i Rocky Linux 9 \u00dczerinde Let’s Encrypt ile G\u00fcvenli Hale Getirme\nRocky Linux 9, kararl\u0131 ve g\u00fcvenilir bir i\u015fletim sistemi platformu sunarken","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"csco_page_header_type":"","csco_page_load_nextpost":"","csco_page_subscribe_form":"","csco_page_contact_form":"","footnotes":""},"categories":[241],"tags":[],"class_list":{"0":"post-36125","1":"post","2":"type-post","3":"status-publish","4":"format-standard","6":"category-linux","7":"cs-entry","8":"cs-video-wrap"},"yoast_head":"\nNginx'i Rocky Linux 9 \u00dczerinde Let's Encrypt ile G\u00fcvenli Hale Getirme - Kodlar\u0131n Gizemli D\u00fcnyas\u0131<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/fatihsoysal.com\/blog\/nginxi-rocky-linux-9-uzerinde-lets-encrypt-ile-guvenli-hale-getirme\/\" \/>\n<meta property=\"og:locale\" content=\"tr_TR\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Nginx'i Rocky Linux 9 \u00dczerinde Let's Encrypt ile G\u00fcvenli Hale Getirme\" \/>\n<meta property=\"og:description\" content=\"Nginx'i Rocky Linux 9 \u00dczerinde Let's Encrypt ile G\u00fcvenli Hale Getirme Rocky Linux 9, kararl\u0131 ve g\u00fcvenilir bir i\u015fletim sistemi platformu sunarken\" \/>\n<meta property=\"og:url\" content=\"https:\/\/fatihsoysal.com\/blog\/nginxi-rocky-linux-9-uzerinde-lets-encrypt-ile-guvenli-hale-getirme\/\" \/>\n<meta property=\"og:site_name\" content=\"Kodlar\u0131n Gizemli D\u00fcnyas\u0131\" \/>\n<meta property=\"article:published_time\" content=\"2025-12-08T13:40:51+00:00\" \/>\n<meta name=\"author\" content=\"Fatih Soysal\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Yazan:\" \/>\n\t<meta name=\"twitter:data1\" content=\"Fatih Soysal\" \/>\n\t<meta name=\"twitter:label2\" content=\"Tahmini okuma s\u00fcresi\" \/>\n\t<meta name=\"twitter:data2\" content=\"20 dakika\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/nginxi-rocky-linux-9-uzerinde-lets-encrypt-ile-guvenli-hale-getirme\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/nginxi-rocky-linux-9-uzerinde-lets-encrypt-ile-guvenli-hale-getirme\/\"},\"author\":{\"name\":\"Fatih Soysal\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"headline\":\"Nginx’i Rocky Linux 9 \u00dczerinde Let’s Encrypt ile G\u00fcvenli Hale Getirme\",\"datePublished\":\"2025-12-08T13:40:51+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/nginxi-rocky-linux-9-uzerinde-lets-encrypt-ile-guvenli-hale-getirme\/\"},\"wordCount\":3370,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"articleSection\":[\"Linux\"],\"inLanguage\":\"tr\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/fatihsoysal.com\/blog\/nginxi-rocky-linux-9-uzerinde-lets-encrypt-ile-guvenli-hale-getirme\/#respond\"]}],\"copyrightYear\":\"2025\",\"copyrightHolder\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#organization\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/nginxi-rocky-linux-9-uzerinde-lets-encrypt-ile-guvenli-hale-getirme\/\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/nginxi-rocky-linux-9-uzerinde-lets-encrypt-ile-guvenli-hale-getirme\/\",\"name\":\"Nginx'i Rocky Linux 9 \u00dczerinde Let's Encrypt ile G\u00fcvenli Hale Getirme - Kodlar\u0131n Gizemli D\u00fcnyas\u0131\",\"isPartOf\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#website\"},\"datePublished\":\"2025-12-08T13:40:51+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/nginxi-rocky-linux-9-uzerinde-lets-encrypt-ile-guvenli-hale-getirme\/#breadcrumb\"},\"inLanguage\":\"tr\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/fatihsoysal.com\/blog\/nginxi-rocky-linux-9-uzerinde-lets-encrypt-ile-guvenli-hale-getirme\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/nginxi-rocky-linux-9-uzerinde-lets-encrypt-ile-guvenli-hale-getirme\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Anasayfa\",\"item\":\"https:\/\/fatihsoysal.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Nginx’i Rocky Linux 9 \u00dczerinde Let’s Encrypt ile G\u00fcvenli Hale Getirme\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#website\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/\",\"name\":\"Fatihsoysal.com\",\"description\":\"Blog - Yaz\u0131l\u0131m D\u00fcnyas\u0131 Tecr\u00fcbelerim\",\"publisher\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/fatihsoysal.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"tr\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\",\"name\":\"Fatih Soysal\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"tr\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png\",\"contentUrl\":\"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png\",\"width\":512,\"height\":512,\"caption\":\"Fatih Soysal\"},\"logo\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/\"},\"description\":\"Kullan\u0131m ve kodlama m\u00fckemmeliyetini odak alan uygulamalar olu\u015fturma deneyimine sahip, profesyonel olarak 15+ y\u0131l \u00fczeri deneyime sahip bir yaz\u0131l\u0131m m\u00fchendisi.\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/author\/fatihsoysal\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Nginx'i Rocky Linux 9 \u00dczerinde Let's Encrypt ile G\u00fcvenli Hale Getirme - Kodlar\u0131n Gizemli D\u00fcnyas\u0131","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/fatihsoysal.com\/blog\/nginxi-rocky-linux-9-uzerinde-lets-encrypt-ile-guvenli-hale-getirme\/","og_locale":"tr_TR","og_type":"article","og_title":"Nginx'i Rocky Linux 9 \u00dczerinde Let's Encrypt ile G\u00fcvenli Hale Getirme","og_description":"Nginx'i Rocky Linux 9 \u00dczerinde Let's Encrypt ile G\u00fcvenli Hale Getirme Rocky Linux 9, kararl\u0131 ve g\u00fcvenilir bir i\u015fletim sistemi platformu sunarken","og_url":"https:\/\/fatihsoysal.com\/blog\/nginxi-rocky-linux-9-uzerinde-lets-encrypt-ile-guvenli-hale-getirme\/","og_site_name":"Kodlar\u0131n Gizemli D\u00fcnyas\u0131","article_published_time":"2025-12-08T13:40:51+00:00","author":"Fatih Soysal","twitter_card":"summary_large_image","twitter_misc":{"Yazan:":"Fatih Soysal","Tahmini okuma s\u00fcresi":"20 dakika"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/fatihsoysal.com\/blog\/nginxi-rocky-linux-9-uzerinde-lets-encrypt-ile-guvenli-hale-getirme\/#article","isPartOf":{"@id":"https:\/\/fatihsoysal.com\/blog\/nginxi-rocky-linux-9-uzerinde-lets-encrypt-ile-guvenli-hale-getirme\/"},"author":{"name":"Fatih Soysal","@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"headline":"Nginx’i Rocky Linux 9 \u00dczerinde Let’s Encrypt ile G\u00fcvenli Hale Getirme","datePublished":"2025-12-08T13:40:51+00:00","mainEntityOfPage":{"@id":"https:\/\/fatihsoysal.com\/blog\/nginxi-rocky-linux-9-uzerinde-lets-encrypt-ile-guvenli-hale-getirme\/"},"wordCount":3370,"commentCount":0,"publisher":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"articleSection":["Linux"],"inLanguage":"tr","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/fatihsoysal.com\/blog\/nginxi-rocky-linux-9-uzerinde-lets-encrypt-ile-guvenli-hale-getirme\/#respond"]}],"copyrightYear":"2025","copyrightHolder":{"@id":"https:\/\/fatihsoysal.com\/blog\/#organization"}},{"@type":"WebPage","@id":"https:\/\/fatihsoysal.com\/blog\/nginxi-rocky-linux-9-uzerinde-lets-encrypt-ile-guvenli-hale-getirme\/","url":"https:\/\/fatihsoysal.com\/blog\/nginxi-rocky-linux-9-uzerinde-lets-encrypt-ile-guvenli-hale-getirme\/","name":"Nginx'i Rocky Linux 9 \u00dczerinde Let's Encrypt ile G\u00fcvenli Hale Getirme - Kodlar\u0131n Gizemli D\u00fcnyas\u0131","isPartOf":{"@id":"https:\/\/fatihsoysal.com\/blog\/#website"},"datePublished":"2025-12-08T13:40:51+00:00","breadcrumb":{"@id":"https:\/\/fatihsoysal.com\/blog\/nginxi-rocky-linux-9-uzerinde-lets-encrypt-ile-guvenli-hale-getirme\/#breadcrumb"},"inLanguage":"tr","potentialAction":[{"@type":"ReadAction","target":["https:\/\/fatihsoysal.com\/blog\/nginxi-rocky-linux-9-uzerinde-lets-encrypt-ile-guvenli-hale-getirme\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/fatihsoysal.com\/blog\/nginxi-rocky-linux-9-uzerinde-lets-encrypt-ile-guvenli-hale-getirme\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Anasayfa","item":"https:\/\/fatihsoysal.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Nginx’i Rocky Linux 9 \u00dczerinde Let’s Encrypt ile G\u00fcvenli Hale Getirme"}]},{"@type":"WebSite","@id":"https:\/\/fatihsoysal.com\/blog\/#website","url":"https:\/\/fatihsoysal.com\/blog\/","name":"Fatihsoysal.com","description":"Blog - Yaz\u0131l\u0131m D\u00fcnyas\u0131 Tecr\u00fcbelerim","publisher":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/fatihsoysal.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"tr"},{"@type":["Person","Organization"],"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1","name":"Fatih Soysal","image":{"@type":"ImageObject","inLanguage":"tr","@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png","contentUrl":"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png","width":512,"height":512,"caption":"Fatih Soysal"},"logo":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/"},"description":"Kullan\u0131m ve kodlama m\u00fckemmeliyetini odak alan uygulamalar olu\u015fturma deneyimine sahip, profesyonel olarak 15+ y\u0131l \u00fczeri deneyime sahip bir yaz\u0131l\u0131m m\u00fchendisi.","url":"https:\/\/fatihsoysal.com\/blog\/author\/fatihsoysal\/"}]}},"yoast_meta":{"yoast_wpseo_title":"","yoast_wpseo_metadesc":"","yoast_wpseo_canonical":""},"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/36125","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/comments?post=36125"}],"version-history":[{"count":1,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/36125\/revisions"}],"predecessor-version":[{"id":36126,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/36125\/revisions\/36126"}],"wp:attachment":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/media?parent=36125"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/categories?post=36125"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/tags?post=36125"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}