{"id":37735,"date":"2026-01-13T22:41:40","date_gmt":"2026-01-13T19:41:40","guid":{"rendered":"https:\/\/fatihsoysal.com\/blog\/?p=37735"},"modified":"2026-01-13T22:41:40","modified_gmt":"2026-01-13T19:41:40","slug":"nginxi-lets-encrypt-ile-ubuntu-uzerinde-guvenli-hale-getirme","status":"publish","type":"post","link":"https:\/\/fatihsoysal.com\/blog\/nginxi-lets-encrypt-ile-ubuntu-uzerinde-guvenli-hale-getirme\/","title":{"rendered":"Nginx’i Let’s Encrypt ile Ubuntu \u00dczerinde G\u00fcvenli Hale Getirme"},"content":{"rendered":"

<\/p>\n

Nginx’i Let’s Encrypt ile Ubuntu \u00dczerinde G\u00fcvenli Hale Getirme<\/h2>\n

\u0130nternet d\u00fcnyas\u0131nda g\u00fcvenlik her ge\u00e7en g\u00fcn daha da kritik hale geliyor. Web sitelerinin kullan\u0131c\u0131 verilerini korumas\u0131, arama motorlar\u0131nda daha \u00fcst s\u0131ralarda yer almas\u0131 ve genel olarak g\u00fcvenilir bir imaj sergilemesi i\u00e7in HTTPS kullan\u0131m\u0131 bir zorunluluktur. HTTPS, web taray\u0131c\u0131s\u0131 ile sunucu aras\u0131ndaki ileti\u015fimi \u015fifreleyerek \u00fc\u00e7\u00fcnc\u00fc taraflar\u0131n verileri okumas\u0131n\u0131 veya de\u011fi\u015ftirmesini engeller. Bu rehberde, pop\u00fcler web sunucusu Nginx’i Ubuntu i\u015fletim sistemi \u00fczerinde Let’s Encrypt’in \u00fccretsiz SSL\/TLS sertifikalar\u0131 ile nas\u0131l g\u00fcvenli hale getirece\u011finizi ad\u0131m ad\u0131m \u00f6\u011freneceksiniz.<\/p>\n

Let’s Encrypt, Internet Security Research Group (ISRG) taraf\u0131ndan i\u015fletilen, a\u00e7\u0131k kaynakl\u0131 ve kar amac\u0131 g\u00fctmeyen bir sertifika yetkilisidir (CA). Amac\u0131, web’i daha g\u00fcvenli hale getirmek i\u00e7in SSL\/TLS sertifikalar\u0131n\u0131 herkes i\u00e7in \u00fccretsiz ve kolay eri\u015filebilir k\u0131lmakt\u0131r. Certbot ise, Let’s Encrypt sertifikalar\u0131n\u0131 sunuculara kurmay\u0131 ve y\u00f6netmeyi otomatikle\u015ftiren bir ara\u00e7t\u0131r.<\/p>\n

\u00d6n Haz\u0131rl\u0131klar<\/h3>\n

Sertifika kurulumuna ba\u015flamadan \u00f6nce baz\u0131 temel gereksinimleri kar\u015f\u0131lad\u0131\u011f\u0131n\u0131zdan emin olmal\u0131s\u0131n\u0131z:<\/p>\n

Ubuntu Sunucusu<\/h4>\n

* Ubuntu i\u015fletim sistemine sahip bir sunucuya (tercihen LTS s\u00fcr\u00fcm\u00fc) SSH eri\u015fiminiz olmal\u0131 ve sudo yetkilerine sahip bir kullan\u0131c\u0131 ile giri\u015f yapmal\u0131s\u0131n\u0131z.<\/p>\n

Nginx Kurulumu ve Alan Ad\u0131<\/h4>\n

* Nginx web sunucusu sunucunuzda kurulu ve yap\u0131land\u0131r\u0131lm\u0131\u015f olmal\u0131d\u0131r. Bir veya daha fazla alan ad\u0131n\u0131z (domain) Nginx \u00fczerinde \u00e7al\u0131\u015f\u0131yor olmal\u0131d\u0131r.
\n* Alan ad\u0131n\u0131z\u0131n DNS kay\u0131tlar\u0131 (A kayd\u0131 veya AAA kayd\u0131) sunucunuzun IP adresine do\u011fru \u015fekilde i\u015faret etmelidir. Bu, Let’s Encrypt’in alan ad\u0131n\u0131z\u0131n sahipli\u011fini do\u011frulamas\u0131 i\u00e7in kritik \u00f6neme sahiptir. \u00d6rne\u011fin, example.com<\/code> ve www.example.com<\/code> i\u00e7in kay\u0131tlar sunucunuzu g\u00f6stermelidir.<\/p>\n

G\u00fcvenlik Duvar\u0131 (UFW) Ayarlar\u0131<\/h4>\n

* Ubuntu’da genellikle UFW (Uncomplicated Firewall) kullan\u0131l\u0131r. Nginx’in web trafi\u011fini alabilmesi i\u00e7in HTTP (80) ve HTTPS (443) portlar\u0131n\u0131n a\u00e7\u0131k olmas\u0131 gerekmektedir.<\/p>\n

sudo ufw allow 'Nginx Full'\n    sudo ufw status<\/code><\/pre>\n
    E\u011fer ‘Nginx Full’ profili ekli de\u011filse, sudo ufw allow http<\/code> ve sudo ufw allow https<\/code> komutlar\u0131n\u0131 ayr\u0131 ayr\u0131 kullanabilirsiniz.<\/p>\n
Certbot Kurulumu ve Let’s Encrypt Sertifikas\u0131 Alma<\/h3>\n
Certbot, Let’s Encrypt sertifikalar\u0131n\u0131 Nginx ile birlikte otomatik olarak yap\u0131land\u0131rmak i\u00e7in m\u00fckemmel bir ara\u00e7t\u0131r.<\/p>\n
Certbot Kurulumu<\/h4>\n
*   Certbot’u Ubuntu’ya kurman\u0131n en kolay yolu, resmi PPA (Personal Package Archive) kullanmakt\u0131r. Bu, en g\u00fcncel s\u00fcr\u00fcm\u00fc alman\u0131z\u0131 sa\u011flar.<\/p>\n
sudo apt update\n    sudo apt install software-properties-common\n    sudo add-apt-repository universe\n    sudo add-apt-repository ppa:certbot\/certbot\n    sudo apt update\n    sudo apt install certbot python3-certbot-nginx<\/code><\/pre>\n
    Bu komutlar, Certbot’u ve Nginx entegrasyonu i\u00e7in gerekli eklentiyi kuracakt\u0131r.<\/p>\n
Sertifika Alma<\/h4>\n
*   Certbot’u Nginx ile birlikte kullanarak sertifika almak olduk\u00e7a basittir. certbot --nginx<\/code> komutu, Nginx yap\u0131land\u0131rman\u0131z\u0131 otomatik olarak alg\u0131lar ve sertifika alma s\u00fcrecini ba\u015flat\u0131r.<\/p>\n
sudo certbot --nginx<\/code><\/pre>\n
    Bu komutu \u00e7al\u0131\u015ft\u0131rd\u0131ktan sonra, Certbot size baz\u0131 sorular soracakt\u0131r:
\n    1.  E-posta Adresi:<\/strong> Acil bildirimler ve kay\u0131p anahtarlar i\u00e7in bir e-posta adresi girmeniz istenir.
\n    2.  Hizmet \u015eartlar\u0131:<\/strong> Let’s Encrypt’in hizmet \u015fartlar\u0131n\u0131 kabul etmeniz gerekir.
\n    3.  Alan Ad\u0131 Se\u00e7imi:<\/strong> Certbot, Nginx yap\u0131land\u0131rman\u0131zda buldu\u011fu t\u00fcm alan adlar\u0131n\u0131 listeler. Hangi alan adlar\u0131 i\u00e7in sertifika almak istedi\u011finizi se\u00e7menizi ister (genellikle t\u00fcm\u00fcn\u00fc se\u00e7mek isteyeceksiniz, \u00f6rn: example.com<\/code> ve www.example.com<\/code>).
\n    4.  HTTP’den HTTPS’e Y\u00f6nlendirme:<\/strong> Certbot, HTTP trafi\u011fini otomatik olarak HTTPS’e y\u00f6nlendirip y\u00f6nlendirmeyece\u011fini sorar. G\u00fcvenlik i\u00e7in bu se\u00e7ene\u011fi “Redirect” (2)<\/strong> olarak se\u00e7meniz \u015fiddetle tavsiye edilir.<\/p>\n
    S\u00fcre\u00e7 ba\u015far\u0131l\u0131 bir \u015fekilde tamamland\u0131\u011f\u0131nda, Certbot size sertifikan\u0131z\u0131n ba\u015far\u0131yla al\u0131nd\u0131\u011f\u0131n\u0131 ve Nginx yap\u0131land\u0131rman\u0131z\u0131n g\u00fcncellendi\u011fini bildiren bir mesaj g\u00f6sterecektir.<\/p>\n
Nginx Konfig\u00fcrasyonunun Kontrol\u00fc<\/h4>\n
*   Certbot, sertifikalar\u0131 \/etc\/letsencrypt\/live\/your_domain_name\/<\/code> dizinine kaydeder ve Nginx yap\u0131land\u0131rma dosyan\u0131z\u0131 (genellikle \/etc\/nginx\/sites-available\/your_domain_name<\/code>) otomatik olarak g\u00fcnceller.
\n*   G\u00fcncellenmi\u015f Nginx yap\u0131land\u0131rma dosyan\u0131z\u0131n i\u00e7eri\u011fine bakarsan\u0131z, Certbot’un a\u015fa\u011f\u0131daki gibi de\u011fi\u015fiklikler yapt\u0131\u011f\u0131n\u0131 g\u00f6receksiniz:<\/p>\n
# HTTP trafi\u011fini HTTPS'e y\u00f6nlendirme\n    server {\n        listen 80;\n        server_name example.com www.example.com;\n        return 301 https:\/\/$host$request_uri;\n    }\n\n    # HTTPS i\u00e7in yeni server blo\u011fu\n    server {\n        listen 443 ssl;\n        server_name example.com www.example.com;\n\n        ssl_certificate \/etc\/letsencrypt\/live\/example.com\/fullchain.pem;\n        ssl_certificate_key \/etc\/letsencrypt\/live\/example.com\/privkey.pem;\n        include \/etc\/letsencrypt\/options-ssl-nginx.conf;\n        ssl_dhparam \/etc\/letsencrypt\/ssl-dhparams.pem; # E\u011fer Certbot olu\u015fturduysa\n\n        # Di\u011fer Nginx yap\u0131land\u0131rmalar\u0131n\u0131z buraya gelir (root, index, location bloklar\u0131 vb.)\n        root \/var\/www\/html\/example.com;\n        index index.html index.htm;\n        # ...\n    }<\/code><\/pre>\n
    options-ssl-nginx.conf<\/code> dosyas\u0131, Certbot’un varsay\u0131lan olarak ekledi\u011fi g\u00fc\u00e7l\u00fc SSL\/TLS ayarlar\u0131n\u0131 i\u00e7erir. Bu ayarlar, modern \u015fifreleme protokollerini ve \u015fifre s\u00fcitlerini kullanarak g\u00fcvenli\u011fi art\u0131r\u0131r.<\/p>\n
*   Nginx yap\u0131land\u0131rman\u0131z\u0131 kontrol etmek i\u00e7in:<\/p>\n
sudo nginx -t<\/code><\/pre>\n
    E\u011fer hata yoksa, Nginx’i yeniden y\u00fckleyerek de\u011fi\u015fiklikleri uygulay\u0131n:<\/p>\n
sudo systemctl reload nginx<\/code><\/pre>\n
    Art\u0131k web sitenize https:\/\/your_domain_name<\/code> adresinden eri\u015febilirsiniz ve taray\u0131c\u0131n\u0131zda bir kilit simgesi g\u00f6rmelisiniz.<\/p>\n
Sertifika Otomatik Yenileme<\/h3>\n
Let’s Encrypt sertifikalar\u0131 90 g\u00fcn ge\u00e7erlidir. Bu k\u0131sa s\u00fcre, g\u00fcvenli\u011fi art\u0131rmak ve olas\u0131 anahtar s\u0131z\u0131nt\u0131lar\u0131n\u0131n etkisini azaltmak i\u00e7indir. Ancak, Certbot bu yenileme i\u015flemini otomatikle\u015ftirerek size kolayl\u0131k sa\u011flar.<\/p>\n
Certbot Yenileme Mekanizmas\u0131<\/h4>\n
*   Certbot, Ubuntu’da genellikle systemd timer<\/code> veya cronjob<\/code> olarak otomatik bir yenileme g\u00f6revi kurar. Bu g\u00f6rev, sertifikalar\u0131n\u0131z\u0131n s\u00fcresi dolmadan \u00f6nce otomatik olarak yenilenmesini sa\u011flar. Genellikle g\u00fcnde iki kez \u00e7al\u0131\u015f\u0131r ve sertifikalar\u0131n s\u00fcresi dolmak \u00fczereyse (son 30 g\u00fcn i\u00e7inde) yenileme i\u015flemini ger\u00e7ekle\u015ftirir.
\n*   Yenileme ba\u015far\u0131l\u0131 oldu\u011funda, Certbot Nginx’i yeniden y\u00fckleyerek yeni sertifikalar\u0131n devreye girmesini sa\u011flar.<\/p>\n
Yenileme Testi<\/h4>\n
*   Otomatik yenileme s\u00fcrecinin d\u00fczg\u00fcn \u00e7al\u0131\u015f\u0131p \u00e7al\u0131\u015fmad\u0131\u011f\u0131n\u0131 test etmek i\u00e7in “dry run” (deneme \u00e7al\u0131\u015ft\u0131rmas\u0131) yapabilirsiniz:<\/p>\n
sudo certbot renew --dry-run<\/code><\/pre>\n
    Bu komut, yenileme i\u015flemini ger\u00e7ekten sertifikalar\u0131 yenilemeden sim\u00fcle eder. E\u011fer herhangi bir hata mesaj\u0131 almazsan\u0131z, otomatik yenilemenin sorunsuz \u00e7al\u0131\u015fmas\u0131 beklenir.
\n*   E\u011fer bir sorunla kar\u015f\u0131la\u015f\u0131rsan\u0131z, hata mesaj\u0131n\u0131 dikkatlice inceleyerek sorunun kayna\u011f\u0131n\u0131 (\u00f6rn. firewall, DNS, Nginx yap\u0131land\u0131rmas\u0131) tespit edebilirsiniz.<\/p>\n
Ek G\u00fcvenlik Ayarlar\u0131 ve \u0130yile\u015ftirmeler<\/h3>\n
Sertifikay\u0131 kurduktan sonra, Nginx sunucunuzun g\u00fcvenli\u011fini daha da art\u0131rmak i\u00e7in baz\u0131 ek yap\u0131land\u0131rmalar yapabilirsiniz.<\/p>\n
HSTS (HTTP Strict Transport Security)<\/h4>\n
*   HSTS, taray\u0131c\u0131lara web sitenize her zaman HTTPS \u00fczerinden ba\u011flanmalar\u0131n\u0131 s\u00f6yleyen bir g\u00fcvenlik mekanizmas\u0131d\u0131r. Bu, kullan\u0131c\u0131lar\u0131n yanl\u0131\u015fl\u0131kla veya k\u00f6t\u00fc niyetli bir sald\u0131r\u0131 sonucu HTTP \u00fczerinden ba\u011flanmas\u0131n\u0131 engelleyerek man-in-the-middle sald\u0131r\u0131lar\u0131na kar\u015f\u0131 koruma sa\u011flar.
\n*   Nginx yap\u0131land\u0131rma dosyan\u0131za (HTTPS server blo\u011fu i\u00e7ine) a\u015fa\u011f\u0131daki sat\u0131r\u0131 ekleyin:<\/p>\n
# \/etc\/nginx\/sites-available\/your_domain_name\n    server {\n        listen 443 ssl;\n        server_name example.com www.example.com;\n        # ... di\u011fer ayarlar ...\n\n        add_header Strict-Transport-Security \"max-age=63072000; includeSubDomains; preload\";\n\n        # ...\n    }<\/code><\/pre>\n
    *   max-age<\/code>: Taray\u0131c\u0131n\u0131n bu kural\u0131 ne kadar s\u00fcreyle hat\u0131rlayaca\u011f\u0131n\u0131 saniye cinsinden belirtir (2 y\u0131l).
\n    *   includeSubDomains<\/code>: T\u00fcm alt alan adlar\u0131 i\u00e7in de HSTS’nin ge\u00e7erli olmas\u0131n\u0131 sa\u011flar.
\n    *   preload<\/code>: Alan ad\u0131n\u0131z\u0131 HSTS preload listesine eklemek isterseniz bu anahtar kelimeyi kullan\u0131rs\u0131n\u0131z. Bu, taray\u0131c\u0131lar\u0131n alan ad\u0131n\u0131z\u0131 ilk ziyaretlerinden \u00f6nce bile HTTPS olarak kabul etmesini sa\u011flar. hstspreload.org<\/code> adresinden alan ad\u0131n\u0131z\u0131 preload listesine ekleyebilirsiniz, ancak bu kal\u0131c\u0131 bir i\u015flem oldu\u011fu i\u00e7in dikkatli olunmal\u0131d\u0131r.<\/p>\n
*   De\u011fi\u015fiklikleri uygulad\u0131ktan sonra Nginx’i yeniden y\u00fckleyin:<\/p>\n
sudo nginx -t\n    sudo systemctl reload nginx<\/code><\/pre>\n
G\u00fc\u00e7l\u00fc \u015eifreleme Protokolleri ve \u015eifre S\u00fcitleri<\/h4>\n
*   Certbot’un varsay\u0131lan options-ssl-nginx.conf<\/code> dosyas\u0131 genellikle iyi ayarlar i\u00e7erir. Ancak, daha fazla kontrol isterseniz veya belirli gereksinimleriniz varsa, bu ayarlar\u0131 do\u011frudan Nginx yap\u0131land\u0131rman\u0131za ekleyebilirsiniz.<\/p>\n
ssl_protocols TLSv1.2 TLSv1.3; # Yaln\u0131zca g\u00fcvenli TLS protokollerini kullan\n    ssl_ciphers 'TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256'; # Modern ve g\u00fcvenli \u015fifre s\u00fcitleri\n    ssl_prefer_server_ciphers on; # Sunucunun \u015fifre s\u00fcitlerini tercih etmesini sa\u011flar<\/code><\/pre>\n
    Bu ayarlar, daha eski ve zay\u0131f \u015fifreleme y\u00f6ntemlerini devre d\u0131\u015f\u0131 b\u0131rakarak sunucunuzu daha g\u00fcvenli hale getirir.<\/p>\n
OCSP Stapling<\/h4>\n
*   OCSP (Online Certificate Status Protocol) Stapling, sunucunuzun sertifika yetkilisinden (CA) sertifika durumunu al\u0131p \u00f6nbelle\u011fe almas\u0131n\u0131 ve bu bilgiyi taray\u0131c\u0131lara do\u011frudan sunmas\u0131n\u0131 sa\u011flar. Bu, taray\u0131c\u0131lar\u0131n CA’ya ayr\u0131 bir istek g\u00f6ndermesini engelleyerek performans\u0131 art\u0131r\u0131r ve kullan\u0131c\u0131n\u0131n gizlili\u011fini korur.<\/p>\n
ssl_stapling on;\n    ssl_stapling_verify on;\n    ssl_trusted_certificate \/etc\/letsencrypt\/live\/example.com\/chain.pem; # CA zincir dosyas\u0131<\/code><\/pre>\n
    chain.pem<\/code> dosyas\u0131, Certbot taraf\u0131ndan sertifika dizininizde otomatik olarak olu\u015fturulur.<\/p>\n
Diffie-Hellman Parametreleri<\/h4>\n
*   Diffie-Hellman (DH) parametreleri, anahtar de\u011fi\u015fimi i\u00e7in kullan\u0131l\u0131r. Daha g\u00fc\u00e7l\u00fc bir DH parametre dosyas\u0131 olu\u015fturmak, ileriye d\u00f6n\u00fck gizlili\u011fi (Perfect Forward Secrecy) g\u00fc\u00e7lendirir ve anahtar de\u011fi\u015fimini daha g\u00fcvenli hale getirir.<\/p>\n
sudo openssl dhparam -out \/etc\/ssl\/certs\/dhparam.pem 2048\n    # Daha fazla g\u00fcvenlik i\u00e7in 4096 kullanabilirsiniz, ancak bu daha uzun s\u00fcrer ve CPU kullan\u0131m\u0131 art\u0131r\u0131r.\n    # sudo openssl dhparam -out \/etc\/ssl\/certs\/dhparam.pem 4096<\/code><\/pre>\n
    Bu komut biraz zaman alabilir. Olu\u015fturulduktan sonra, Nginx yap\u0131land\u0131rman\u0131za ekleyin:<\/p>\n
ssl_dhparam \/etc\/ssl\/certs\/dhparam.pem;<\/code><\/pre>\n
    Certbot’un options-ssl-nginx.conf<\/code> dosyas\u0131 genellikle zaten bir DH parametresi i\u00e7erir, ancak manuel olarak daha g\u00fc\u00e7l\u00fc bir tane olu\u015fturmak isteyebilirsiniz.<\/p>\n
T\u00fcm bu de\u011fi\u015fiklikleri yapt\u0131ktan sonra, Nginx’i yeniden y\u00fcklemeyi unutmay\u0131n:<\/p>\n
sudo nginx -t\nsudo systemctl reload nginx<\/code><\/pre>\n
Web sitenizin SSL\/TLS yap\u0131land\u0131rmas\u0131n\u0131 test etmek i\u00e7in [SSL Labs’\u0131n SSL Testi](https:\/\/www.ssllabs.com\/ssltest\/) arac\u0131n\u0131 kullanabilirsiniz. Genellikle A veya A+ notu alman\u0131z hedeflenir.<\/p>\n
Sonu\u00e7 ve S\u0131k\u00e7a Sorulan Sorular<\/h3>\n
Bu rehberde, Nginx web sunucunuzu Ubuntu \u00fczerinde Let’s Encrypt’in \u00fccretsiz SSL\/TLS sertifikalar\u0131 ile nas\u0131l g\u00fcvenli hale getirece\u011finizi detayl\u0131 bir \u015fekilde \u00f6\u011frendiniz. Certbot’un kolay kurulumu ve otomatik yenileme \u00f6zellikleri sayesinde, web sitenizi g\u00fcvenli ve g\u00fcncel tutmak art\u0131k \u00e7ok daha eri\u015filebilir. Ek g\u00fcvenlik ayarlar\u0131yla da sunucunuzu olas\u0131 tehditlere kar\u015f\u0131 daha diren\u00e7li hale getirebilirsiniz. Unutmay\u0131n, g\u00fcvenli bir web deneyimi hem sizin hem de kullan\u0131c\u0131lar\u0131n\u0131z i\u00e7in kritik \u00f6neme sahiptir.<\/p>\n
S\u0131k\u00e7a Sorulan Sorular (SSS)<\/h4>\n
Sertifika yenileme neden ba\u015far\u0131s\u0131z oluyor?<\/H3><\/p>\n
Yenileme ba\u015far\u0131s\u0131zl\u0131\u011f\u0131n\u0131n birka\u00e7 yayg\u0131n nedeni olabilir:<\/p>\n
    \n
  • Firewall Engeli:<\/b> Let’s Encrypt sunucular\u0131n\u0131n alan ad\u0131n\u0131z\u0131n 80 veya 443 portuna eri\u015fememesi. UFW veya ba\u015fka bir g\u00fcvenlik duvar\u0131 ayar\u0131n\u0131z\u0131 kontrol edin.<\/li>\n
  • DNS Sorunlar\u0131:<\/b> Alan ad\u0131n\u0131z\u0131n DNS kay\u0131tlar\u0131n\u0131n sunucunuzun IP adresini do\u011fru \u015fekilde g\u00f6stermemesi.<\/li>\n
  • Nginx Yap\u0131land\u0131rma Hatas\u0131:<\/b> Certbot’un Nginx yap\u0131land\u0131rman\u0131z\u0131 okuyamamas\u0131 veya test edememesi. sudo nginx -t<\/code> komutuyla hatalar\u0131 kontrol edin.<\/li>\n
  • Sunucu Blo\u011fu Eksikli\u011fi:<\/b> Baz\u0131 durumlarda Certbot’un do\u011frulamay\u0131 yapabilmesi i\u00e7in 80 portunda \u00e7al\u0131\u015fan bir server<\/code> blo\u011funa ihtiyac\u0131 olabilir.<\/li>\n<\/ul>\n
    Birden fazla alan ad\u0131 i\u00e7in tek bir sertifika alabilir miyim?<\/H3><\/p>\n
    Evet, Certbot tek bir komutla birden fazla alan ad\u0131 (veya alt alan ad\u0131) i\u00e7in tek bir sertifika alman\u0131za olanak tan\u0131r. \u00d6rne\u011fin:<\/p>\n
    sudo certbot --nginx -d example.com -d www.example.com -d blog.example.com<\/code><\/pre>\n
    Bu, t\u00fcm belirtilen alan adlar\u0131 i\u00e7in tek bir sertifika olu\u015fturur ve y\u00f6netimi kolayla\u015ft\u0131r\u0131r.<\/p>\n
    Wildcard sertifika nas\u0131l al\u0131n\u0131r?<\/H3><\/p>\n
    Wildcard (joker karakter) sertifikalar (\u00f6rn: *.example.com<\/code>), t\u00fcm alt alan adlar\u0131n\u0131z\u0131 tek bir sertifika ile koruman\u0131z\u0131 sa\u011flar. Wildcard sertifikalar\u0131 almak i\u00e7in DNS do\u011frulamas\u0131 kullanman\u0131z gerekir:<\/p>\n
    sudo certbot certonly --manual --preferred-challenges dns --nginx -d *.example.com -d example.com<\/code><\/pre>\n
    Bu komut, Certbot’un size DNS TXT kayd\u0131 eklemeniz i\u00e7in talimatlar vermesine neden olur. Bu kayd\u0131 alan ad\u0131n\u0131z\u0131n DNS sa\u011flay\u0131c\u0131s\u0131 \u00fczerinden ekledikten sonra Certbot do\u011frulama i\u015flemini tamamlar.<\/p>\n
    Nginx’i yeniden ba\u015flatmak veya yeniden y\u00fcklemek ne zaman gerekir?<\/H3><\/p>\n
    Certbot, sertifika yenileme veya ilk kurulumdan sonra Nginx’i otomatik olarak yeniden y\u00fckler. Ancak, Nginx yap\u0131land\u0131rma dosyalar\u0131n\u0131zda (\u00f6rn. \/etc\/nginx\/sites-available\/your_domain_name<\/code>) manuel bir de\u011fi\u015fiklik yapt\u0131\u011f\u0131n\u0131zda, bu de\u011fi\u015fikliklerin etkinle\u015fmesi i\u00e7in Nginx’i yeniden y\u00fcklemeniz gerekir:<\/p>\n
    sudo nginx -t           # Yap\u0131land\u0131rma hatalar\u0131n\u0131 kontrol et\nsudo systemctl reload nginx  # De\u011fi\u015fiklikleri uygulamak i\u00e7in Nginx'i yeniden y\u00fckle<\/code><\/pre>\n
    Nginx’i yeniden ba\u015flatmak (sudo systemctl restart nginx<\/code>) da i\u015fe yarar ancak mevcut ba\u011flant\u0131lar\u0131 keserken, yeniden y\u00fcklemek (reload<\/code>) mevcut ba\u011flant\u0131lar\u0131 koruyarak yeni yap\u0131land\u0131rmay\u0131 devreye al\u0131r.<\/p>\n
    HSTS nedir ve neden \u00f6nemlidir?<\/H3><\/p>\n
    HSTS (HTTP Strict Transport Security), bir web sitesinin yaln\u0131zca HTTPS \u00fczerinden eri\u015filebilir olmas\u0131 gerekti\u011fini taray\u0131c\u0131lara bildiren bir g\u00fcvenlik politikas\u0131 mekanizmas\u0131d\u0131r. \u00d6nemli olmas\u0131n\u0131n nedenleri:<\/p>\n
      \n
    • Kullan\u0131c\u0131lar\u0131n yanl\u0131\u015fl\u0131kla veya manuel olarak HTTP s\u00fcr\u00fcm\u00fcne eri\u015fmesini engeller.<\/li>\n
    • Man-in-the-middle sald\u0131r\u0131lar\u0131nda (\u00f6rne\u011fin, SSL Strip sald\u0131r\u0131lar\u0131) sald\u0131rgan\u0131n HTTP ba\u011flant\u0131s\u0131n\u0131 zorlamas\u0131n\u0131 engeller.<\/li>\n
    • Taray\u0131c\u0131lar\u0131n her zaman \u015fifreli ba\u011flant\u0131 kullanmas\u0131n\u0131 sa\u011flayarak g\u00fcvenli\u011fi art\u0131r\u0131r ve performans\u0131 optimize eder (y\u00f6nlendirme ihtiyac\u0131n\u0131 azalt\u0131r).<\/li>\n<\/ul>\n
      <\/body><\/p>\n","protected":false},"excerpt":{"rendered":"Nginx’i Let’s Encrypt ile Ubuntu \u00dczerinde G\u00fcvenli Hale Getirme\n\u0130nternet d\u00fcnyas\u0131nda g\u00fcvenlik her ge\u00e7en g\u00fcn daha da kritik hale geliyor. Web","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"csco_page_header_type":"","csco_page_load_nextpost":"","csco_page_subscribe_form":"","csco_page_contact_form":"","footnotes":""},"categories":[1468],"tags":[],"class_list":{"0":"post-37735","1":"post","2":"type-post","3":"status-publish","4":"format-standard","6":"category-ubuntu","7":"cs-entry","8":"cs-video-wrap"},"yoast_head":"\nNginx'i Let's Encrypt ile Ubuntu \u00dczerinde G\u00fcvenli Hale Getirme - Kodlar\u0131n Gizemli D\u00fcnyas\u0131<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/fatihsoysal.com\/blog\/nginxi-lets-encrypt-ile-ubuntu-uzerinde-guvenli-hale-getirme\/\" \/>\n<meta property=\"og:locale\" content=\"tr_TR\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Nginx'i Let's Encrypt ile Ubuntu \u00dczerinde G\u00fcvenli Hale Getirme\" \/>\n<meta property=\"og:description\" content=\"Nginx'i Let's Encrypt ile Ubuntu \u00dczerinde G\u00fcvenli Hale Getirme \u0130nternet d\u00fcnyas\u0131nda g\u00fcvenlik her ge\u00e7en g\u00fcn daha da kritik hale geliyor. Web\" \/>\n<meta property=\"og:url\" content=\"https:\/\/fatihsoysal.com\/blog\/nginxi-lets-encrypt-ile-ubuntu-uzerinde-guvenli-hale-getirme\/\" \/>\n<meta property=\"og:site_name\" content=\"Kodlar\u0131n Gizemli D\u00fcnyas\u0131\" \/>\n<meta property=\"article:published_time\" content=\"2026-01-13T19:41:40+00:00\" \/>\n<meta name=\"author\" content=\"Fatih Soysal\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Yazan:\" \/>\n\t<meta name=\"twitter:data1\" content=\"Fatih Soysal\" \/>\n\t<meta name=\"twitter:label2\" content=\"Tahmini okuma s\u00fcresi\" \/>\n\t<meta name=\"twitter:data2\" content=\"12 dakika\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/nginxi-lets-encrypt-ile-ubuntu-uzerinde-guvenli-hale-getirme\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/nginxi-lets-encrypt-ile-ubuntu-uzerinde-guvenli-hale-getirme\/\"},\"author\":{\"name\":\"Fatih Soysal\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"headline\":\"Nginx’i Let’s Encrypt ile Ubuntu \u00dczerinde G\u00fcvenli Hale Getirme\",\"datePublished\":\"2026-01-13T19:41:40+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/nginxi-lets-encrypt-ile-ubuntu-uzerinde-guvenli-hale-getirme\/\"},\"wordCount\":1891,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"articleSection\":[\"Ubuntu\"],\"inLanguage\":\"tr\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/fatihsoysal.com\/blog\/nginxi-lets-encrypt-ile-ubuntu-uzerinde-guvenli-hale-getirme\/#respond\"]}],\"copyrightYear\":\"2026\",\"copyrightHolder\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#organization\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/nginxi-lets-encrypt-ile-ubuntu-uzerinde-guvenli-hale-getirme\/\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/nginxi-lets-encrypt-ile-ubuntu-uzerinde-guvenli-hale-getirme\/\",\"name\":\"Nginx'i Let's Encrypt ile Ubuntu \u00dczerinde G\u00fcvenli Hale Getirme - Kodlar\u0131n Gizemli D\u00fcnyas\u0131\",\"isPartOf\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#website\"},\"datePublished\":\"2026-01-13T19:41:40+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/nginxi-lets-encrypt-ile-ubuntu-uzerinde-guvenli-hale-getirme\/#breadcrumb\"},\"inLanguage\":\"tr\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/fatihsoysal.com\/blog\/nginxi-lets-encrypt-ile-ubuntu-uzerinde-guvenli-hale-getirme\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/nginxi-lets-encrypt-ile-ubuntu-uzerinde-guvenli-hale-getirme\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Anasayfa\",\"item\":\"https:\/\/fatihsoysal.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Nginx’i Let’s Encrypt ile Ubuntu \u00dczerinde G\u00fcvenli Hale Getirme\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#website\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/\",\"name\":\"Fatihsoysal.com\",\"description\":\"Blog - Yaz\u0131l\u0131m D\u00fcnyas\u0131 Tecr\u00fcbelerim\",\"publisher\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/fatihsoysal.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"tr\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\",\"name\":\"Fatih Soysal\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"tr\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png\",\"contentUrl\":\"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png\",\"width\":512,\"height\":512,\"caption\":\"Fatih Soysal\"},\"logo\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/\"},\"description\":\"Kullan\u0131m ve kodlama m\u00fckemmeliyetini odak alan uygulamalar olu\u015fturma deneyimine sahip, profesyonel olarak 15+ y\u0131l \u00fczeri deneyime sahip bir yaz\u0131l\u0131m m\u00fchendisi.\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/author\/fatihsoysal\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Nginx'i Let's Encrypt ile Ubuntu \u00dczerinde G\u00fcvenli Hale Getirme - Kodlar\u0131n Gizemli D\u00fcnyas\u0131","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/fatihsoysal.com\/blog\/nginxi-lets-encrypt-ile-ubuntu-uzerinde-guvenli-hale-getirme\/","og_locale":"tr_TR","og_type":"article","og_title":"Nginx'i Let's Encrypt ile Ubuntu \u00dczerinde G\u00fcvenli Hale Getirme","og_description":"Nginx'i Let's Encrypt ile Ubuntu \u00dczerinde G\u00fcvenli Hale Getirme \u0130nternet d\u00fcnyas\u0131nda g\u00fcvenlik her ge\u00e7en g\u00fcn daha da kritik hale geliyor. Web","og_url":"https:\/\/fatihsoysal.com\/blog\/nginxi-lets-encrypt-ile-ubuntu-uzerinde-guvenli-hale-getirme\/","og_site_name":"Kodlar\u0131n Gizemli D\u00fcnyas\u0131","article_published_time":"2026-01-13T19:41:40+00:00","author":"Fatih Soysal","twitter_card":"summary_large_image","twitter_misc":{"Yazan:":"Fatih Soysal","Tahmini okuma s\u00fcresi":"12 dakika"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/fatihsoysal.com\/blog\/nginxi-lets-encrypt-ile-ubuntu-uzerinde-guvenli-hale-getirme\/#article","isPartOf":{"@id":"https:\/\/fatihsoysal.com\/blog\/nginxi-lets-encrypt-ile-ubuntu-uzerinde-guvenli-hale-getirme\/"},"author":{"name":"Fatih Soysal","@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"headline":"Nginx’i Let’s Encrypt ile Ubuntu \u00dczerinde G\u00fcvenli Hale Getirme","datePublished":"2026-01-13T19:41:40+00:00","mainEntityOfPage":{"@id":"https:\/\/fatihsoysal.com\/blog\/nginxi-lets-encrypt-ile-ubuntu-uzerinde-guvenli-hale-getirme\/"},"wordCount":1891,"commentCount":0,"publisher":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"articleSection":["Ubuntu"],"inLanguage":"tr","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/fatihsoysal.com\/blog\/nginxi-lets-encrypt-ile-ubuntu-uzerinde-guvenli-hale-getirme\/#respond"]}],"copyrightYear":"2026","copyrightHolder":{"@id":"https:\/\/fatihsoysal.com\/blog\/#organization"}},{"@type":"WebPage","@id":"https:\/\/fatihsoysal.com\/blog\/nginxi-lets-encrypt-ile-ubuntu-uzerinde-guvenli-hale-getirme\/","url":"https:\/\/fatihsoysal.com\/blog\/nginxi-lets-encrypt-ile-ubuntu-uzerinde-guvenli-hale-getirme\/","name":"Nginx'i Let's Encrypt ile Ubuntu \u00dczerinde G\u00fcvenli Hale Getirme - Kodlar\u0131n Gizemli D\u00fcnyas\u0131","isPartOf":{"@id":"https:\/\/fatihsoysal.com\/blog\/#website"},"datePublished":"2026-01-13T19:41:40+00:00","breadcrumb":{"@id":"https:\/\/fatihsoysal.com\/blog\/nginxi-lets-encrypt-ile-ubuntu-uzerinde-guvenli-hale-getirme\/#breadcrumb"},"inLanguage":"tr","potentialAction":[{"@type":"ReadAction","target":["https:\/\/fatihsoysal.com\/blog\/nginxi-lets-encrypt-ile-ubuntu-uzerinde-guvenli-hale-getirme\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/fatihsoysal.com\/blog\/nginxi-lets-encrypt-ile-ubuntu-uzerinde-guvenli-hale-getirme\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Anasayfa","item":"https:\/\/fatihsoysal.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Nginx’i Let’s Encrypt ile Ubuntu \u00dczerinde G\u00fcvenli Hale Getirme"}]},{"@type":"WebSite","@id":"https:\/\/fatihsoysal.com\/blog\/#website","url":"https:\/\/fatihsoysal.com\/blog\/","name":"Fatihsoysal.com","description":"Blog - Yaz\u0131l\u0131m D\u00fcnyas\u0131 Tecr\u00fcbelerim","publisher":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/fatihsoysal.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"tr"},{"@type":["Person","Organization"],"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1","name":"Fatih Soysal","image":{"@type":"ImageObject","inLanguage":"tr","@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png","contentUrl":"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png","width":512,"height":512,"caption":"Fatih Soysal"},"logo":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/"},"description":"Kullan\u0131m ve kodlama m\u00fckemmeliyetini odak alan uygulamalar olu\u015fturma deneyimine sahip, profesyonel olarak 15+ y\u0131l \u00fczeri deneyime sahip bir yaz\u0131l\u0131m m\u00fchendisi.","url":"https:\/\/fatihsoysal.com\/blog\/author\/fatihsoysal\/"}]}},"yoast_meta":{"yoast_wpseo_title":"","yoast_wpseo_metadesc":"","yoast_wpseo_canonical":""},"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/37735","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/comments?post=37735"}],"version-history":[{"count":1,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/37735\/revisions"}],"predecessor-version":[{"id":37736,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/37735\/revisions\/37736"}],"wp:attachment":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/media?parent=37735"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/categories?post=37735"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/tags?post=37735"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}