G\u00fcn\u00fcm\u00fcz\u00fcn dijital d\u00fcnyas\u0131nda web sitelerinin g\u00fcvenli\u011fi, kullan\u0131c\u0131 verilerinin korunmas\u0131 ve arama motoru s\u0131ralamalar\u0131 i\u00e7in vazge\u00e7ilmez bir unsurdur. HTTP protokol\u00fc \u00fczerinden yap\u0131lan ileti\u015fimler \u015fifrelenmedi\u011fi i\u00e7in, hassas bilgiler (\u015fifreler, kredi kart\u0131 numaralar\u0131 vb.) \u00fc\u00e7\u00fcnc\u00fc taraflarca kolayca ele ge\u00e7irilebilir. Bu riski ortadan kald\u0131rmak i\u00e7in HTTPS (Hypertext Transfer Protocol Secure) protokol\u00fc kullan\u0131l\u0131r. HTTPS, SSL\/TLS (Secure Sockets Layer\/Transport Layer Security) sertifikalar\u0131 arac\u0131l\u0131\u011f\u0131yla istemci ve sunucu aras\u0131ndaki t\u00fcm ileti\u015fimi \u015fifreler.<\/p>\n
Nginx, y\u00fcksek performansl\u0131, \u00f6l\u00e7eklenebilir ve esnek bir web sunucusu ve ters proxy olarak d\u00fcnya genelinde milyonlarca web sitesi taraf\u0131ndan kullan\u0131lmaktad\u0131r. Nginx’i HTTPS ile g\u00fcvenli hale getirmek, web sitenizin g\u00fcvenilirli\u011fini art\u0131rman\u0131n ve kullan\u0131c\u0131lar\u0131n\u0131za g\u00fcvenli bir deneyim sunman\u0131n temel ad\u0131mlar\u0131ndan biridir. Geleneksel olarak, SSL\/TLS sertifikalar\u0131 \u00fccretli olup, belirli bir maliyet ve manuel yap\u0131land\u0131rma gerektiriyordu. Ancak Let’s Encrypt, bu durumu de\u011fi\u015ftirerek herkese \u00fccretsiz, otomatik ve a\u00e7\u0131k bir Sertifika Yetkilisi (CA) hizmeti sunmaktad\u0131r. Let’s Encrypt sayesinde, sertifika alma ve yenileme s\u00fcre\u00e7leri b\u00fcy\u00fck \u00f6l\u00e7\u00fcde basitle\u015ftirilmi\u015ftir.<\/p>\n
Bu kapsaml\u0131 teknik makale, Debian 8 (Jessie) i\u015fletim sistemi \u00fczerinde \u00e7al\u0131\u015fan bir Nginx web sunucusunu Let’s Encrypt sertifikalar\u0131yla nas\u0131l g\u00fcvenli hale getirece\u011finizi ad\u0131m ad\u0131m a\u00e7\u0131klayacakt\u0131r. Debian 8, g\u00fcncel bir da\u011f\u0131t\u0131m olmasa da, bir\u00e7ok sunucuda hala kullan\u0131lmaktad\u0131r ve bu rehber, eski sistemlerde bile modern g\u00fcvenlik standartlar\u0131n\u0131 sa\u011flamak isteyen y\u00f6neticilere yard\u0131mc\u0131 olmay\u0131 ama\u00e7lamaktad\u0131r. Makale boyunca, \u00f6n gereksinimlerden ba\u015flayarak, Certbot kurulumuna, sertifika alma ve Nginx yap\u0131land\u0131rmas\u0131na, otomatik yenilemeye ve ek g\u00fcvenlik iyile\u015ftirmelerine kadar t\u00fcm s\u00fcre\u00e7 detayl\u0131 bir \u015fekilde ele al\u0131nacakt\u0131r.<\/p>\n
Bu rehbere ba\u015flamadan \u00f6nce a\u015fa\u011f\u0131daki \u00f6n gereksinimlerin kar\u015f\u0131land\u0131\u011f\u0131ndan emin olmal\u0131s\u0131n\u0131z:<\/p>\n
* Debian 8 (Jessie) Sunucusu:<\/strong> \u00c7al\u0131\u015f\u0131r durumda bir Debian 8 sunucusuna sahip olmal\u0131s\u0131n\u0131z. E\u011fer Nginx sunucunuzda zaten kurulu ve yap\u0131land\u0131r\u0131lm\u0131\u015fsa, bu ad\u0131m\u0131 atlayabilirsiniz. Aksi takdirde, a\u015fa\u011f\u0131daki ad\u0131mlar\u0131 izleyerek Nginx’i kurun ve temel bir yap\u0131land\u0131rma yap\u0131n.<\/p>\n \u0130lk olarak, paket listelerinizi g\u00fcncelleyin ve mevcut paketleri y\u00fckseltin:<\/p>\n Nginx’i kurmak i\u00e7in a\u015fa\u011f\u0131daki komutu kullan\u0131n:<\/p>\n Kurulumdan sonra Nginx servisinin \u00e7al\u0131\u015ft\u0131\u011f\u0131ndan emin olun:<\/p>\n \u00c7\u0131kt\u0131da Varsay\u0131lan olarak Nginx, \u00d6ncelikle, web sitenizin k\u00f6k dizinini olu\u015fturun. \u00d6rne\u011fin, Test ama\u00e7l\u0131 basit bir \u015eimdi, alan ad\u0131n\u0131z i\u00e7in bir Nginx yap\u0131land\u0131rma dosyas\u0131 olu\u015fturun. \u00d6rne\u011fin, Dosyan\u0131n i\u00e7ine a\u015fa\u011f\u0131daki i\u00e7eri\u011fi yap\u0131\u015ft\u0131r\u0131n (alan ad\u0131n\u0131z\u0131 kendi alan ad\u0131n\u0131zla de\u011fi\u015ftirin):<\/p>\n Bu yap\u0131land\u0131rma, sunucunun 80 numaral\u0131 porttan gelen HTTP isteklerini dinlemesini, belirtilen k\u00f6k dizinden dosyalar\u0131 sunmas\u0131n\u0131 ve alan ad\u0131n\u0131z\u0131 tan\u0131mas\u0131n\u0131 sa\u011flar.<\/p>\n Yeni yap\u0131land\u0131rma dosyas\u0131n\u0131 etkinle\u015ftirmek i\u00e7in bir sembolik ba\u011f (symlink) olu\u015fturun ve varsay\u0131lan yap\u0131land\u0131rmay\u0131 devre d\u0131\u015f\u0131 b\u0131rak\u0131n:<\/p>\n Nginx yap\u0131land\u0131rman\u0131zda herhangi bir s\u00f6zdizimi hatas\u0131 olup olmad\u0131\u011f\u0131n\u0131 kontrol edin:<\/p>\n E\u011fer \u015eimdi web taray\u0131c\u0131n\u0131zdan E\u011fer UFW kullan\u0131yorsan\u0131z, HTTP ve HTTPS trafi\u011fine izin vermek i\u00e7in:<\/p>\n E\u011fer UFW kurulu de\u011filse ve iptables kullan\u0131yorsan\u0131z, port 80 ve 443’e izin veren kurallar eklemeniz gerekebilir.<\/p>\n Let’s Encrypt sertifikalar\u0131n\u0131 otomatik olarak almak ve y\u00f6netmek i\u00e7in Certbot istemcisini kullanaca\u011f\u0131z. Debian 8 (Jessie) eski bir da\u011f\u0131t\u0131m oldu\u011fu i\u00e7in, varsay\u0131lan depolardaki Certbot s\u00fcr\u00fcm\u00fc eski veya hi\u00e7 bulunmayabilir. Bu nedenle, Dosyan\u0131n sonuna a\u015fa\u011f\u0131daki sat\u0131r\u0131 ekleyin:<\/p>\n Dosyay\u0131 kaydedip kapat\u0131n (CTRL+X, Y, Enter).<\/p>\n Paket listelerinizi g\u00fcncelleyin:<\/p>\n \u015eimdi Certbot’u y\u00fckleyin:<\/p>\n Bu komut, Certbot’u kurduktan sonra, alan ad\u0131n\u0131z i\u00e7in bir SSL sertifikas\u0131 alabiliriz. A\u015fa\u011f\u0131daki komutu kullan\u0131n (alan ad\u0131n\u0131z\u0131 ve webroot dizininizi kendi bilgilerinizle de\u011fi\u015ftirin):<\/p>\n * Komutu \u00e7al\u0131\u015ft\u0131rd\u0131ktan sonra Certbot size baz\u0131 sorular soracakt\u0131r:<\/p>\n 1. E-posta Adresi:<\/strong> Sertifika bildirimleri ve kay\u0131p anahtar kurtarma i\u00e7in bir e-posta adresi girin. E\u011fer her \u015fey yolunda giderse, Certbot sertifikalar\u0131 ba\u015far\u0131yla alacak ve size a\u015fa\u011f\u0131daki gibi bir \u00e7\u0131kt\u0131 g\u00f6sterecektir:<\/p>\n Bu \u00e7\u0131kt\u0131, sertifika dosyalar\u0131n\u0131z\u0131n nerede sakland\u0131\u011f\u0131n\u0131 g\u00f6sterir. \u00d6zellikle Sertifikalar\u0131 ald\u0131ktan sonra, Nginx’i HTTPS trafi\u011fini dinleyecek ve bu sertifikalar\u0131 kullanacak \u015fekilde yap\u0131land\u0131rmam\u0131z gerekiyor. Ayr\u0131ca HTTP trafi\u011fini HTTPS’e y\u00f6nlendirece\u011fiz.<\/p>\n Ekstra g\u00fcvenlik i\u00e7in, g\u00fc\u00e7l\u00fc bir Diffie-Hellman grubu olu\u015fturmak iyi bir uygulamad\u0131r. Bu, anahtar de\u011fi\u015fimi s\u0131ras\u0131nda ileri gizlili\u011fi (Perfect Forward Secrecy) sa\u011flar. Bu i\u015flem biraz zaman alabilir (birka\u00e7 dakika):<\/p>\n Daha da g\u00fc\u00e7l\u00fc bir anahtar i\u00e7in 4096 bit kullanabilirsiniz, ancak bu i\u015flem daha da uzun s\u00fcrecektir.<\/p>\n Alan ad\u0131n\u0131z i\u00e7in daha \u00f6nce olu\u015fturdu\u011funuz Nginx yap\u0131land\u0131rma dosyas\u0131n\u0131 tekrar a\u00e7\u0131n:<\/p>\n Mevcut Dosyan\u0131n i\u00e7eri\u011fini a\u015fa\u011f\u0131daki gibi g\u00fcncelleyin (alan ad\u0131n\u0131z\u0131 de\u011fi\u015ftirmeyi unutmay\u0131n):<\/p>\n Yap\u0131land\u0131rma A\u00e7\u0131klamalar\u0131:<\/strong><\/p>\n * HTTP Y\u00f6nlendirme Blo\u011fu:<\/strong> \u0130lk Dosyay\u0131 kaydedip kapat\u0131n.<\/p>\n Nginx yap\u0131land\u0131rman\u0131zda herhangi bir s\u00f6zdizimi hatas\u0131 olup olmad\u0131\u011f\u0131n\u0131 tekrar kontrol edin:<\/p>\n E\u011fer \u015eimdi web taray\u0131c\u0131n\u0131zdan Let’s Encrypt sertifikalar\u0131 90 g\u00fcn boyunca ge\u00e7erlidir. Bu nedenle, sertifikalar\u0131n s\u00fcresi dolmadan \u00f6nce otomatik olarak yenilenmesi \u00e7ok \u00f6nemlidir. Certbot, bu i\u015flemi otomatikle\u015ftirmek i\u00e7in tasarlanm\u0131\u015ft\u0131r.<\/p>\n Certbot, kurulum s\u0131ras\u0131nda genellikle otomatik olarak bir Yenileme mekanizmas\u0131n\u0131n do\u011fru \u00e7al\u0131\u015ft\u0131\u011f\u0131n\u0131 test etmek i\u00e7in E\u011fer bu komut herhangi bir hata mesaj\u0131 vermeden ba\u015far\u0131l\u0131 bir \u015fekilde tamamlan\u0131rsa, otomatik yenileme mekanizman\u0131z\u0131n d\u00fczg\u00fcn \u00e7al\u0131\u015ft\u0131\u011f\u0131 anlam\u0131na gelir.<\/p>\n \u00d6nemli Not:<\/strong> Certbot sertifikalar\u0131 yeniledi\u011finde, Nginx’in yeni sertifikalar\u0131 kullanmaya ba\u015flamas\u0131 i\u00e7in yeniden y\u00fcklenmesi gerekir. Certbot’un varsay\u0131lan yenileme beti\u011fi Nginx’i yeniden y\u00fcklemeyebilir. Bunu sa\u011flamak i\u00e7in, Bu komut, yenileme ba\u015far\u0131l\u0131 oldu\u011funda Nginx’i yeniden y\u00fckleyecektir. Certbot’un otomatik \u00d6rnek bir cron girdisi (farkl\u0131l\u0131k g\u00f6sterebilir):<\/p>\n E\u011fer Nginx ve Let’s Encrypt ile temel HTTPS yap\u0131land\u0131rmas\u0131n\u0131 tamamlad\u0131k. Ancak, web sitenizin g\u00fcvenli\u011fini daha da art\u0131rmak i\u00e7in baz\u0131 ek ayarlar yapabiliriz. Yukar\u0131daki Nginx yap\u0131land\u0131rmas\u0131nda bu ayarlar\u0131n \u00e7o\u011fu zaten eklenmi\u015fti, ancak burada \u00f6nemlerini ve detaylar\u0131n\u0131 tekrar vurgulayal\u0131m.<\/p>\n HSTS, web sitenizin yaln\u0131zca HTTPS \u00fczerinden eri\u015filebilir olmas\u0131n\u0131 sa\u011flayan bir g\u00fcvenlik politikas\u0131d\u0131r. Bir kullan\u0131c\u0131 sitenizi HTTPS \u00fczerinden ziyaret etti\u011finde, sunucu taray\u0131c\u0131ya “gelecekte bu siteye sadece HTTPS ile ba\u011flan” talimat\u0131n\u0131 g\u00f6nderir. Bu, taray\u0131c\u0131n\u0131n HTTP isteklerini otomatik olarak HTTPS’e \u00e7evirmesini sa\u011flar ve ortadaki adam sald\u0131r\u0131lar\u0131n\u0131 \u00f6nler.<\/p>\n Nginx yap\u0131land\u0131rman\u0131zda a\u015fa\u011f\u0131daki ba\u015fl\u0131\u011f\u0131 ekleyerek HSTS’yi etkinle\u015ftirebilirsiniz:<\/p>\n * OCSP (Online Certificate Status Protocol) Stapling, sunucunun sertifika yetkilisinden (CA) bir sertifikan\u0131n iptal durumu hakk\u0131nda g\u00fcncel bilgileri almas\u0131n\u0131 ve bu bilgiyi TLS el s\u0131k\u0131\u015fmas\u0131 s\u0131ras\u0131nda istemciye “z\u0131mbalamas\u0131n\u0131” sa\u011flar. Bu, istemcinin CA’ya do\u011frudan sorgu g\u00f6ndermesine gerek kalmadan sertifikan\u0131n durumunu h\u0131zl\u0131 ve gizlili\u011fe sayg\u0131l\u0131 bir \u015fekilde do\u011frulamas\u0131na olanak tan\u0131r.<\/p>\n Nginx yap\u0131land\u0131rman\u0131zda OCSP Stapling’i etkinle\u015ftirmek i\u00e7in:<\/p>\n G\u00fcvenli bir HTTPS ba\u011flant\u0131s\u0131 i\u00e7in, yaln\u0131zca g\u00fcncel ve g\u00fc\u00e7l\u00fc TLS protokollerini ve \u015fifreleme s\u00fcitlerini kullanmak \u00e7ok \u00f6nemlidir. Eski ve zay\u0131f protokoller (SSLv2, SSLv3, TLSv1.0, TLSv1.1) g\u00fcvenlik a\u00e7\u0131klar\u0131 i\u00e7erebilir ve devre d\u0131\u015f\u0131 b\u0131rak\u0131lmal\u0131d\u0131r.<\/p>\n Nginx yap\u0131land\u0131rman\u0131zda \u00f6nerilen ayarlar:<\/p>\n Bu yap\u0131land\u0131rma, yaln\u0131zca TLS 1.2 ve TLS 1.3’\u00fc etkinle\u015ftirir ve modern, g\u00fcvenli \u015fifreleme s\u00fcitlerini tercih eder. Yukar\u0131daki Nginx yap\u0131land\u0131rmas\u0131nda eklenen di\u011fer g\u00fcvenlik ba\u015fl\u0131klar\u0131 da web sitenizi \u00e7e\u015fitli sald\u0131r\u0131 t\u00fcrlerine kar\u015f\u0131 korur:<\/p>\n * Bu g\u00fcvenlik ba\u015fl\u0131klar\u0131, Nginx yap\u0131land\u0131rmas\u0131na Kurulum ve yap\u0131land\u0131rma s\u0131ras\u0131nda baz\u0131 sorunlarla kar\u015f\u0131la\u015fmak olas\u0131d\u0131r. \u0130\u015fte s\u0131k kar\u015f\u0131la\u015f\u0131lan sorunlar ve olas\u0131 \u00e7\u00f6z\u00fcmleri:<\/p>\n * Firewall Engeli:<\/strong> E\u011fer web sitenize HTTP veya HTTPS \u00fczerinden eri\u015femiyorsan\u0131z, g\u00fcvenlik duvar\u0131n\u0131z\u0131n (UFW\/iptables) 80 ve 443 portlar\u0131na izin verdi\u011finden emin olun.<\/p>\n * DNS Sorunlar\u0131:<\/strong> Alan ad\u0131n\u0131z\u0131n sunucunuzun do\u011fru IP adresine y\u00f6nlendirilmedi\u011finden emin olun. * Nginx S\u00f6zdizimi Hatalar\u0131:<\/strong> Nginx yap\u0131land\u0131rma dosyalar\u0131n\u0131zda bir hata varsa, Bu rehberde, Debian 8 i\u015fletim sistemi \u00fczerinde Nginx web sunucunuzu Let’s Encrypt sertifikalar\u0131yla g\u00fcvenli hale getirmenin t\u00fcm ad\u0131mlar\u0131n\u0131 ayr\u0131nt\u0131l\u0131 olarak inceledik. Nginx kurulumundan ba\u015flayarak, Certbot istemcisini kullanarak \u00fccretsiz SSL\/TLS sertifikalar\u0131 almay\u0131, Nginx’i HTTPS trafi\u011fini y\u00f6netecek \u015fekilde yap\u0131land\u0131rmay\u0131, HTTP’yi HTTPS’e y\u00f6nlendirmeyi ve sertifikalar\u0131n otomatik yenilenmesini sa\u011flamay\u0131 \u00f6\u011frendik. Ayr\u0131ca, HSTS, OCSP Stapling ve g\u00fc\u00e7l\u00fc TLS protokolleri\/\u015fifreleme s\u00fcitleri gibi geli\u015fmi\u015f g\u00fcvenlik \u00f6nlemlerini uygulayarak web sitenizin g\u00fcvenli\u011fini daha da art\u0131rma yollar\u0131n\u0131 ele ald\u0131k.<\/p>\n Web sitenizi HTTPS ile korumak, g\u00fcn\u00fcm\u00fcz\u00fcn internet ortam\u0131nda bir zorunluluktur. Kullan\u0131c\u0131lar\u0131n\u0131z\u0131n verilerini korur, arama motoru s\u0131ralamalar\u0131n\u0131z\u0131 iyile\u015ftirir ve web sitenize olan g\u00fcveni art\u0131r\u0131r. Let’s Encrypt sayesinde, bu g\u00fcvenlik seviyesine ula\u015fmak hi\u00e7 bu kadar kolay ve \u00fccretsiz olmam\u0131\u015ft\u0131. Unutmay\u0131n, g\u00fcvenlik s\u00fcrekli bir s\u00fcre\u00e7tir. Sertifikalar\u0131n\u0131z\u0131n d\u00fczenli olarak yenilendi\u011finden, Nginx yap\u0131land\u0131rman\u0131z\u0131n g\u00fcncel g\u00fcvenlik tavsiyelerine uygun oldu\u011fundan ve sunucunuzun genel g\u00fcvenli\u011finin sa\u011fland\u0131\u011f\u0131ndan emin olmak i\u00e7in d\u00fczenli kontroller yapmaya devam edin. Bu rehber, g\u00fcvenli bir web deneyimi i\u00e7in sa\u011flam bir temel olu\u015fturman\u0131za yard\u0131mc\u0131 olacakt\u0131r.<\/body><\/p>\n","protected":false},"excerpt":{"rendered":"Nginx’i Debian 8 \u00dczerinde Let’s Encrypt ile G\u00fcvenli Hale Getirme Giri\u015f G\u00fcn\u00fcm\u00fcz\u00fcn dijital d\u00fcnyas\u0131nda web sitelerinin g\u00fcvenli\u011fi, kullan\u0131c\u0131 verilerinin korunmas\u0131 ve arama motoru s\u0131ralamalar\u0131 i\u00e7in vazge\u00e7ilmez bir unsurdur.","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"csco_page_header_type":"","csco_page_load_nextpost":"","csco_page_subscribe_form":"","csco_page_contact_form":"","footnotes":""},"categories":[241],"tags":[],"class_list":{"0":"post-41036","1":"post","2":"type-post","3":"status-publish","4":"format-standard","6":"category-linux","7":"cs-entry","8":"cs-video-wrap"},"yoast_head":"\n
\n* Nginx Kurulumu:<\/strong> Sunucunuzda Nginx’in kurulu ve en az\u0131ndan bir alan ad\u0131 i\u00e7in HTTP \u00fczerinden \u00e7al\u0131\u015f\u0131r durumda olmas\u0131 gerekmektedir. E\u011fer Nginx kurulu de\u011filse, sonraki b\u00f6l\u00fcmde kurulum ad\u0131mlar\u0131 g\u00f6sterilecektir.
\n* Alan Ad\u0131:<\/strong> Sunucunuzun IP adresine y\u00f6nlendirilmi\u015f (A\/AAAA kayd\u0131) bir alan ad\u0131na sahip olmal\u0131s\u0131n\u0131z (\u00f6rne\u011fin, ornekalanadi.com<\/code>). Let’s Encrypt, sertifika verirken bu alan ad\u0131n\u0131n kontrol\u00fcn\u00fc do\u011frular.
\n* SSH Eri\u015fimi ve Sudo Yetkileri:<\/strong> Sunucuya SSH \u00fczerinden eri\u015fiminiz ve sudo<\/code> komutunu kullanma yetkiniz olmal\u0131d\u0131r.
\n* G\u00fcvenlik Duvar\u0131 (Firewall) Ayarlar\u0131:<\/strong> Sunucunuzun g\u00fcvenlik duvar\u0131n\u0131n (UFW veya iptables) 80 (HTTP) ve 443 (HTTPS) portlar\u0131na gelen ba\u011flant\u0131lara izin verdi\u011finden emin olun.<\/p>\nNginx Kurulumu ve Temel Yap\u0131land\u0131rma<\/h3>\n
Sistem G\u00fcncellemesi<\/h4>\n
sudo apt update\nsudo apt upgrade -y<\/code><\/pre>\nNginx Kurulumu<\/h4>\n
sudo apt install nginx -y<\/code><\/pre>\nsudo systemctl status nginx<\/code><\/pre>\nactive (running)<\/code> ibaresini g\u00f6rmelisiniz.<\/p>\nNginx Temel Yap\u0131land\u0131rmas\u0131<\/h4>\n
\/etc\/nginx\/sites-available\/default<\/code> dosyas\u0131nda bir yap\u0131land\u0131rma blo\u011fu ile gelir. Kendi alan ad\u0131n\u0131z i\u00e7in yeni bir yap\u0131land\u0131rma dosyas\u0131 olu\u015fturmak daha iyi bir uygulamad\u0131r.<\/p>\nornekalanadi.com<\/code> i\u00e7in:<\/p>\nsudo mkdir -p \/var\/www\/ornekalanadi.com\/html<\/code><\/pre>\nindex.html<\/code> dosyas\u0131 olu\u015fturun:<\/p>\necho \"Merhaba D\u00fcnya! Bu Nginx sunucunuzun test sayfas\u0131d\u0131r.\" | sudo tee \/var\/www\/ornekalanadi.com\/html\/index.html<\/code><\/pre>\n\/etc\/nginx\/sites-available\/ornekalanadi.com<\/code> ad\u0131nda bir dosya olu\u015fturun:<\/p>\nsudo nano \/etc\/nginx\/sites-available\/ornekalanadi.com<\/code><\/pre>\nserver {\n listen 80;\n listen [::]:80;\n\n root \/var\/www\/ornekalanadi.com\/html;\n index index.html index.htm index.nginx-debian.html;\n\n server_name ornekalanadi.com www.ornekalanadi.com;\n\n location \/ {\n try_files $uri $uri\/ =404;\n }\n}<\/code><\/pre>\nsudo ln -s \/etc\/nginx\/sites-available\/ornekalanadi.com \/etc\/nginx\/sites-enabled\/\nsudo rm \/etc\/nginx\/sites-enabled\/default<\/code><\/pre>\nsudo nginx -t<\/code><\/pre>\ntest is successful<\/code> mesaj\u0131n\u0131 g\u00f6r\u00fcrseniz, Nginx servisini yeniden y\u00fckleyin:<\/p>\nsudo systemctl reload nginx<\/code><\/pre>\nhttp:\/\/ornekalanadi.com<\/code> adresine giderek Nginx’in do\u011fru \u00e7al\u0131\u015ft\u0131\u011f\u0131n\u0131 do\u011frulayabilirsiniz.<\/p>\nG\u00fcvenlik Duvar\u0131 Ayarlar\u0131<\/h4>\n
sudo ufw allow 'Nginx HTTP'\nsudo ufw allow 'Nginx HTTPS'\nsudo ufw allow 'OpenSSH'\nsudo ufw enable<\/code><\/pre>\nCertbot Kurulumu<\/h3>\n
jessie-backports<\/code> deposunu etkinle\u015ftirerek daha g\u00fcncel bir Certbot s\u00fcr\u00fcm\u00fcn\u00fc y\u00fcklememiz gerekecektir.<\/p>\nJessie-Backports Deposunu Ekleme<\/h4>\n
\/etc\/apt\/sources.list<\/code> dosyan\u0131z\u0131 a\u00e7\u0131n:<\/p>\nsudo nano \/etc\/apt\/sources.list<\/code><\/pre>\ndeb http:\/\/ftp.debian.org\/debian jessie-backports main contrib non-free<\/code><\/pre>\nsudo apt update<\/code><\/pre>\nCertbot Kurulumu<\/h4>\n
jessie-backports<\/code> deposundan Certbot’u y\u00fckleyebilirsiniz. Nginx i\u00e7in \u00f6zel bir eklenti olan python-certbot-nginx<\/code> de mevcuttur, ancak Debian 8’de bu eklentinin sorunsuz \u00e7al\u0131\u015f\u0131p \u00e7al\u0131\u015fmad\u0131\u011f\u0131 garanti de\u011fildir. En g\u00fcvenli y\u00f6ntem, certbot certonly --webroot<\/code> kullanarak sertifikay\u0131 almak ve Nginx yap\u0131land\u0131rmas\u0131n\u0131 manuel olarak yapmakt\u0131r. Bu y\u00f6ntem, Certbot’un web sitenizin k\u00f6k dizinine ge\u00e7ici bir dosya yerle\u015ftirerek alan ad\u0131 sahipli\u011fini do\u011frulamas\u0131na dayan\u0131r.<\/p>\nsudo apt install certbot -t jessie-backports<\/code><\/pre>\njessie-backports<\/code> deposundan Certbot’un en g\u00fcncel s\u00fcr\u00fcm\u00fcn\u00fc y\u00fcklemeye \u00e7al\u0131\u015facakt\u0131r.<\/p>\nLet’s Encrypt SSL Sertifikas\u0131 Alma<\/h3>\n
webroot<\/code> eklentisini kullanarak sertifika alaca\u011f\u0131z. Bu y\u00f6ntem, Certbot’un belirli bir dizine (webroot) ge\u00e7ici dosyalar yerle\u015ftirmesini ve Let’s Encrypt sunucular\u0131n\u0131n bu dosyalara HTTP \u00fczerinden eri\u015ferek alan ad\u0131n\u0131z\u0131n kontrol\u00fcn\u00fc do\u011frulamas\u0131n\u0131 gerektirir.<\/p>\nsudo certbot certonly --webroot -w \/var\/www\/ornekalanadi.com\/html -d ornekalanadi.com -d www.ornekalanadi.com<\/code><\/pre>\ncertonly<\/code>: Yaln\u0131zca sertifika al, Nginx yap\u0131land\u0131rmas\u0131n\u0131 otomatik yapma.
\n* --webroot<\/code>: Webroot eklentisini kullan.
\n* -w \/var\/www\/ornekalanadi.com\/html<\/code>: Web sitenizin k\u00f6k dizini. Certbot, bu dizine do\u011frulama dosyalar\u0131n\u0131 yerle\u015ftirecektir.
\n* -d ornekalanadi.com<\/code>: Sertifika almak istedi\u011finiz birincil alan ad\u0131.
\n* -d www.ornekalanadi.com<\/code>: Sertifika almak istedi\u011finiz di\u011fer alan ad\u0131 (\u00f6rne\u011fin, www \u00f6n ekli).<\/p>\n
\n2. Hizmet \u015eartlar\u0131:<\/strong> Let’s Encrypt hizmet \u015fartlar\u0131n\u0131 kabul etmeniz istenecektir. Kabul etmek i\u00e7in A<\/code> (Agree) yaz\u0131p Enter tu\u015funa bas\u0131n.
\n3. EFF B\u00fclteni:<\/strong> EFF (Electronic Frontier Foundation) b\u00fcltenine abone olmak isteyip istemedi\u011finiz sorulacakt\u0131r. Y<\/code> (Yes) veya N<\/code> (No) yaz\u0131p Enter tu\u015funa bas\u0131n.<\/p>\nIMPORTANT NOTES:\n - Congratulations! Your certificate and chain have been saved at:\n \/etc\/letsencrypt\/live\/ornekalanadi.com\/fullchain.pem\n Your key file has been saved at:\n \/etc\/letsencrypt\/live\/ornekalanadi.com\/privkey.pem\n ...<\/code><\/pre>\n\/etc\/letsencrypt\/live\/ornekalanadi.com\/<\/code> dizini, sertifikan\u0131z\u0131n, \u00f6zel anahtar\u0131n\u0131z\u0131n ve zincir dosyalar\u0131n\u0131z\u0131n sembolik ba\u011flant\u0131lar\u0131n\u0131 i\u00e7erir. Bu ba\u011flant\u0131lar her yenilemede g\u00fcncellenecektir, bu y\u00fczden Nginx yap\u0131land\u0131rman\u0131zda bu live<\/code> dizinindeki yollar\u0131 kullanmal\u0131s\u0131n\u0131z.<\/p>\nNginx’i SSL Kullanacak \u015eekilde Yap\u0131land\u0131rma<\/h3>\n
Diffie-Hellman Parametreleri Olu\u015fturma<\/h4>\n
sudo openssl dhparam -out \/etc\/nginx\/dhparam.pem 2048<\/code><\/pre>\nNginx SSL Yap\u0131land\u0131rmas\u0131<\/h4>\n
sudo nano \/etc\/nginx\/sites-available\/ornekalanadi.com<\/code><\/pre>\nserver<\/code> blo\u011funu iki ayr\u0131 server<\/code> blo\u011funa ay\u0131raca\u011f\u0131z: biri HTTP (port 80) i\u00e7in, di\u011feri HTTPS (port 443) i\u00e7in. HTTP blo\u011fu, t\u00fcm istekleri HTTPS blo\u011funa y\u00f6nlendirecektir.<\/p>\n# HTTP trafi\u011fini HTTPS'e y\u00f6nlendirme\nserver {\n listen 80;\n listen [::]:80;\n server_name ornekalanadi.com www.ornekalanadi.com;\n\n # Certbot do\u011frulama dosyalar\u0131 i\u00e7in \u00f6zel lokasyon\n location ~ \/.well-known\/acme-challenge {\n allow all;\n root \/var\/www\/ornekalanadi.com\/html;\n }\n\n return 301 https:\/\/$host$request_uri;\n}\n\nHTTPS yap\u0131land\u0131rmas\u0131<\/h2>\nserver {\n listen 443 ssl http2;\n listen [::]:443 ssl http2;\n server_name ornekalanadi.com www.ornekalanadi.com;\n\n root \/var\/www\/ornekalanadi.com\/html;\n index index.html index.htm index.nginx-debian.html;\n\n ssl_certificate \/etc\/letsencrypt\/live\/ornekalanadi.com\/fullchain.pem;\n ssl_certificate_key \/etc\/letsencrypt\/live\/ornekalanadi.com\/privkey.pem;\n\n ssl_session_cache shared:SSL:10m;\n ssl_session_timeout 10m;\n ssl_protocols TLSv1.2 TLSv1.3; # Yaln\u0131zca g\u00fcvenli protokolleri kullan\u0131n\n ssl_ciphers \"ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384\";\n ssl_prefer_server_ciphers on;\n ssl_dhparam \/etc\/nginx\/dhparam.pem; # Olu\u015fturdu\u011fumuz Diffie-Hellman parametresi\n\n # OCSP Stapling (sertifika iptal kontrol\u00fc)\n ssl_stapling on;\n ssl_stapling_verify on;\n resolver 8.8.8.8 8.8.4.4 valid=300s; # Google DNS veya kendi g\u00fcvenilir DNS sunucunuzu kullan\u0131n\n resolver_timeout 5s;\n\n # HSTS (HTTP Strict Transport Security)\n add_header Strict-Transport-Security \"max-age=63072000; includeSubDomains; preload\" always;\n\n # G\u00fcvenlik ba\u015fl\u0131klar\u0131 (iste\u011fe ba\u011fl\u0131 ama \u00f6nerilir)\n add_header X-Frame-Options \"DENY\" always;\n add_header X-Content-Type-Options \"nosniff\" always;\n add_header X-XSS-Protection \"1; mode=block\" always;\n add_header Referrer-Policy \"no-referrer-when-downgrade\" always;\n\n location \/ {\n try_files $uri $uri\/ =404;\n }\n}<\/code><\/pre>\n
server<\/code> blo\u011fu, 80 numaral\u0131 porttan gelen t\u00fcm HTTP isteklerini yakalar ve return 301 https:\/\/$host$request_uri;<\/code> komutu ile kal\u0131c\u0131 olarak HTTPS’e y\u00f6nlendirir.
\n* .well-known\/acme-challenge<\/code>:<\/strong> Certbot’un sertifikay\u0131 yenilerken kullanaca\u011f\u0131 do\u011frulama dosyalar\u0131na eri\u015fmesine izin veren \u00f6zel bir lokasyon blo\u011fudur. Bu, HTTP y\u00f6nlendirmesi olsa bile Certbot’un \u00e7al\u0131\u015fmas\u0131n\u0131 sa\u011flar.
\n* HTTPS Blo\u011fu:<\/strong> \u0130kinci server<\/code> blo\u011fu, 443 numaral\u0131 porttan gelen HTTPS isteklerini dinler.
\n* ssl_certificate<\/code> ve ssl_certificate_key<\/code>: Let’s Encrypt taraf\u0131ndan sa\u011flanan sertifika ve \u00f6zel anahtar dosyalar\u0131n\u0131n yollar\u0131n\u0131 belirtir.
\n* ssl_protocols<\/code>: Yaln\u0131zca g\u00fcvenli TLS protokollerini (TLSv1.2 ve TLSv1.3) kullan\u0131r. Eski ve zay\u0131f protokolleri devre d\u0131\u015f\u0131 b\u0131rak\u0131r.
\n* ssl_ciphers<\/code>: G\u00fc\u00e7l\u00fc \u015fifreleme s\u00fcitlerini belirler. Bu liste, g\u00fcncel g\u00fcvenlik tavsiyelerine g\u00f6re se\u00e7ilmi\u015ftir.
\n* ssl_prefer_server_ciphers on<\/code>: Sunucunun \u015fifreleme s\u00fcitleri se\u00e7iminde \u00f6ncelikli olmas\u0131n\u0131 sa\u011flar.
\n* ssl_dhparam<\/code>: Daha \u00f6nce olu\u015fturdu\u011fumuz Diffie-Hellman parametre dosyas\u0131n\u0131 belirtir.
\n* OCSP Stapling:<\/strong> Sertifikan\u0131z\u0131n iptal edilip edilmedi\u011fini kontrol etmek i\u00e7in bir mekanizmad\u0131r. Bu, taray\u0131c\u0131lar\u0131n CA’ya do\u011frudan sorgu g\u00f6ndermesini engeller ve gizlili\u011fi art\u0131r\u0131r. resolver<\/code> direktifi, DNS sorgular\u0131 i\u00e7in kullan\u0131lacak sunucuyu belirtir.
\n* HSTS (HTTP Strict Transport Security):<\/strong> Taray\u0131c\u0131lara, belirli bir s\u00fcre boyunca (burada 2 y\u0131l) sitenize yaln\u0131zca HTTPS \u00fczerinden eri\u015fmeleri gerekti\u011fini bildiren bir g\u00fcvenlik mekanizmas\u0131d\u0131r. Bu, ortadaki adam sald\u0131r\u0131lar\u0131n\u0131 (man-in-the-middle attacks) \u00f6nlemeye yard\u0131mc\u0131 olur. preload<\/code> se\u00e7ene\u011fi, taray\u0131c\u0131lar\u0131n \u00f6n y\u00fckleme listelerine sitenizi eklemesini sa\u011flar.
\n* G\u00fcvenlik Ba\u015fl\u0131klar\u0131:<\/strong> X-Frame-Options<\/code>, X-Content-Type-Options<\/code>, X-XSS-Protection<\/code> ve Referrer-Policy<\/code> gibi ba\u015fl\u0131klar, \u00e7e\u015fitli taray\u0131c\u0131 tabanl\u0131 g\u00fcvenlik a\u00e7\u0131klar\u0131n\u0131 azaltmaya yard\u0131mc\u0131 olur.<\/p>\nsudo nginx -t<\/code><\/pre>\ntest is successful<\/code> mesaj\u0131n\u0131 al\u0131rsan\u0131z, Nginx servisini yeniden y\u00fckleyin:<\/p>\nsudo systemctl reload nginx<\/code><\/pre>\nhttp:\/\/ornekalanadi.com<\/code> adresine gidin. Otomatik olarak https:\/\/ornekalanadi.com<\/code> adresine y\u00f6nlendirilmeniz ve taray\u0131c\u0131n\u0131zda bir kilit simgesi g\u00f6rmeniz gerekir. Bu, sitenizin art\u0131k g\u00fcvenli bir HTTPS ba\u011flant\u0131s\u0131 \u00fczerinden sunuldu\u011fu anlam\u0131na gelir. SSL Labs gibi bir ara\u00e7la sitenizin SSL yap\u0131land\u0131rmas\u0131n\u0131 test ederek A veya A+ derecesi ald\u0131\u011f\u0131n\u0131zdan emin olabilirsiniz.<\/p>\nSSL Sertifikas\u0131n\u0131n Otomatik Yenilenmesi<\/h3>\n
cron<\/code> i\u015fi veya systemd<\/code> zamanlay\u0131c\u0131s\u0131 (Debian 8 i\u00e7in cron<\/code> daha olas\u0131d\u0131r) olu\u015fturur. Bu g\u00f6rev, sertifikalar\u0131 s\u00fcresi dolmadan \u00f6nce kontrol eder ve yeniler. Varsay\u0131lan olarak, bu g\u00f6rev g\u00fcnde iki kez \u00e7al\u0131\u015f\u0131r ve yaln\u0131zca sertifikan\u0131n s\u00fcresi dolmak \u00fczereyse (genellikle 30 g\u00fcn i\u00e7inde) yenileme yapar.<\/p>\ndry-run<\/code> (deneme \u00e7al\u0131\u015ft\u0131rmas\u0131) se\u00e7ene\u011fini kullanabilirsiniz:<\/p>\nsudo certbot renew --dry-run<\/code><\/pre>\nrenew<\/code> komutuna bir --post-hook<\/code> ekleyebilirsiniz:<\/p>\nsudo certbot renew --post-hook \"systemctl reload nginx\"<\/code><\/pre>\ncron<\/code> i\u015fini d\u00fczenleyerek bu --post-hook<\/code> se\u00e7ene\u011fini kal\u0131c\u0131 hale getirebilirsiniz. cron<\/code> i\u015fleri genellikle \/etc\/cron.d\/certbot<\/code> veya \/etc\/crontab<\/code> dosyas\u0131nda bulunur.<\/p>\nsudo nano \/etc\/cron.d\/certbot<\/code> komutuyla dosyay\u0131 a\u00e7\u0131n ve certbot renew<\/code> komutunun sonuna --post-hook \"systemctl reload nginx\"<\/code> ekleyin.<\/p>\n0 \/12 <\/em> <\/em> root test -x \/usr\/bin\/certbot -a \\! -d \/run\/systemd\/system && perl -e 'sleep int(rand(3600))' && certbot renew --nginx --quiet --post-hook \"systemctl reload nginx\"<\/code><\/pre>\ncertbot<\/code> komutunu webroot<\/code> ile kulland\u0131ysan\u0131z, --nginx<\/code> yerine certonly --webroot -w \/path\/to\/webroot<\/code> kullanman\u0131z gerekebilir. En basit haliyle, sadece certbot renew --post-hook \"systemctl reload nginx\"<\/code> komutunun \u00e7al\u0131\u015fmas\u0131n\u0131 sa\u011flayan bir cron girdisi yeterli olacakt\u0131r.<\/p>\nG\u00fcvenlik Ayarlar\u0131n\u0131 Geli\u015ftirme<\/h3>\n
HTTP Strict Transport Security (HSTS)<\/h4>\n
add_header Strict-Transport-Security \"max-age=63072000; includeSubDomains; preload\" always;<\/code><\/pre>\nmax-age<\/code>: Taray\u0131c\u0131n\u0131n bu politikay\u0131 ne kadar s\u00fcreyle hat\u0131rlayaca\u011f\u0131n\u0131 saniye cinsinden belirtir (63072000 saniye = 2 y\u0131l).
\n* includeSubDomains<\/code>: Bu politikan\u0131n t\u00fcm alt alan adlar\u0131 i\u00e7in de ge\u00e7erli olmas\u0131n\u0131 sa\u011flar.
\n* preload<\/code>: Sitenizin HSTS \u00f6n y\u00fckleme listelerine dahil edilmesini sa\u011flar. Bu, taray\u0131c\u0131lar\u0131n sitenizi hi\u00e7 HTTP \u00fczerinden ziyaret etmeden bile HTTPS ile ba\u011flanmas\u0131n\u0131 sa\u011flar. \u00d6n y\u00fckleme i\u00e7in hstspreload.org adresine ba\u015fvurman\u0131z gerekir.<\/p>\nOCSP Stapling<\/h4>\n
ssl_stapling on;\nssl_stapling_verify on;\nresolver 8.8.8.8 8.8.4.4 valid=300s; # G\u00fcvenilir DNS sunucular\u0131n\u0131z\u0131 kullan\u0131n\nresolver_timeout 5s;<\/code><\/pre>\nresolver<\/code> direktifi, Nginx’in OCSP sorgular\u0131 i\u00e7in kullanaca\u011f\u0131 DNS sunucular\u0131n\u0131 belirtir. Google DNS (8.8.8.8, 8.8.4.4) yayg\u0131n olarak kullan\u0131l\u0131r, ancak kendi g\u00fcvenilir DNS sunucular\u0131n\u0131z\u0131 da kullanabilirsiniz.<\/p>\nTLS Protokolleri ve \u015eifreleme S\u00fcitleri<\/h4>\n
ssl_protocols TLSv1.2 TLSv1.3;\nssl_ciphers \"ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384\";\nssl_prefer_server_ciphers on;<\/code><\/pre>\nssl_prefer_server_ciphers on<\/code> direktifi, sunucunun istemcinin \u00f6nerdi\u011fi yerine kendi tercih etti\u011fi \u015fifreleme s\u00fcitlerini kullanmas\u0131n\u0131 sa\u011flar, b\u00f6ylece daha g\u00fc\u00e7l\u00fc olanlar se\u00e7ilir.<\/p>\nDi\u011fer G\u00fcvenlik Ba\u015fl\u0131klar\u0131<\/h4>\n
X-Frame-Options \"DENY\"<\/code>: Clickjacking sald\u0131r\u0131lar\u0131n\u0131 \u00f6nlemek i\u00e7in sitenizin ba\u015fka sitelerde iframe i\u00e7inde g\u00f6r\u00fcnt\u00fclenmesini engeller.
\n* X-Content-Type-Options \"nosniff\"<\/code>: Taray\u0131c\u0131lar\u0131n bir dosyan\u0131n Content-Type<\/code> ba\u015fl\u0131\u011f\u0131n\u0131 g\u00f6z ard\u0131 ederek i\u00e7erik t\u00fcr\u00fcn\u00fc tahmin etmesini engeller. Bu, MIME t\u00fcr\u00fc sald\u0131r\u0131lar\u0131n\u0131 \u00f6nler.
\n* X-XSS-Protection \"1; mode=block\"<\/code>: Taray\u0131c\u0131lar\u0131n yerle\u015fik XSS (Cross-Site Scripting) filtrelerini etkinle\u015ftirir.
\n* Referrer-Policy \"no-referrer-when-downgrade\"<\/code>: Y\u00f6nlendiren bilgisini (referrer) yaln\u0131zca HTTPS’ten HTTPS’e ge\u00e7erken g\u00f6ndermesini sa\u011flar, HTTP’ye d\u00fc\u015f\u00fc\u015flerde g\u00f6ndermez. Bu, hassas bilgilerin HTTP \u00fczerinden s\u0131zmas\u0131n\u0131 engeller.<\/p>\nadd_header<\/code> direktifiyle eklenir ve always<\/code> anahtar kelimesiyle her zaman g\u00f6nderilmeleri sa\u011flan\u0131r.<\/p>\nSorun Giderme ve S\u0131k Kar\u015f\u0131la\u015f\u0131lan Sorunlar<\/h3>\n
sudo ufw status verbose # UFW i\u00e7in\n # veya\n sudo iptables -L -n # iptables i\u00e7in<\/code><\/pre>\ndig<\/code> veya nslookup<\/code> komutlar\u0131yla kontrol edebilirsiniz.<\/p>\ndig ornekalanadi.com<\/code><\/pre>\nsudo nginx -t<\/code> komutu size hatay\u0131 g\u00f6sterecektir. Hata mesaj\u0131n\u0131 dikkatlice okuyarak ilgili sat\u0131r\u0131 d\u00fczeltin.
\n* Certbot Hatalar\u0131:<\/strong>
\n * Rate Limits (Oran S\u0131n\u0131rlar\u0131):<\/strong> Let’s Encrypt’in sertifika verme konusunda belirli oran s\u0131n\u0131rlar\u0131 vard\u0131r. \u00c7ok s\u0131k sertifika almaya \u00e7al\u0131\u015f\u0131rsan\u0131z bu s\u0131n\u0131rlara tak\u0131labilirsiniz. Genellikle haftada bir alan ad\u0131 i\u00e7in 5 sertifika ile s\u0131n\u0131rl\u0131d\u0131r. Hata mesaj\u0131nda rate limit exceeded<\/code> g\u00f6r\u00fcyorsan\u0131z, bir s\u00fcre beklemeniz gerekebilir.
\n * Domain Validation Failed (Alan Ad\u0131 Do\u011frulama Ba\u015far\u0131s\u0131z):<\/strong> Certbot, alan ad\u0131n\u0131z\u0131n kontrol\u00fcn\u00fc do\u011frulayam\u0131yorsa bu hatay\u0131 al\u0131rs\u0131n\u0131z. Bu genellikle DNS sorunlar\u0131, yanl\u0131\u015f webroot yolu veya g\u00fcvenlik duvar\u0131 engeli nedeniyle HTTP portu 80 \u00fczerinden Certbot’un do\u011frulama dosyalar\u0131na eri\u015filememesi durumunda ortaya \u00e7\u0131kar.
\n * Old Certbot Version (Eski Certbot S\u00fcr\u00fcm\u00fc):<\/strong> Debian 8’de jessie-backports<\/code> kullan\u0131lmas\u0131na ra\u011fmen hala eski bir Certbot s\u00fcr\u00fcm\u00fcyle ilgili sorunlar ya\u015fanabilir. E\u011fer apt install certbot -t jessie-backports<\/code> i\u015fe yaramazsa, Certbot’un resmi web sitesindeki di\u011fer kurulum y\u00f6ntemlerini (\u00f6rne\u011fin pip<\/code> veya snap<\/code> ile kurulum) de\u011ferlendirmeniz gerekebilir, ancak bu y\u00f6ntemler Debian 8 i\u00e7in daha karma\u015f\u0131k olabilir.
\n* Taray\u0131c\u0131 Uyar\u0131lar\u0131:<\/strong> Taray\u0131c\u0131n\u0131zda “G\u00fcvenli De\u011fil” uyar\u0131s\u0131 veya kar\u0131\u015f\u0131k i\u00e7erik (mixed content) uyar\u0131lar\u0131 al\u0131yorsan\u0131z, Nginx yap\u0131land\u0131rman\u0131zda eksik veya yanl\u0131\u015f bir \u015fey olabilir. Taray\u0131c\u0131n\u0131z\u0131n geli\u015ftirici ara\u00e7lar\u0131n\u0131 (F12) kullanarak konsoldaki hatalar\u0131 kontrol edin. Kar\u0131\u015f\u0131k i\u00e7erik genellikle sitenizdeki baz\u0131 kaynaklar\u0131n (resimler, CSS, JS dosyalar\u0131) hala HTTP \u00fczerinden y\u00fcklenmeye \u00e7al\u0131\u015fmas\u0131ndan kaynaklan\u0131r. Bu durumda, web sitenizin i\u00e7eri\u011findeki t\u00fcm ba\u011flant\u0131lar\u0131n HTTPS oldu\u011fundan emin olun veya Nginx’te sub_filter<\/code> gibi mod\u00fcllerle HTTP URL’lerini HTTPS’e d\u00f6n\u00fc\u015ft\u00fcrmeyi deneyin.<\/p>\nSonu\u00e7<\/h3>\n