Install RBT: TLS certificates

This step obtains a public TLS certificate with acme.sh and installs the private key and full certificate chain used by the RBT NGINX virtual host. HTTPS is required for secure authentication, browser APIs and mobile clients.

This page is one step in the complete RBT installation guide.

Before you start

Replace every example hostname and email address with production values.
Confirm public DNS resolves to this server and HTTP port 80 is reachable.
Protect /etc/ssl/key.pem so only privileged services can read it.

Expected result

acme.sh should track the domain, the installed certificate should match it, and NGINX should reload automatically after future renewals.

Verify this step

acme.sh --list
openssl x509 -in /etc/ssl/cert.pem -noout -subject -issuer -dates
nginx -t

Get SSL certificate

curl https://get.acme.sh | sh -s email=<your-email@example.com>

acme.sh --set-default-ca --server letsencrypt

acme.sh --issue -d example.com -w /var/www/html

acme.sh --install-cert -d example.com --key-file /etc/ssl/key.pem --fullchain-file /etc/ssl/cert.pem --reloadcmd "service nginx force-reload"