SSL and DNS Configuration for Magento

Let's Encrypt with Certbot

# Install Certbot
sudo apt install -y certbot python3-certbot-nginx

# Get certificate
sudo certbot --nginx -d www.example.com -d example.com

# Verify auto-renewal
sudo systemctl status certbot.timer

# Test renewal
sudo certbot renew --dry-run

# Manual renewal
sudo certbot renew

Nginx SSL Configuration

server {
    listen 443 ssl http2;
    server_name www.example.com;
    
    # SSL certificates
    ssl_certificate /etc/letsencrypt/live/www.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/www.example.com/privkey.pem;
    
    # SSL protocols
    ssl_protocols TLSv1.2 TLSv1.3;
    
    # SSL ciphers
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
    ssl_prefer_server_ciphers off;
    
    # SSL session caching
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;
    ssl_session_tickets off;
    
    # OCSP Stapling
    ssl_stapling on;
    ssl_stapling_verify on;
    resolver 8.8.8.8 8.8.4.4 valid=300s;
    resolver_timeout 5s;
    
    # HSTS
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
}

# Redirect HTTP to HTTPS
server {
    listen 80;
    server_name www.example.com example.com;
    return 301 https://www.example.com$request_uri;
}

SSL Security Headers

# Additional security headers
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Content-Security-Policy "default-src 'self' https: http:" always;

Key Takeaway

Use Let's Encrypt for free SSL certificates. Configure Nginx with TLSv1.2+, strong ciphers, HSTS, and OCSP stapling for security.

Essential DNS Records

; A Record - points domain to IP
example.com.        IN  A       192.168.1.100
www.example.com.    IN  A       192.168.1.100

; CNAME - points domain to another domain
shop.example.com.   IN  CNAME   example.com.

; MX - mail server
example.com.        IN  MX  10  mail.example.com.

; TXT - SPF, DKIM, DMARC
example.com.        IN  TXT     "v=spf1 include:_spf.google.com ~all"
_dmarc.example.com. IN  TXT     "v=DMARC1; p=none; rua=mailto:dmarc@example.com"

Magento DNS Setup

; Main store
example.com.        IN  A       203.0.113.10
www.example.com.    IN  CNAME   example.com.

; Staging
staging.example.com. IN  A      203.0.113.20

; API subdomain
api.example.com.    IN  A       203.0.113.10

; CDN
cdn.example.com.    IN  CNAME   d123456.cloudfront.net.

DNS TTL Settings

; Low TTL for frequently changed records (300 seconds)
example.com.        IN  A       203.0.113.10  ; TTL 300

; High TTL for stable records (86400 seconds)
example.com.        IN  A       203.0.113.10  ; TTL 86400

DNS Propagation

# Check DNS propagation
dig example.com
nslookup example.com
host example.com

# Check specific record types
dig example.com A
dig example.com MX
dig example.com TXT

Key Takeaway

Configure A records for domains, CNAME for subdomains, MX for email, TXT for SPF/DKIM. Use appropriate TTLs and verify propagation.

CloudFront Setup

# Create CloudFront distribution
# Origin: d123456.cloudfront.net
# Origin domain: www.example.com
# Viewer protocol policy: Redirect HTTP to HTTPS
# Allowed HTTP methods: GET, HEAD, OPTIONS, PUT, POST, PATCH, DELETE
# Cache behavior: /static/* -> CachingOptimized

Magento CDN Configuration

# Set base URL with CDN
bin/magento config:set web/base/url "https://d123456.cloudfront.net/"

# Set static URL
bin/magento config:set web/secure/base_static_url "https://d123456.cloudfront.net/"
bin/magento config:set web/unsecure/base_static_url "https://d123456.cloudfront.net/"

# Deploy static content to CDN
bin/magento setup:static-content:deploy -f

Nginx CDN Configuration

# Origin pull from CDN
location /static/ {
    # CloudFront headers
    add_header X-Cache-Status $upstream_cache_status;
    
    # Cache static files
    expires 1y;
    add_header Cache-Control "public";
    
    # Serve from CDN
    proxy_pass https://d123456.cloudfront.net;
}

CDN Cache Invalidation

# AWS CLI invalidation
aws cloudfront create-invalidation \
    --distribution-id E1234567890ABC \
    --paths "/static/*" "/media/*"

# Wait for invalidation
aws cloudfront wait invalidation-completed \
    --distribution-id E1234567890ABC \
    --id I1234567890ABC

Key Takeaway

CDN serves static content from edge locations. Configure Magento base URL to use CDN, set proper cache headers, and invalidate CDN when deploying new static content.

Multi-Domain Setup

# Primary store
server {
    listen 443 ssl http2;
    server_name www.example.com;
    # ... SSL config ...
}

# Secondary store
server {
    listen 443 ssl http2;
    server_name www.store2.com;
    # ... SSL config ...
}

# Redirect non-www to www
server {
    listen 80;
    server_name example.com;
    return 301 https://www.example.com$request_uri;
}

Magento Multi-Store DNS

; Store 1
www.store1.com.     IN  A       203.0.113.10

; Store 2
www.store2.com.     IN  A       203.0.113.10

; Store 3
www.store3.com.     IN  A       203.0.113.10

Wildcard SSL Certificate

# For multiple subdomains
sudo certbot certonly --manual --preferred-challenges dns \
    -d "*.example.com" -d "example.com"

# Or use SAN certificate
sudo certbot --nginx \
    -d example.com \
    -d www.example.com \
    -d api.example.com \
    -d admin.example.com

Magento Base URL Configuration

# Set store URLs
bin/magento config:set web/base/url "https://www.example.com/"
bin/magento config:set web/secure/base_url "https://www.example.com/"
bin/magento config:set web/unsecure/base_url "http://www.example.com/"

# Set secure URLs
bin/magento config:set web/secure/base_link_url "https://www.example.com/"
bin/magento config:set web/secure/base_skin_url "https://www.example.com/"
bin/magento config:set web/secure/base_media_url "https://www.example.com/"
bin/magento config:set web/secure/base_static_url "https://www.example.com/"

Key Takeaway

Multi-domain setup requires separate server blocks in Nginx. Use wildcard or SAN certificates for multiple subdomains. Configure Magento base URLs to match domain structure.