Secure Odoo 18 with SSL/TLS: Complete HTTPS Setup Guide

Implementing SSL/TLS encryption for your Odoo 18 installation is paramount for safeguarding sensitive business data, user credentials, and fostering customer trust. This comprehensive guide will meticulously walk you through the process of setting up free SSL certificates using Let\'s Encrypt and properly configuring HTTPS for your Odoo instance, ensuring a secure online environment.

Why SSL/TLS is Essential for Odoo

Adopting SSL/TLS encryption is not merely a technical recommendation; it is a fundamental requirement for any Odoo deployment handling crucial business operations. The benefits extend beyond basic data security:

• Robust Data Protection: SSL/TLS encrypts all data transmitted between your users\' browsers and your Odoo server, protecting sensitive information like financial records, personal data, and login credentials from interception.
• Server Authentication: It verifies the identity of your server to users, ensuring they are connecting to the legitimate Odoo instance and not a malicious impostor.
• Significant SEO Benefits: Search engines like Google actively prioritize HTTPS-enabled websites in their search rankings, leading to improved visibility and organic traffic for your Odoo platform.
• Enhanced Browser Trust: Modern web browsers prominently display security indicators (e.g., a padlock icon) for HTTPS sites and issue severe warnings or block access to non-HTTPS pages, potentially deterring users.
• Regulatory Compliance: SSL/TLS is often a mandatory requirement for adhering to various industry standards and data protection regulations, including PCI DSS (for payment processing), GDPR, HIPAA, and many others.
• Boosted Customer Confidence: A secure HTTPS connection demonstrates professionalism and a commitment to data security, significantly building and maintaining trust with your customers and partners.

Prerequisites

Before proceeding with the SSL/TLS setup, please ensure that the following prerequisites are met on your server environment:

• Odoo 18 Installation: You must have a functional Odoo 18 instance already installed and running on Ubuntu 24.04 LTS.
• Nginx Reverse Proxy Configuration: Nginx should be properly configured and acting as a reverse proxy for your Odoo instance. If you haven\'t set this up yet, please refer to our dedicated Nginx configuration guide.
• Valid Domain Name: A fully qualified domain name (FQDN) must be registered and correctly pointed via DNS \'A\' records to your server\'s public IP address.
• Open Firewall Ports: Ensure that both port 80 (for HTTP challenges) and port 443 (for HTTPS traffic) are open in your server\'s firewall.
• Root or Sudo Access: You will need root privileges or a user account with sudo access to execute administrative commands on your server.

Step 1: Install Certbot

Certbot is the official and highly recommended client from Let\'s Encrypt. It simplifies and automates the process of obtaining and installing SSL/TLS certificates. Begin by updating your package list and installing Certbot along with its Nginx plugin:

sudo apt update
sudo apt install certbot python3-certbot-nginx -y

Once the installation is complete, you can verify that Certbot is correctly installed and accessible by checking its version:

certbot --version

Step 2: Prepare Nginx Configuration

Before requesting the SSL certificate, it\'s crucial to ensure your Nginx configuration is correctly set up for your domain. Edit your Odoo 18 Nginx server block:

sudo nano /etc/nginx/sites-available/odoo18

Your Nginx server block should be configured to listen on port 80 and include your primary domain and any subdomains (like www) that you wish to secure. A basic structure will resemble the following:

server {
    listen 80;
    server\_name your-domain.com www.your-domain.com;
    
    # Your existing Odoo reverse proxy configuration
    include /etc/nginx/snippets/odoo-proxy.conf;
}

After making any changes, always test your Nginx configuration for syntax errors and then reload Nginx to apply them:

sudo nginx -t
sudo systemctl reload nginx

Step 3: Obtain SSL Certificate

With Certbot installed and your Nginx configuration prepared, you can now proceed to obtain and automatically install your free Let\'s Encrypt SSL certificate. Execute the following command, replacing your-domain.com and www.your-domain.com with your actual domain names:

sudo certbot --nginx -d your-domain.com -d www.your-domain.com

Certbot will guide you through a few interactive prompts:

1. Email Address: Provide a valid email address. This is essential for receiving important renewal notices and security alerts for your certificates.
2. Terms of Service: You will need to read and agree to the Let\'s Encrypt Terms of Service to proceed.
3. EFF Sharing (Optional): You can choose whether or not to share your email address with the Electronic Frontier Foundation (EFF), who are supporters of Let\'s Encrypt. This is entirely optional.
4. HTTPS Redirection: When prompted, it is highly recommended to select option 2. This automatically configures Nginx to redirect all incoming HTTP traffic (port 80) to HTTPS (port 443), ensuring all connections to your Odoo instance are secure.

Upon successful completion, Certbot will inform you that your certificate has been installed and is now active.

Step 4: Verify SSL Installation

After Certbot completes its process, it automatically modifies your Nginx configuration file to include the necessary SSL directives and set up the HTTP to HTTPS redirection. To inspect these changes, open your Nginx server block again:

sudo nano /etc/nginx/sites-available/odoo18

You should now observe significant additions to your configuration, typically including a new server block for HTTPS (port 443) and modifications to the HTTP (port 80) block to enforce redirection. The configuration should closely resemble the following:

server {
    server\_name your-domain.com www.your-domain.com;
    
    listen 443 ssl http2; # managed by Certbot
    ssl\_certificate /etc/letsencrypt/live/your-domain.com/fullchain.pem; # managed by Certbot
    ssl\_certificate\_key /etc/letsencrypt/live/your-domain.com/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl\_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
    
    include /etc/nginx/snippets/odoo-proxy.conf;
}

server {
    if ($host = www.your-domain.com) {
        return 301 https://$server\_name$request\_uri;
    } # managed by Certbot

    if ($host = your-domain.com) {
        return 301 https://$server\_name$request\_uri;
    } # managed by Certbot

    listen 80;
    server\_name your-domain.com www.your-domain.com;
    return 404; # managed by Certbot
}

This revised configuration ensures that your Odoo instance is served securely over HTTPS, leveraging the certificates provided by Let\'s Encrypt.

Step 5: Enhance SSL Configuration

While Certbot provides a secure default configuration, you can further enhance the security and performance of your SSL setup by implementing a custom snippet for modern SSL/TLS protocols and ciphers. This improves protection against known vulnerabilities and optimizes handshake performance.

Create a new Nginx snippet file for your advanced SSL parameters:

sudo nano /etc/nginx/snippets/ssl-params.conf

Add the following recommended configuration to the newly created file. This snippet specifies strong protocols, preferred ciphers, session optimization settings, OCSP stapling for faster certificate validation, and essential security headers like Strict-Transport-Security (HSTS).

# Modern SSL configuration
ssl\_protocols TLSv1.2 TLSv1.3;
ssl\_prefer\_server\_ciphers off;
ssl\_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;

# SSL optimization
ssl\_session\_timeout 1d;
ssl\_session\_cache shared:SSL:10m;
ssl\_session\_tickets off;

# OCSP stapling
ssl\_stapling on;
ssl\_stapling\_verify on;
resolver 8.8.8.8 8.8.4.4 valid=300s;
resolver\_timeout 5s;

# Security headers
add\_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";

Note: The Strict-Transport-Security header value max-age is usually set to a longer duration like 63072000 (2 years) for robust security. Ensure to complete this line if it was truncated.

To integrate this enhanced configuration, you will need to modify your Nginx server block (/etc/nginx/sites-available/odoo18) and include this new snippet within the server block that listens on port 443, replacing or complementing Certbot\'s default SSL options.

After updating your Nginx configuration to include the ssl-params.conf snippet, remember to test Nginx for syntax errors and reload the service:

sudo nginx -t
sudo systemctl reload nginx

This will activate your hardened SSL/TLS configuration, providing a higher level of security for your Odoo 18 instance.

By following these steps, you have successfully secured your Odoo 18 installation with free Let\'s Encrypt SSL/TLS certificates, enforced HTTPS, and implemented advanced security measures. This ensures that all data transmitted to and from your Odoo instance is encrypted, protecting sensitive information and bolstering trust with your users and clients. Regular certificate renewal, which Certbot handles automatically, will maintain this secure posture over time.