Replace paid SSL cert with LE + autorenewal on Nginx Ubuntu 14.04

How to install LE SSL on a server running Nginx on Ubuntu 14.04 that already got a SSL cert setup.
Remember to replace example.com with your own domain through the tutorial.
SSH into server with sudo priveleges:

cd /usr/local/sbin
sudo wget https://dl.eff.org/certbot-auto
sudo chmod a+x /usr/local/sbin/certbot-auto
sudo nano /etc/nginx/sites-available/default

add this to the server block that listens to 443
DON’T TOUCH OLD CERT STUFF YET!

        location ~ /.well-known {
                allow all;
        }

test and restart:

sudo nginx -t
sudo service nginx restart 
sudo apt-get update
sudo apt-get upgrade
sudo certbot-auto certonly -a webroot --webroot-path=/usr/share/nginx/html -d example.com -d www.example.com

answer the questions.
set up DH group for extra security

sudo openssl dhparam -out /etc/ssl/certs/dhparam.pem 2048

wait 1-2 minutes.
open up your nginx config again:

 sudo nano /etc/nginx/sites-available/default

then replace/comment out your old lines with:

        ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

then add this for extra security utilizing the DH group we generated:

        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
        ssl_prefer_server_ciphers on;
        ssl_dhparam /etc/ssl/certs/dhparam.pem;
        ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA';
        ssl_session_timeout 1d;
        ssl_session_cache shared:SSL:50m;
        ssl_stapling on;
        ssl_stapling_verify on;
        add_header Strict-Transport-Security max-age=15768000;

exit and save.

test and restart

sudo nginx -t
sudo service nginx restart

test SSL
https://www.ssllabs.com/ssltest/analyze.html?d=example.com

Sweet!

Now lets add a cronjob for automatically update the cert:
check all is setup:

certbot-auto renew

you should get something back that “no renewals were attempted”

then:

sudo crontab -e

choose 2 for nano (unless you prefer other)

then paste this in at the bottom of the config.

30 2 * * 1 /usr/local/sbin/certbot-auto renew >> /var/log/le-renew.log
35 2 * * 1 /etc/init.d/nginx reload

Ctrl + x for exit
y for save

thats it!