SSL رایگان روی nginx با certbot و ریدایرکت به HTTPS

dig +short example.com
dig +short www.example.com
sudo ufw allow 'Nginx Full'
sudo nginx -t

sudo apt update
sudo apt install -y certbot python3-certbot-nginx

sudo certbot --nginx -d example.com -d www.example.com

# HTTP -> HTTPS
server {
    listen 80;
    listen [::]:80;
    server_name example.com www.example.com;
    return 301 https://example.com$request_uri;
}

# www -> بدون www (HTTPS)
server {
    listen 443 ssl;
    listen [::]:443 ssl;
    http2 on;
    server_name www.example.com;

    ssl_certificate     /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
    return 301 https://example.com$request_uri;
}

# سایت اصلی
server {
    listen 443 ssl;
    listen [::]:443 ssl;
    http2 on;
    server_name example.com;

    ssl_certificate     /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
    include /etc/letsencrypt/options-ssl-nginx.conf;
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;

    root /var/www/example.com/html;
    index index.html;

    location / {
        try_files $uri $uri/ =404;
    }
}

    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

systemctl list-timers | grep certbot
sudo certbot renew --dry-run
sudo certbot certificates

sudo certbot renew --deploy-hook "systemctl reload nginx"

curl -I https://example.com
curl -I http://example.com   # باید 301 بدهد
echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -dates