The way CertPot handles the HTTP Let's Encrypt challenge is that it adds a directory inside your nginx site's root directory that has a file that contains a token. When the Let's Encrypt servers visit a specific URL on your domain, nginx will resolve that token file and respond with its content. That's how Let's Encrypt knows that you have control over the domain you claim that is yours. And after that, Let's Encrypt generates a certificate and gives it to CertPot, which stores this certificate on the server and configures nginx to use it for requests coming over port 443. In the process, CertPot modifies the nginx configuration file for the site. So before we continue any further, let's take a backup copy of our nginx file. So sudo cp /etc/nginx/sites-available/laracasts /etc/nginx/sites-available/laracasts-backup. Now let's run CertPot and generate a certificate. sudo certpot nginx CertPot asks us for our email address. So let's provide it.

the site visitors will get redirected to the HTTPS version over and over and over until it enters a redirect loop. And that's why our website wasn't working. So to avoid that, we need to change the encryption mode to full or full strict. In both modes, the traffic between Cloudflare and the origin server will be encrypted. However, in full strict mode, Cloudflare will expect a valid certificate to be in place, not an expired one or one issued by an untrusted certificate authority. You can read more about the difference between the two options. But in my case here, I'm going to go for the full strict option. Now let's open a new browser tab and visit the website. Go with php.com.

Now we guarantee that all traffic will be encrypted. If you don't use Cloudflare, you won't need this extra step of enabling full encryption. And the certificate that appears in the browser will be the Let's Encrypt one. I personally use Cloudflare for everything as it's not just a DNS provider, but also a content delivery network. It has a lot of features that we may explore in different courses. For now, let's go check the Nginx file of our site and see what Certbot did there. So let's open the file sudo nano /etc/nginx/sites-available/laracasts. And the first thing we notice here is that Certbot removed the listeners on port 80 and replaced them with listeners on port 443.