Securing MediaWiki with Let's Encrypt HTTPS: Certbot, Apache and Nginx

MediaWiki handles user credentials, session cookies and often private content. Served over plain HTTP, that traffic can be sniffed and sessions hijacked on any network between visitor and server. HTTPS encrypts the connection and authenticates the server — and for a login-based wiki it is not optional. This guide covers the complete setup with Let's Encrypt certificates and the MediaWiki-side settings that make the HTTPS switch stick.

1. Obtain a certificate with certbot

On Debian/Ubuntu, install certbot with the plugin matching your web server:

sudo apt install certbot python3-certbot-nginx   # Nginx
# or
sudo apt install certbot python3-certbot-apache  # Apache

Issue and install the certificate — certbot edits your virtual host configuration automatically:

sudo certbot --nginx -d wiki.example.org
# or: sudo certbot --apache -d wiki.example.org

Certificates land in /etc/letsencrypt/live/wiki.example.org/. Renewal: certbot installs a systemd timer (certbot.timer) that renews automatically; verify with systemctl list-timers | grep certbot. The manual fallback is certbot renew in cron. Certificates otherwise expire after 90 days.

2. Web server configuration

Apache — enable TLS and the security headers module, then configure the virtual host:

sudo a2enmod ssl headers

<VirtualHost *:443>
    ServerName wiki.example.org
    DocumentRoot /var/www/mediawiki

    SSLEngine on
    SSLCertificateFile /etc/letsencrypt/live/wiki.example.org/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/wiki.example.org/privkey.pem

    SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1
    SSLHonorCipherOrder on

    SSLUseStapling on

    Header always set Strict-Transport-Security "max-age=31536000"
    Header always set X-Content-Type-Options nosniff
    Header always set X-Frame-Options SAMEORIGIN
</VirtualHost>

<VirtualHost *:80>
    ServerName wiki.example.org
    Redirect permanent / https://wiki.example.org/
</VirtualHost>

Nginx equivalent:

server {
    listen 443 ssl http2;
    server_name wiki.example.org;
    root /var/www/mediawiki;

    ssl_certificate     /etc/letsencrypt/live/wiki.example.org/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/wiki.example.org/privkey.pem;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_stapling on;

    add_header Strict-Transport-Security "max-age=31536000" always;
    add_header X-Content-Type-Options nosniff always;
}

server {
    listen 80;
    server_name wiki.example.org;
    return 301 https://wiki.example.org$request_uri;
}

Modern servers with TLS 1.2/1.3 need no cipher swiss-army-knife lines; the defaults of OpenSSL 1.1.1+ are sound.

3. MediaWiki-side settings

TLS at the web server is only half the job — MediaWiki must generate HTTPS URLs, redirect consistently and set secure cookies (in LocalSettings.php, above everything else):

$wgServer = 'https://wiki.example.org';
$wgCanonicalServer = 'https://wiki.example.org';
$wgForceHTTPS = true;             // redirect HTTP to HTTPS (deprecated in 1.42, see below)
$wgCookieSecure = 'detect';

Since MediaWiki 1.42 the recommended way to force HTTPS is $wgForceHTTPS still working but superseded for API purposes by requiring secure connections at the server level — the canonical approach is $wgServer with HTTPS plus the web server redirect, which is what most wikis run. Set $wgCanonicalServer so the API, IRC feeds and extensions emit the canonical host.

4. Hardening after the switch

• HSTS — the Strict-Transport-Security header above teaches browsers to never retry HTTP; add preload only after long-term testing
• OCSP stapling — enabled in the examples; it lets browsers verify the certificate without extra round trips
• Mixed content — after switching, hunt for pages embedding http:// images or scripts; the browser console lists them, and MediaWiki:Common.css/templates should reference protocol-relative URLs (//...)
• Login security — HTTPS is a prerequisite for password policy enforcement and two-factor extensions to mean anything
• Renewal monitoring — certificate expiry is the classic outage; monitor the certbot timer or subscribe to expiry alerts

Once the certificate is live and renewal is automated, HTTPS stops being a project and becomes background infrastructure. The Manual:HTTPS page collects the remaining MediaWiki-specific notes, and Mozilla's TLS config generator is the reference for current cipher suites.