EXERCISE 1 — A complete, correct nginx HTTPS config
====================================================

# ---- Port 80: redirect ALL plain HTTP to HTTPS ----
server {
    listen 80;
    server_name example.com www.example.com;
    return 301 https://$host$request_uri;   # 301 = permanent
}

# ---- Port 443: the real HTTPS site ----
server {
    listen 443 ssl;
    http2 on;
    server_name example.com www.example.com;

    # *** THIS LINE PREVENTS THE MISSING-INTERMEDIATE BUG ***
    ssl_certificate     /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

    # only modern protocols (Chapter 8)
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers off;

    # one-year HSTS, applied to subdomains too
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

    root /var/www/example.com;
}

WHY ssl_certificate -> fullchain.pem IS THE KEY LINE:
  - fullchain.pem = the LEAF certificate + the INTERMEDIATE(s).
  - The server must send leaf + intermediates so every client can build the
    chain up to a trusted root (Chapter 5). The root itself is NOT included
    (clients already have it).
  - If you instead pointed at cert.pem (leaf only), some browsers would
    succeed (they cache/fetch the intermediate) while others fail with
    "unable to get local issuer certificate" -> the classic
    "works on my laptop, fails on her phone" bug.

NOTES:
  - `always` on add_header ensures the HSTS header is sent even on error
    responses (4xx/5xx), not just 200s.
  - After editing: `nginx -t` to test syntax, then `systemctl reload nginx`.
  - http2 on; is optional but free here — HTTP/2 requires HTTPS anyway.