Let’s encrypt is a Certificate Authority (CA) run by Internet Security Research Group (ISRG), and is sponsored by some of the biggest name in the web industry
You are probably here to create a certificate, not get a history lesson ! so Let me cut the chase, for those who want to know more, there is always wikipedia (Let’s encrypt on Wikipedia)
So let’s encrypt provides certificates for domain names, including wildcard certificates (Which I will get to by the end of this article), What we are going through here is the manual process, which serves to give you a taste of how things work, in practice, you are encouraged to use on of the automated methods for multiple reasons, one compelling such reason is that Let’s encrypt issues certificates valid for three months only ! You don’t want to have to cater to your certificate every three months do you ?
To simplify things, I will create a step by step video to demonstrate the creation process ! and post it here, but for now, I will simply take you through the steps, in this tutorial, all you need is SSH access to any server including one you have at home ! or even maybe a virtual machine running Linux inside your windows computer, anything goes, once you have a certificate, you can move it to your production server, this allows me to keep this as general as possible, and this is done using the –manual option, So without further ado, let me get to it
1- login to a linux server and install certbot, the tool that allows you to get certificates from let’s encrypt, On the official website, they promote the use of SNAP, here, I will skip snap and use Debian’s repository ! simpler and there is no need to get into snap
apt install certbot
Now that you have certbot, let us create a certificate for the domain example.com (replace it with your own)
certbot certonly --manual --preferred-challenges http
The –preferred-challenges directive allows you to specify what challenge (http or dns) you would like to perform, the manual plugin is basically the same as webroot plugin but not automated, which is a hassle to keep up to date as this form of issuance needs to be renewed manually every 3 months, (You can take extra steps to automate this) which i will describe later on another post to keep things tidy
Now, as soon as you enter the above, you will enter an interactive dialogue with the following steps
Note: If you want to create a wildcard certificate for your domain name, let’s encrypt allows the use of the * wildcard, but only supports DNS challenge, so the command must reflect that, So when asked for a domain, simply enter *.example.com (or -d ‘*.example.com’), should work normally
As soon as you are in, you will be asked 1- An email for notifications 2- Do you agree to the terms of service ? 3- Would you like to subscribe to the newsletter ? 4- enter your domain names (you should enter both example.com and www.example.com separated by either a comma or a space) 5- Create a file containing just this data: Pg1xJ.........-88 And make it available on your web server at this URL: http://example.com/.well-known/acme-challenge/Pg1...........xuu_0 6- Now you need to create the 2 challenge files, one for exmaple.com and the other for WWW.example.com Create a file containing just this data: Ud4m81x..............zupbWEz-88 And make it available on your web server at this URL: http://www.example.com/.well-known/acme-challenge/Ud4........550 (This must be set up in addition to the previous challenges; do not remove, replace, or undo the previous challenge tasks yet.) -------------------------- IMPORTANT NOTES: - Congratulations! Your certificate and chain have been saved at: /etc/letsencrypt/live/example.com/fullchain.pem Your key file has been saved at: /etc/letsencrypt/live/example.com/privkey.pem Your certificate will expire on 2023-03-11. To obtain a new or tweaked version of this certificate in the future, simply run certbot again. To non-interactively renew *all* of your certificates, run "certbot renew" - If you like Certbot, please consider supporting our work by: Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate Donating to EFF: https://eff.org/donate-le
At this stage, there are things you should remain aware of
1- DO NOT RENAME OR MOVE THE CERTIFICATES, they need to be in place for renewal if you decide to not automate and check on your certificates every 3 months.
2- Copy (Don’t move) them to the ssl directory, and add them to your config files, the only files you will need to include in your nginx or apache2 config are as follows
For apache 2, you need to use the following 2 lines, modify the path to the files to wherever you have placed them
SSLCertificateFile /etc/apache2/ssl/example.com/fullchain.pem
SSLCertificateKeyFile /etc/apache2/ssl/example.com/privkey.key
And for nginx
ssl_certificate /etc/nginx/ssl/allspots.com/fullchain.pem;
ssl_certificate_key /etc/nginx/ssl/allspots.com/privkey.pem;
So, restart apache or nginx, and you should be able to see the certificate in action, so this is the simplest way to use let’s encrypt, in my next post, I will
Now, after 3 months, the simplest way to renew the certificate is to issue the command
certbot certonly --force-renew -d example.com www.example.com