{"id":226,"date":"2018-09-09T13:00:54","date_gmt":"2018-09-09T11:00:54","guid":{"rendered":"https:\/\/blog.chloesoe.ch\/?p=226"},"modified":"2018-09-27T16:46:16","modified_gmt":"2018-09-27T14:46:16","slug":"https-with-free-lets-encrypt-certificate","status":"publish","type":"post","link":"https:\/\/blog.chloesoe.ch\/?p=226","title":{"rendered":"https with free Let’s Encrypt certificate"},"content":{"rendered":"

This how to was created, before wildcard certificates were possible.<\/em><\/p>\n

Steps:<\/p>\n

    \n
  1. Install lets encrypt<\/li>\n
  2. Get a certificate<\/li>\n
  3. Add the certificate path to apache config<\/li>\n<\/ol>\n

    Get a certificate with certbot<\/h2>\n

    Let's encrypt recommends cretbot to create and renew a certificate. For openSUSE we can follow the steps from https:\/\/certbot.eff.org\/#pip-other, below the steps summarized:<\/p>\n

    wget https:\/\/dl.eff.org\/certbot-auto\nchmod a+x \/opt\/certbot-auto\n\/opt\/certbot-auto certonly -d <SUBDOMAIN>.example.com --webroot -w \/opt\/tomcat\/webapps\/ROOT\/\n<\/code><\/pre>\n
    You could add multiple domain names with -d .example.com if needed.<\/p>\n
    After that, the certificates are stored at \/etc\/letsencrypt\/live\/.example.com . Now change in the SSL configuration of \/etc\/apache2\/conf.d\/example.com this two lines and reload apache2:<\/p>\n
    SSLCertificateKeyFile \/etc\/letsencrypt\/live\/<SUBDOMAIN>.example.com\/privkey.pem\nSSLCertificateFile \/etc\/letsencrypt\/live\/<SUBDOMAIN>.example.com\/fullchain.pem\n<\/code><\/pre>\n
    Automatically renew the certificate<\/h2>\n
    It is recommended to run the renew script daily (see https:\/\/serverfault.com\/...<\/a> ). The certificate actually is renewed, if the expire date is < than 30 days. A let's encrypt certificate by default is valid 90 days.<\/p>\n
    Add a cronjob with crontab -e and add following line:<\/p>\n
    45 00 * * * \/opt\/certbot-auto renew --no-self-upgrade --post-hook \"systemctl reload apache2\"\n<\/code><\/pre>\n
    This will run certbot-auto daily and with \"post-hook\" apache2 is reloaded, if the certificate is renewed.
    \nCreate certs for Apache reverse proxy<\/p>\n
    Certbot has a plugin, to automatically create a certificate for all subdomains. To create the certificat run:<\/p>\n
    \/opt\/certbot-auto --apache\n<\/code><\/pre>\n
    The script will ask you, to select the domains, choose all then a certificate is generated and a https config for every subdomain.<\/p>\n
    If you add a new subdomain you then the certificate could be renewed with the new subdomain included with this command:<\/p>\n
    \/opt\/certbot-auto certonly --apache --expand\nsystemctl restart apache2.service\n<\/code><\/pre>\n
    Windows server with Apache<\/h2>\n
    Install according to https:\/\/github.com\/Lone-Coder\/letsencrypt-win-simple.
    \nSteps are first downloading and extracting, then run letsencrypt.exe from command line:<\/p>\n
    letsencrypt.exe --plugin manual --manualhost indowsserver.example.com --webroot C:\\apache2\\htdocs\n<\/code><\/pre>\n
    Certificates are stored at:<\/p>\n