LetsEncrypt SSL Ubuntu 18.04 LTS

I pieced the following together from various sites to get Lets Encrypt to work on Ubuntu 18.04 LTS

1) Set up a way to exchange keys

sudo openssl dhparam -out /etc/ssl/certs/dhparam.pem 2048

Just be warned this takes a loooong time to run

2) Use the Webroot plugin to obtain an SSL certificate that works by creating a temporary file for validating the requested domain in the ${webroot-path}/.well-known/acme-challenge directory. The Let’s Encrypt server makes HTTP requests to the temporary file to validate that the requested domain resolves to the server where certbot (more on certbot later) runs.

To make it more simple we’re going to map all HTTP requests for .well-known/acme-challenge to a single directory, /var/lib/letsencrypt.

sudo mkdir -p /var/lib/letsencrypt/.well-known
sudo chgrp www-data /var/lib/letsencryptsudo
sudo chmod g+s /var/lib/letsencrypt

3) Create some snippets config files for letsencrypt.

make sure mod_ssl and mod_headers are enabled

sudo a2enmod ssl
sudo a2enmod headers

create the snippets

sudo a2enconf letsencrypt
sudo a2enconf ssl-params

this will make

/etc/apache2/conf-available/letsencrypt.conf and /etc/apache2/conf-available/ssl-params.conf

they will look like this….

/etc/apache2/conf-available/letsencrypt.conf

Alias /.well-known/acme-challenge/ "/var/lib/letsencrypt/.well-known/acme-challenge/"

<Directory "/var/lib/letsencrypt/">

 AllowOverride None

 Options MultiViews Indexes SymLinksIfOwnerMatch IncludesNoExec

 Require method GET POST OPTIONS

</Directory>

/etc/apache2/conf-available/ssl-params.conf

SSLCipherSuite EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH
SSLProtocol All -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
SSLHonorCipherOrder On
Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"
Header always set X-Frame-Options DENY
Header always set X-Content-Type-Options nosniff
# Requires Apache >= 2.4
SSLCompression off
SSLUseStapling on
SSLStaplingCache "shmcb:logs/stapling-cache(150000)"
# Requires Apache >= 2.4.11
SSLSessionTickets Off

SSLOpenSSLConfCmd DHParameters "/etc/ssl/certs/dhparam.pem"

4) Enable the HTTP/2 module which will make your sites faster and more robust:

sudo a2enmod http2

5) Reload Apache

sudo systemctl reload apache2

6) Certbot is a fully featured and easy to use tool that can automate the tasks for obtaining and renewing Let’s Encrypt SSL certificates and configuring web servers. It is included with Ubuntu 16 and higher.

sudo certbot certonly –agree-tos –email admin@example.com –webroot -w /var/lib/letsencrypt/ -d example.com -d www.example.com

If the SSL certificate is successfully obtained you will see this….

IMPORTANT NOTES:
- Congratulations! Your certificate and chain have been saved at:
/etc/letsencrypt/live/example.com/fullchain.pem
Your key file has been saved at:
/etc/letsencrypt/live/example.com/privkey.pem
Your cert will expire on 2018-10-28. To obtain a new or tweaked
version of this certificate in the future, simply run certbot
again. To non-interactively renew *all* of your certificates, run
"certbot renew"
- If you like Certbot, please consider supporting our work by:

Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate
Donating to EFF: https://eff.org/donate-le

7) Now that we have the files, we need to edit a conf for a site for it to use. You can do this by either making a conf file for your site domain specifically OR using the default conf file. I chose to use the default conf file. The conf files are located in /etc/apache2/sites-available , again I used the default-ssl.conf but you can make a new one for your specific domain . Edit this file, or your ssl conf file, to have the following between the virtualhost section. Replace all example.com stuff with your real domain.

<VirtualHost *:443>

 ServerName example.com

Protocols h2 http:/1.1

DocumentRoot /var/www/example.com/

 ErrorLog ${APACHE_LOG_DIR}/example.com-error.log

 CustomLog ${APACHE_LOG_DIR}/example.com-access.log combined
 SSLEngine On

 SSLCertificateFile /etc/letsencrypt/live/example.com/cert.pem

 SSLCertificateKeyFile /etc/letsencrypt/live/example.com/privkey.pem

 SSLCertificateChainFile /etc/letsencrypt/live/example.com/chain.pem

</VirtualHost>

If you do use the defalult-ssl.conf there are two SSL lines you have to rem out

#SSLCertificateFile /etc/ssl/certs/ssl-cert-snakeoil.pem

#SSLCertificateKeyFile /etc/ssl/private/ssl-cert-snakeoil.key

8) Once the conf file is ready, it has to be enabled. Run the following with the name of the conf file you created. In my case default-ssl.conf

sudo a2ensite dafalult-ssl.conf

this makes a pointer in /etc/apache2/sites-enabled/ making the site live

9) Restart Apache to bring it all together

sudo systemctl reload apache2

At this point you should be able to open your browser and go to your site on HTTPS:// . You should notice a nice lock icon with no warnings.

You can also run a verification on your site to test the SSL cert by going here https://www.ssllabs.com/ssltest/ . If all goes well you should get an A+ rating..

Auto-renewing your Let’s Encrypt SSL Cert

Let’s Encrypt’s certificates are valid for 90 days. To automatically renew the certificates before they expire, the certbot package creates a cronjob which runs twice a day and will automatically renew any certificate 30 days before its expiration. The issue is that once the certificate is renewed we also have to reload the Apache service. To fix this, append --renew-hook "systemctl reload apache2" to /etc/cron.d/certbot file. It should look like this

/etc/cron.d/certbot
0 */12 * * * root test -x /usr/bin/certbot -a \! -d /run/systemd/system && perl -e 'sleep int(rand(3600))' && certbot -q renew --renew-hook "systemctl reload apache2"

To test this you can use the –dry-run switch

sudo certbot renew –dry-run

LetsEncrypt SSL Ubuntu 18.04 LTS

Auto-renewing your Let’s Encrypt SSL Cert

Leave a Reply Cancel reply