LetsEncrypt SSL Ubuntu 18.04 LTS
I pieced the following together from various sites to get Lets Encrypt to work on Ubuntu 18.04 LTS
1) Set up a way to exchange keys
sudo openssl dhparam -out /etc/ssl/certs/dhparam.pem 2048
Just be warned this takes a loooong time to run
2) Use the Webroot plugin to obtain an SSL certificate that works by creating a temporary file for validating the requested domain in the ${webroot-path}/.well-known/acme-challenge
directory. The Let’s Encrypt server makes HTTP requests to the temporary file to validate that the requested domain resolves to the server where certbot (more on certbot later) runs.
To make it more simple we’re going to map all HTTP requests for .well-known/acme-challenge
to a single directory, /var/lib/letsencrypt
.
sudo mkdir -p /var/lib/letsencrypt/.well-known
sudo chgrp www-data /var/lib/letsencryptsudo
sudo chmod g+s /var/lib/letsencrypt
3) Create some snippets config files for letsencrypt.
- make sure mod_ssl and mod_headers are enabled
sudo a2enmod ssl
sudo a2enmod headers
- create the snippets
sudo a2enconf letsencrypt
sudo a2enconf ssl-params
- this will make
/etc/apache2/conf-available/letsencrypt.conf and /etc/apache2/conf-available/ssl-params.conf
they will look like this….
Alias /.well-known/acme-challenge/ "/var/lib/letsencrypt/.well-known/acme-challenge/"
<Directory "/var/lib/letsencrypt/">
AllowOverride None
Options MultiViews Indexes SymLinksIfOwnerMatch IncludesNoExec
Require method GET POST OPTIONS
</Directory>
SSLCipherSuite EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH
SSLProtocol All -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
SSLHonorCipherOrder On
Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"
Header always set X-Frame-Options DENY
Header always set X-Content-Type-Options nosniff
# Requires Apache >= 2.4
SSLCompression off
SSLUseStapling on
SSLStaplingCache "shmcb:logs/stapling-cache(150000)"
# Requires Apache >= 2.4.11
SSLSessionTickets Off
SSLOpenSSLConfCmd DHParameters "/etc/ssl/certs/dhparam.pem"
sudo a2enmod http2
sudo systemctl reload apache2
sudo certbot certonly –agree-tos –email admin@example.com –webroot -w /var/lib/letsencrypt/ -d example.com -d www.example.com
IMPORTANT NOTES:
- Congratulations! Your certificate and chain have been saved at:
/etc/letsencrypt/live/example.com/fullchain.pem
Your key file has been saved at:
/etc/letsencrypt/live/example.com/privkey.pem
Your cert will expire on 2018-10-28. To obtain a new or tweaked
version of this certificate in the future, simply run certbot
again. To non-interactively renew *all* of your certificates, run
"certbot renew"
- If you like Certbot, please consider supporting our work by:
Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate
Donating to EFF: https://eff.org/donate-le
<VirtualHost *:443>
ServerName example.com
Protocols h2 http:/1.1
DocumentRoot /var/www/example.com/
ErrorLog ${APACHE_LOG_DIR}/example.com-error.log
CustomLog ${APACHE_LOG_DIR}/example.com-access.log combined
SSLEngine On
SSLCertificateFile /etc/letsencrypt/live/example.com/cert.pem
SSLCertificateKeyFile /etc/letsencrypt/live/example.com/privkey.pem
SSLCertificateChainFile /etc/letsencrypt/live/example.com/chain.pem
</VirtualHost>
- If you do use the defalult-ssl.conf there are two SSL lines you have to rem out
#SSLCertificateFile /etc/ssl/certs/ssl-cert-snakeoil.pem
#SSLCertificateKeyFile /etc/ssl/private/ssl-cert-snakeoil.key
sudo a2ensite dafalult-ssl.conf
sudo systemctl reload apache2
Auto-renewing your Let’s Encrypt SSL Cert
Let’s Encrypt’s certificates are valid for 90 days. To automatically renew the certificates before they expire, the certbot package creates a cronjob which runs twice a day and will automatically renew any certificate 30 days before its expiration. The issue is that once the certificate is renewed we also have to reload the Apache service. To fix this, append --renew-hook "systemctl reload apache2"
to /etc/cron.d/certbot file. It should look like this
/etc/cron.d/certbot
0 */12 * * * root test -x /usr/bin/certbot -a \! -d /run/systemd/system && perl -e 'sleep int(rand(3600))' && certbot -q renew --renew-hook "systemctl reload apache2"
sudo certbot renew –dry-run