<\/span><\/p>\n 1) Set up a way to exchange keys<\/span><\/p>\n sudo openssl dhparam -out \/etc\/ssl\/certs\/dhparam.pem 2048<\/span><\/p><\/blockquote>\n Just be warned this takes a loooong time to run<\/span><\/p>\n <\/span><\/p>\n 2) Use the Webroot plugin to obtain an SSL certificate that works by creating a temporary file for validating the requested domain in the To make it more simple we\u2019re going to map all HTTP requests for sudo mkdir -p \/var\/lib\/letsencrypt\/.well-known <\/span><\/p>\n 3) Create some snippets config files for letsencrypt. <\/span><\/p>\n sudo a2enmod ssl<\/span> sudo a2enconf letsencrypt<\/span> \/etc\/apache2\/conf-available\/letsencrypt.conf and \/etc\/apache2\/conf-available\/ssl-params.conf<\/span><\/p>\n they will look like this….<\/span><\/p>\n${webroot-path}\/.well-known\/acme-challenge<\/code> directory. The Let\u2019s Encrypt server makes HTTP requests to the temporary file to validate that the requested domain resolves to the server where certbot (more on certbot later) runs.<\/span><\/p>\n.well-known\/acme-challenge<\/code> to a single directory, \/var\/lib\/letsencrypt<\/code>.<\/span><\/p>\n
\n<\/span>sudo chgrp<\/span> www-data \/var\/lib\/letsencryptsudo<\/span>
\nsudo chmod g+s \/var\/lib\/letsencrypt<\/span><\/p><\/blockquote>\n\n
\nsudo a2enmod headers<\/span><\/p><\/blockquote>\n\n
\nsudo a2enconf ssl-params<\/span><\/p><\/blockquote>\n\n
Alias \/.well-known\/acme-challenge\/ \"\/var\/lib\/letsencrypt\/.well-known\/acme-challenge\/\"<\/code>
\n<Directory \"\/var\/lib\/letsencrypt\/\"><\/code>
\n AllowOverride None<\/code>
\n Options MultiViews Indexes SymLinksIfOwnerMatch IncludesNoExec<\/code>
\n Require method GET POST OPTIONS<\/code>
\n<\/Directory><\/code><\/div>\nSSLCipherSuite EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH<\/code>
\nSSLProtocol All -SSLv2 -SSLv3 -TLSv1 -TLSv1.1<\/code>
\nSSLHonorCipherOrder On<\/code>
\nHeader always set Strict-Transport-Security \"max-age=63072000; includeSubDomains; preload\"<\/code>
\nHeader always set X-Frame-Options DENY<\/code>
\nHeader always set X-Content-Type-Options nosniff<\/code>
\n# Requires Apache >= 2.4<\/code>
\nSSLCompression off<\/code>
\nSSLUseStapling on<\/code>
\nSSLStaplingCache \"shmcb:logs\/stapling-cache(150000)\"<\/code>
\n# Requires Apache >= 2.4.11<\/code>
\nSSLSessionTickets Off<\/code><\/p>\nSSLOpenSSLConfCmd DHParameters \"\/etc\/ssl\/certs\/dhparam.pem\"<\/code><\/p>\n<\/div>\n\n
\n
\n
IMPORTANT NOTES:<\/code>
\n - Congratulations! Your certificate and chain have been saved at:<\/code>
\n \/etc\/letsencrypt\/live\/example.com\/fullchain.pem<\/code>
\n Your key file has been saved at:<\/code>
\n \/etc\/letsencrypt\/live\/example.com\/privkey.pem<\/code>
\n Your cert will expire on 2018-10-28. To obtain a new or tweaked<\/code>
\n version of this certificate in the future, simply run certbot<\/code>
\n again. To non-interactively renew *all* of your certificates, run<\/code>
\n \"certbot renew\"<\/code>
\n - If you like Certbot, please consider supporting our work by:<\/code><\/p>\n