Let’s encrypt is becoming popular.. how do you install it with Apache2?
This can be accomplished in many ways and there are many certificate categories to choose from.
However, all TLS/SSL certificates have the same goal – to protect sensitive information communicated across the network.
This brief tutorial is going to show you the easiest way to accomplish this without costing you anything.
Using certificates from Let’s Encrypt, we’ll be able to protect Apache2 web server with trusted certificates for free
Step 1: Install Server dependencies
Before you can get Let’s Encrypt to work, you must install Ubuntu server dependencies.
To do that, run the commands below to update your server.
sudo apt-get update
Download and install git so that we can download Let’s Encrypt packages
sudo apt-get install git
Step 2: download Let’s Encrypt Client
The next step is to download Let’s Encrypt client from its repository. What we’d like to do is download the client in the /opt directory. This is the appropriate place to put it.
sudo git clone https://github.com/letsencrypt/letsencrypt /opt/letsencrypt
Change into Let’s Encrypt’s directory and begin to set it up.
cd /opt/letsencrypt
Step 3: Setup a new SSL Certificate for your sites
Step 3 is where you setup a new SSL certificate for your sites. To create a new certificate, the example command is shown below. This will secures example.com only.
./letsencrypt-auto --apache -d example.com
However, since most websites online today have both example.com and www.example.com setup, the correct process would be to create a certificate that covers both domains.
To do that, run the commands below.
./letsencrypt-auto --apache -d example.com -d www.example.com
If you run into trouble where Let’s Encrypt is unable to verify your www.example.com domain, navigate to your Apache2 config file and add an alias for www.example.com
sudo nano /etc/apache2/sites-enabled/000-default.conf
Add the highlighted line below. Also, make sure CNAME is defined at your host DNS entries.
ServerName example.com
ServerAlias www.example.com
Save your changes and try again. Hopefully, this time it was successful.
When prompted to select the type of installation, choose the secure installation. Selecting this will make sure www and non-www of your site are redirected to one domain.
If everything was successful, your site will then a valid SSL certificate. This certificate will need to be renewed every 3 months. Don’t worry, the process is as simple as installing it.
To trigger the renewal process, change into Let’s Encrypt directory and run the commands below.
cd /opt/letsencrypt
./letsencrypt-auto renew
Ofcouse you’ll want a better way to renew your certificate so you don’t have to do it manually every 3 months. To set up a process to it’s automatically renewed, create a cron job.
sudo crontab -e
Select an editor. To change later, run ‘select-editor’.
1. /bin/ed
2. /bin/nano <—- easiest
3. /usr/bin/vim.tiny
Choose 1-3 [2]:
Choose option 2 and add the line below
00 0 * * 0 /opt/letsencrypt/letsencrypt-auto renew >> /var/log/le-renew.log
Save your changes and you’re set.
Every Sunday at midnight, the job will try to renew your certificate.
That’s it! Enjoy!