=====Automated Free HTTPS Secure Web SSL Certificates=====

Debian (amongst other linux distros) have a package that can be used to automatically get https ssl certs for your apache setup. What used to be quite a process creating self signed certs, can now be fully automated with Lets Encrypt ( https://letsencrypt.org/ )
Lets Encrypt gives SSL certs for 90 days (but may reduce to 64 days). That is not a problem however, as cron will automatically request a new certificate when the time comes.

==== Install Package ====

<code>
 apt-get install python3-certbot-apache
 certbot --apache -d xxxx.com
</code>

End Result -> 

<code>
Account registered.
Requesting a certificate for xxxx.com

Successfully received certificate.
Certificate is saved at: /etc/letsencrypt/live/xxxx.com/fullchain.pem
Key is saved at:         /etc/letsencrypt/live/xxxx.com/privkey.pem
This certificate expires on 2027-01-22.
These files will be updated when the certificate renews.
Certbot has set up a scheduled task to automatically renew this certificate in the background.

Deploying certificate
Successfully deployed certificate for xxxx.com to /etc/apache2/sites-available/02-xxx-le-ssl.conf
Congratulations! You have successfully enabled HTTPS on https://xxxx.com

</code>

Right, so what did it do!

Well it correctly picked up the correct config in apache and modified it to add into <VirtualHost *:80>
<code>
RewriteEngine on
RewriteCond %{SERVER_NAME} =www.xxxx.com [OR]
RewriteCond %{SERVER_NAME} =xxxx.com
RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]
</code>

It then created a new vhost config:

/etc/apache2/sites-available/02-xxx-le-ssl.conf

Copying details of existing vhost for 80 and modifying it for 443.
<code>
<VirtualHost *:443>
        ServerAdmin email@domain.com
        ServerName www.xxxx.com
        ServerAlias xxxx.com
        DocumentRoot /home/xxxx/public_html/
        CustomLog /var/log/apache2/access_xxxx.log combined
        ErrorLog /var/log/apache2/error_xxxx.log
        Loglevel warn
        <Directory /home/xxxx/public_html/>
                Require all granted
                Options +FollowSymLinks -Indexes +MultiViews
                AllowOverride All
        </Directory>
        UserDir disabled

SSLCertificateFile /etc/letsencrypt/live/xxxx.eu/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/xxxx.eu/privkey.pem
Include /etc/letsencrypt/options-ssl-apache.conf
</VirtualHost>
</IfModule>
</code>

It reloaded apache.
Volia. Magic. Site not encrypted. 
Unbelievably easy. Really. Kudos certbot, lets encrypt and Debian.


Crontab added in:

cat /etc/cron.d/certbot

------------------------------------------------------

So, I manually edited the vhost config and added it into the main one. 
Prefer this rather than having a separate vhost config file.

For other vhosts, it was easiest to run the command again ( certbot --apache -d xxxx.com ).
For the 2nd command, it didn't ask for email or to register anymore.
It just done it.


------

Refs:
  * https://linuxconfig.org/generate-ssl-certificates-with-letsencrypt-debian-linux
  * https://www.rosehosting.com/blog/how-to-install-lets-encrypt-on-debian-13/
  * https://wiki.debian.org/LetsEncryp