Automated Free HTTPS Secure Web SSL Certificates

Debian (amongst other linux distros) have a package that can be used to automatically get https ssl certs for your apache setup. What used to be quite a process creating self signed certs, can now be fully automated with Lets Encrypt ( https://letsencrypt.org/ ) Lets Encrypt gives SSL certs for 90 days (but may reduce to 64 days). That is not a problem however, as cron will automatically request a new certificate when the time comes.

Install Package

 apt-get install python3-certbot-apache
 certbot --apache -d xxxx.com

End Result → 

Account registered.
Requesting a certificate for xxxx.com

Successfully received certificate.
Certificate is saved at: /etc/letsencrypt/live/xxxx.com/fullchain.pem
Key is saved at:         /etc/letsencrypt/live/xxxx.com/privkey.pem
This certificate expires on 2027-01-22.
These files will be updated when the certificate renews.
Certbot has set up a scheduled task to automatically renew this certificate in the background.

Deploying certificate
Successfully deployed certificate for xxxx.com to /etc/apache2/sites-available/02-xxx-le-ssl.conf
Congratulations! You have successfully enabled HTTPS on https://xxxx.com

Right, so what did it do!

Well it correctly picked up the correct config in apache and modified it to add into <VirtualHost *:80> 

RewriteEngine on
RewriteCond %{SERVER_NAME} =www.xxxx.com [OR]
RewriteCond %{SERVER_NAME} =xxxx.com
RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]

It then created a new vhost config:

/etc/apache2/sites-available/02-xxx-le-ssl.conf

Copying details of existing vhost for 80 and modifying it for 443. 

<VirtualHost *:443>
        ServerAdmin email@domain.com
        ServerName www.xxxx.com
        ServerAlias xxxx.com
        DocumentRoot /home/xxxx/public_html/
        CustomLog /var/log/apache2/access_xxxx.log combined
        ErrorLog /var/log/apache2/error_xxxx.log
        Loglevel warn
        <Directory /home/xxxx/public_html/>
                Require all granted
                Options +FollowSymLinks -Indexes +MultiViews
                AllowOverride All
        </Directory>
        UserDir disabled

SSLCertificateFile /etc/letsencrypt/live/xxxx.eu/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/xxxx.eu/privkey.pem
Include /etc/letsencrypt/options-ssl-apache.conf
</VirtualHost>
</IfModule>

It reloaded apache. Volia. Magic. Site not encrypted. Unbelievably easy. Really. Kudos certbot, lets encrypt and Debian.

Crontab added in:

cat /etc/cron.d/certbot

So, I manually edited the vhost config and added it into the main one. Prefer this rather than having a separate vhost config file.

For other vhosts, it was easiest to run the command again ( certbot –apache -d xxxx.com ). For the 2nd command, it didn't ask for email or to register anymore. It just done it.

Refs: