Automated Free HTTPS Secure Web SSL Certificates
Debian (amongst other linux distros) have a package that can be used to automatically get https ssl certs for your apache setup. What used to be quite a process creating self signed certs, can now be fully automated with Lets Encrypt ( https://letsencrypt.org/ ) Lets Encrypt gives SSL certs for 90 days (but may reduce to 64 days). That is not a problem however, as cron will automatically request a new certificate when the time comes.
Install Package
apt-get install python3-certbot-apache certbot --apache -d xxxx.com
End Result →
Account registered. Requesting a certificate for xxxx.com Successfully received certificate. Certificate is saved at: /etc/letsencrypt/live/xxxx.com/fullchain.pem Key is saved at: /etc/letsencrypt/live/xxxx.com/privkey.pem This certificate expires on 2027-01-22. These files will be updated when the certificate renews. Certbot has set up a scheduled task to automatically renew this certificate in the background. Deploying certificate Successfully deployed certificate for xxxx.com to /etc/apache2/sites-available/02-xxx-le-ssl.conf Congratulations! You have successfully enabled HTTPS on https://xxxx.com
Right, so what did it do!
Well it correctly picked up the correct config in apache and modified it to add into <VirtualHost *:80>
RewriteEngine on
RewriteCond %{SERVER_NAME} =www.xxxx.com [OR]
RewriteCond %{SERVER_NAME} =xxxx.com
RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]
It then created a new vhost config:
/etc/apache2/sites-available/02-xxx-le-ssl.conf
Copying details of existing vhost for 80 and modifying it for 443.
<VirtualHost *:443>
ServerAdmin email@domain.com
ServerName www.xxxx.com
ServerAlias xxxx.com
DocumentRoot /home/xxxx/public_html/
CustomLog /var/log/apache2/access_xxxx.log combined
ErrorLog /var/log/apache2/error_xxxx.log
Loglevel warn
<Directory /home/xxxx/public_html/>
Require all granted
Options +FollowSymLinks -Indexes +MultiViews
AllowOverride All
</Directory>
UserDir disabled
SSLCertificateFile /etc/letsencrypt/live/xxxx.eu/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/xxxx.eu/privkey.pem
Include /etc/letsencrypt/options-ssl-apache.conf
</VirtualHost>
</IfModule>
It reloaded apache. Volia. Magic. Site not encrypted. Unbelievably easy. Really. Kudos certbot, lets encrypt and Debian.
Crontab added in:
cat /etc/cron.d/certbot
So, I manually edited the vhost config and added it into the main one. Prefer this rather than having a separate vhost config file.
For other vhosts, it was easiest to run the command again ( certbot –apache -d xxxx.com ). For the 2nd command, it didn't ask for email or to register anymore. It just done it.
Refs: