This is an old revision of the document!
= Automated Free HTTPS Secure Web SSL Certificates
Debian (amongst other linux distros) have a package that can be used to automatically get https ssl certs for your apache setup. What used to be quite a process creating self signed certs, can now be fully automated with Lets Encrypt ( https://letsencrypt.org/ ) Lets Encrypt gives SSL certs for 90 days (but may reduce to 64 days). That is not a problem however, as cron will automatically request a new certificate when the time comes.
Install Package
apt-get install python3-certbot-apache
certbot –apache -d xxxx.com
End Result → ##### Account registered. Requesting a certificate for xxxx.com
Successfully received certificate. Certificate is saved at: /etc/letsencrypt/live/xxxx.com/fullchain.pem Key is saved at: /etc/letsencrypt/live/xxxx.com/privkey.pem This certificate expires on 2027-01-22. These files will be updated when the certificate renews. Certbot has set up a scheduled task to automatically renew this certificate in the background.
Deploying certificate Successfully deployed certificate for sburke.eu to /etc/apache2/sites-available/02-xxx-le-ssl.conf Congratulations! You have successfully enabled HTTPS on https://xxxx.com #####
Right, so what did it do! Well it correctly picked up the correct config in apache and modified it to add into <VirtualHost *:80> RewriteEngine on RewriteCond %{SERVER_NAME} =www.xxxx.com [OR] RewriteCond %{SERVER_NAME} =xxxx.com RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]
It then created a new vhost config: /etc/apache2/sites-available/02-xxx-le-ssl.conf Copying details of existing vhost for 80 and modifying it for 443.
<VirtualHost *:443>
ServerAdmin email@domain.com
ServerName www.xxxx.com
ServerAlias xxxx.com
DocumentRoot /home/xxxx/public_html/
CustomLog /var/log/apache2/access_xxxx.log combined
ErrorLog /var/log/apache2/error_xxxx.log
Loglevel warn
<Directory /home/xxxx/public_html/>
Require all granted
Options +FollowSymLinks -Indexes +MultiViews
AllowOverride All
</Directory>
UserDir disabled
SSLCertificateFile /etc/letsencrypt/live/xxxx.eu/fullchain.pem SSLCertificateKeyFile /etc/letsencrypt/live/xxxx.eu/privkey.pem Include /etc/letsencrypt/options-ssl-apache.conf </VirtualHost> </IfModule>
It reloaded apache. Volia. Magic. Site not encrypted. Unbelievably easy. Really. Kudos cerbot, lets encrypt and debian.
Crontab added in: cat /etc/cron.d/certbot
So, I manually edited the vhost config and added it into the main one. Prefer this rather than having a separate vhost config file.
For other vhosts, it was easiest to run the command again ( certbot –apache -d xxxx.com ). For the 2nd command, it didn't ask for email or to register anymore. It just done it.
Refs: https://linuxconfig.org/generate-ssl-certificates-with-letsencrypt-debian-linux https://www.rosehosting.com/blog/how-to-install-lets-encrypt-on-debian-13/ https://wiki.debian.org/LetsEncryp