Try UpCloud for free!<\/a><\/div>\n<\/div>\n\n\n\n
Installing the Certbot client<\/h2>\n\n\n\n
Let\u2019s Encrypt greatly simplifies server management by automating obtaining certificates and configuring web services to use them. The client is fully-featured and extensible for the Let\u2019s Encrypt Certificate Authority or any other CA that uses the ACME<\/a> protocol.<\/p>\n\n\n\n
On Ubuntu servers, the client is available in a PPA<\/a> maintained by the Certbot team. Install the package archive with the following command while also confirming you have the prerequisites.<\/p>\n\n\n\n
sudo apt-get install software-properties-common\nsudo add-apt-repository universe\nsudo add-apt-repository ppa:certbot\/certbot\nsudo apt-get update<\/pre>\n\n\n\nWith the new PPA installed and repositories updated, install the Certbot client itself along with the Apache plugin. You will naturally also need Apache itself which is included below as well.<\/p>\n\n\n\nsudo apt-get install certbot python-certbot-apache apache2<\/pre>\n\n\n\nOnce installed, you can use the next command to see test the client is working correctly.<\/p>\n\n\n\nsudo certbot --help<\/pre>\n\n\n\nOnce the help command works, you are ready to continue with obtaining and installing certificates.<\/p>\n\n\n\nObtaining certificates<\/h2>\n\n\n\nLet\u2019s Encrypt validates the domain it is installed on similarly to a traditional CA process by identifying the server administrator via a public key. The client generates a new key pair when interacting with the Let\u2019s Encrypt servers for the first time, and then aims to prove to the CA that the host has control over a particular\u00a0domain in at least one of the two following ways:<\/p>\n\n\n\n\nProvisioning a DNS record under the domain in question<\/li>\n\n\n\nProvisioning an HTTP resource under a well-known URI on the domain<\/li>\n<\/ul>\n\n\n\nOn top of one of the two challenges, the client also must sign a nonce with its private key to prove it controls that key pair.<\/p>\n\n\n\n
To help the Certbot client accomplish these tasks it supports a number of plugins that can be used to obtain or install certificates. With Apache2 you can use the dedicated plugin. The plugin automates both obtaining and installing certificates on an Apache web server. To use this plugin on the command line, simply include the flag --apache<\/tt>.<\/p>\n\n\n\n
Begin the process with the next command.<\/p>\n\n\n\nsudo certbot --apache<\/pre>\n\n\n\nThis command starts an interactive installation script which will ask a few questions to help you set up the certificate.<\/p>\n\n\n\n\nOn the first installation on any specific host, you will need to enter a contact email.<\/li>\n\n\n\n
Next, go through the Let\u2019s Encrypt Terms of Service and select Agree if you accept the terms and wish to use the service.<\/li>\n\n\n\n
Then, select whether you want to share your email address with the Electronic Frontier Foundation, a founding partner of the Let\u2019s Encrypt project and the non-profit organization that develops Certbot.<\/li>\n\n\n\n
Enter the domain name hosted on the server you are installing the certificate on. If you have multiple domains on the same server, write them all here separated by a comma.<\/li>\n\n\n\nLastly, select whether you wish to use both HTTP and HTTPS or to redirect traffic to use encryption. We recommend using redirection for better security.<\/li>\n<\/ol>\n\n\n\nIf everything worked correctly you\u2019ll get a message that HTTPS was successfully enabled and a link pointing to SSL Labs test site. Click the SSL Labs link in your terminal to run a test on your web server or use the URL below.<\/p>\n\n\n\n
https:\/\/www.ssllabs.com\/ssltest\/analyze.html<\/a><\/pre>\n\n\n\n<\/figure>\n\n\n\nLet\u2019s Encrypt has set certain rate limits for issuing certificates to ensure fair usage by as many people as possible. You can check the details and documentation at Let\u2019s Encrypt community site<\/a>.<\/p>\n\n\n\n
If you are having problems using the client, make sure you are trying to register a domain or subdomain that currently resolves to that host. Also, check that you have the administrative privileges to run the commands and that Apache is working correctly.<\/p>\n\n\n\n
Renewing certificates<\/h2>\n\n\n\nAt the end of the certificate installation script output, you will see the certificate\u2019s expiration date which is usually 3 months from the day you installed it. Renewing a certificate is as easy as running a single command.<\/p>\n\n\n\n
You can test the renewal process with the following command.<\/p>\n\n\n\nsudo certbot renew --dry-run --agree-tos<\/pre>\n\n\n\nIf the test succeeded without issues, you can actually renew the certificate by leaving out the additional parameters.<\/p>\n\n\n\nsudo certbot renew<\/pre>\n\n\n\nOnce the renewal is complete, reload Apache to update the configuration with the next command.<\/p>\n\n\n\nsudo systemctl reload apache2<\/pre>\n\n\n\nYour certificate is now again valid for another 3 months.<\/p>\n\n\n\n
The client will only request a renewal if the current certificate is about to expire. This can be useful for automating the process by creating a renew script similar to the example below.<\/p>\n\n\n\nsudo nano \/etc\/cron.daily\/certbot-renew<\/pre>\n\n\n\n#!\/bin\/sh\nif certbot renew > \/var\/log\/letsencrypt\/renew.log 2>&1 ; then\n   \/etc\/init.d\/apache2 reload >> \/var\/log\/letsencrypt\/renew.log\nfi\nexit<\/pre>\n\n\n\nsudo chmod +x \/etc\/cron.daily\/certbot-renew<\/pre>\n\n\n\nThe example script runs the renewal while directing the output to a log file, then checks if it was successful, and finally reloads Apache to complete the renewal.<\/p>\n\n\n\nYou can automate the script, for example, using Cron job<\/a>. Open the root<\/tt> user crontab for edit with the command underneath.<\/p>\n\n\n\n
sudo crontab -e<\/pre>\n\n\n\nInclude a line similar to the example below in the crontab file, then save and exit.<\/p>\n\n\n\n01 02,14 * * * \/etc\/cron.daily\/certbot-renew<\/pre>\n\n\n\nLet\u2019s Encrypt recommends setting the automated renewal script to run twice a day on a random minute within the hour. The above example runs on 02:01 and 14:01 but you can select any time slot you wish.<\/p>\n\n\n\nRevoking certificates<\/h2>\n\n\n\nIf you wish to remove a certificate from your server it can be revoked using a subcommand with Let\u2019s Encrypt client. The command below can be used to revoke a particular certificate. Replace the <<\/em>domain_name<\/span>><\/span> <\/em>with the domain which certificate you wish to revoke.<\/p>\n\n\n\ncertbot revoke --cert-path \/etc\/letsencrypt\/live\/<domain_name><\/span>\/cert.pem<\/pre>\n\n\n\nThe process does not give a confirmation upon completion, but if you perform it again you will get a message that the certificate has already been revoked.<\/p>\n\n\n\nEnhancing security<\/h2>\n\n\n\nThe default settings adopted by Let\u2019s Encrypt creates a good starting point for enabling HTTPS but there are additional steps you can take to further enhance security. Let\u2019s Encrypt allows you to improve the site\u2019s security options in a couple of different ways.<\/p>\n\n\n\nCertbot<\/a> supports optional command line parameters when installing certificates. Alternatively, update the configuration file directly after installing the certificate. Below you can find a few tips on how to improve your site\u2019s SSL security by updating the configuration.<\/p>\n\n\n\n
The default SSL options for Apache set by Let\u2019s Encrypt are stored in a config file \/etc\/letsencrypt\/options-ssl-apache.conf<\/tt> that is included in the default Apache SSL config \/etc\/apache2\/sites-available\/000-default-le-ssl.conf<\/tt>.<\/p>\n\n\n\n
Open the first in an editor and make the updates as suggested underneath.<\/p>\n\n\n\n
sudo nano \/etc\/letsencrypt\/options-ssl-apache.conf<\/pre>\n\n\n\nDisable old insecure protocols<\/h3>\n\n\n\nIn the SSL options file, you\u2019ll find that SSLv2 and SSLv3 protocols are already disabled. This is due to the insecurities in these protocols and they should not be used. In addition, TLS v1.0 is also already a legacy protocol and should not be used. However, it is still needed to allow older web browsers to work. Enable it only if absolutely necessary.<\/p>\n\n\n\nSSLProtocol all -SSLv2 -SSLv3 -TLSv1<\/pre>\n\n\n\nEnhance cypher suites<\/h3>\n\n\n\nThe cypher suites enable security between your web server and visitors clients by defining how secure communication takes place. The example configuration below is designed for both RSA and ECDSA keys and works as a great starting point for improved security.<\/p>\n\n\n\nSSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:\nECDHE-ECDSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA:ECDHE-ECDSA-AES128-SHA256:\nECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:\nECDHE-RSA-AES128-SHA:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA256:\nECDHE-RSA-AES256-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:\nDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA256<\/pre>\n\n\n\nBy using SSL protocols of SSLv3 or newer, the client tells the web server which cypher suites it supports and the servers chooses one option from that list. The important part of this functionality is that the cyphers on the server are listed in the prefered order from the strongest to the weakest and the cypher order is honoured. Make sure the option shown below is enabled in your Let\u2019s Encrypt configuration file.<\/p>\n\n\n\nSSLHonorCipherOrder on<\/pre>\n\n\n\nDisable SSL compression<\/h3>\n\n\n\nIn 2012, it was shown by the CRIME attack vulnerability that TLS compression cannot be implemented securely. Therefore, it should not be used and the only solution is to disable TLS compression completely. Check that the following is in your configuration file.<\/p>\n\n\n\nSSLCompression off<\/pre>\n\n\n\nEnable HTTP Strict Transport Security (HSTS)<\/h3>\n\n\n\nThe Strict Transport Security safeguards TLS by not allowing any insecure communication with the websites that use it. It was designed to ensure security even in the case of configuration problems and implementation errors. HSTS automatically converting all plaintext links to a secure version. It also disables click-through certificate warnings which are an indicator of an active MITM attack and prevents users from circumventing the warning.<\/p>\n\n\n\n
Enable HSTS in the \/etc\/letsencrypt\/options-ssl-apache.conf<\/tt> configuration file by adding the option as shown below.<\/p>\n\n\n\n
SSLOptions +StrictRequire<\/pre>\n\n\n\nThen to further improve on this, enable the options to include subdomains and to preload in the Apache default SSL configuration file.<\/p>\n\n\n\n
sudo nano \/etc\/apache2\/sites-available\/000-default-le-ssl.conf<\/pre>\n\n\n\nFind the HSTS settings towards the end of the file and update it as shown below.<\/p>\n\n\n\n
Header always set Strict-Transport-Security \"max-age=31536000; includeSubDomains; preload\"<\/pre>\n\n\n\nWith the security enhancement done, reload the Apache configuration.<\/p>\n\n\n\n
sudo systemctl reload apache2<\/pre>\n\n\n\nThen re-test the SSL quality by clicking the Clear cache link at the results page.<\/p>\n\n\n\n
\nhttps:\/\/www.ssllabs.com\/ssltest\/analyze.html?d=<domain>&clearCache=on\n<\/div><\/figure>\n\n\n\n<\/figure>\n\n\n\nStriking a balance<\/h3>\n\n\n\nPerhaps contrary to common sense, with web servers, there is such a thing as too much security. The cost of the cryptographic handshake operations used to establish secure connections is highly influenced by the size of the private key. While using a too short key is obviously insecure, using a key that is too long can also cause problems due to slow operations.<\/p>\n\n\n\n
By best practices, the ephemeral key exchange should use 2048bit RSA keys and 256bit for ECDHE. Using keys strong than these is considered a waste of CPU cycles with little effect on security. You can read more about SSL and TLS deployment best practices<\/a> at SSLLabs.<\/p>\n\n\n\n
Other plugins<\/h2>\n\n\n\nIn most cases simply installing and renewing your certificates as instructed above is enough, but the Let\u2019s Encrypt client also supports some additional plugins for managing your certificates. This guide focuses on installing the certificate using the Apache plugin, though Let\u2019s Encrypt also works just as well with other web servers software. Check out our other guide for how to install Let\u2019s Encrypt on nginx<\/a>. You can also find out about other supported options in the documentation<\/a> for Let\u2019s Encrypt.<\/p>\n","protected":false},"featured_media":24600,"comment_status":"open","ping_status":"closed","template":"","community-category":[116,121],"class_list":["post-24599","tutorial","type-tutorial","status-publish","has-post-thumbnail","hentry","community-category-web-hosting","community-category-security"],"acf":[],"_links":{"self":[{"href":"https:\/\/studiogo.tech\/upcloudold\/wp-json\/wp\/v2\/tutorial\/24599","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/studiogo.tech\/upcloudold\/wp-json\/wp\/v2\/tutorial"}],"about":[{"href":"https:\/\/studiogo.tech\/upcloudold\/wp-json\/wp\/v2\/types\/tutorial"}],"replies":[{"embeddable":true,"href":"https:\/\/studiogo.tech\/upcloudold\/wp-json\/wp\/v2\/comments?post=24599"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/studiogo.tech\/upcloudold\/wp-json\/wp\/v2\/media\/24600"}],"wp:attachment":[{"href":"https:\/\/studiogo.tech\/upcloudold\/wp-json\/wp\/v2\/media?parent=24599"}],"wp:term":[{"taxonomy":"community-category","embeddable":true,"href":"https:\/\/studiogo.tech\/upcloudold\/wp-json\/wp\/v2\/community-category?post=24599"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}