SSL certificates are a great way to ensure that the website you’re connected to is really the one you think you’re connected to, and it also keeps the traffic between your client and the server secure. The HTTPS protocol uses SSL certificates. The main problem with the SSL infrastructure was that you needed to get one that was signed by one of the central trusted authorities – and generally if you wanted one of these you had to pay for one. There were a few places that would give you a free certificate for personal use, the other alternative was to use a self signed certificate but there were usability issues because it isn’t signed by a trusted authority.
This all changed recently with Let’s Encrypt – you can now get a free certificate with very little effort. If you maintain a website or host an app, you should check letsencrypt.org out. The remainder of this post is a cleaned up set of notes on what I did.
I started out here https://letsencrypt.org/getting-started/ – which seemed to be a good starting point. Then I figured I’d make sure my server met the criteria they had for support, the documentation had some details covering this. I was happy to see Ubuntu 12.04+ and Apache 2.x support, so this made me fairly confident my server was supported.
But.. my Ubuntu doesn’t seem to have a letsencrypt package
|
1 2 3 4 5 |
$ sudo apt-get install letsencrypt Reading package lists... Done Building dependency tree Reading state information... Done E: Unable to locate package letsencrypt |
No problem, we’ll just follow along with https://letsencrypt.org/getting-started/
|
1 2 3 |
$ git clone https://github.com/letsencrypt/letsencrypt $ cd letsencrypt $ ./letsencrypt-auto --help |
The last command, while asking for help – will do some bootstrapping of let’s encrypt. So don’t skip it. The scripts include calls to sudo, so you don’t have to be root to run them but it will ask for root access.
[Security note – it is always a little bit scary running random scripts, always worth looking at them. There is a growing trend of having “wget -O – http://randomscript.com | bash” be normal, but you should be afraid]
Some exciting updates to my server from doing just the bootstrap. My /etc/ca-certificates got updated (it was probably way overdue), it also dragged me up to date for libssl. It took a while to finish, but we finally got the help screen.
At this point, I have the let’s encrypt tools installed on my server, so time to try them out.
Hopefully the following command is going to register us and get a new certificate for my old expired one.
|
1 |
$ ./letsencrypt-auto --apache |
Well that didn’t work, it picked up some ‘other’ domains I host — but not my main lowtek.ca one. Weird, but probably due to my non-standard configuration of Apache due to years of hacking it. It was easy to bail out so no harm done. Let’s try this then:
|
1 |
$ ./letsencrypt-auto --apache --domains lowtek.ca |
Ok – much better, email sign up and an agreement (which yes, I took the time to read – it was only 6 pages). It seems as I don’t have a virtual host setup for lowtek.ca and needed to manually pick the apache config file (not a big deal), this was why the first try didn’t work.
Visiting https://lowtek.ca/ shows no more certificate error (woot!) and all looks good. It was really this easy.
The end of the script even suggests you visit: https://www.ssllabs.com/ssltest/analyze.html?d=lowtek.ca to check for issues. These SSL Labs tests, show that my certificate from letsencrypt will expire in just under 3 months, so I’ll want to add a cron job to do a renew. They also gave me a B rating, with lots of gorpy details on why.
To renew, I just need to run this command from time to time
|
1 |
$ ./letsencrypt-auto renew |
That’s really easy to do with cron – so I added an entry to my root user crontab to run this once a month.