Sometimes you may need to add an SSL certificate to all subdomains at once, without having to do so individually. This is what wildcard certificates are for.
The process is quite straightforward and is similar to obtaining Let's Encrypt certificates with Certbot, but with a few configuration differences and an additional DNS record.
Installation
Start by updating the server:
# apt update -y && apt upgrade -yMake sure certbot is installed:
# apt install certbot -yAdd the wildcard SSL certificate:
To add the SSL certificate, run the following command, replacing the email address and domain:
# certbot certonly --manual --preferred-challenges=dns --email ejemplo@ejemplo.com --server https://acme-v02.api.letsencrypt.org/directory --agree-tos -d testkb.com -d *.testkb.comYou will then see a prompt like this, telling you to add DNS TXT records with the subdomain _acme-challenge.dominio.com and the code as the TXT record value:
If you use Clouding's name servers, it would look like this:
Once you have done this, press Enter. A warning will appear indicating that the record may take a little while to update, along with a Toolbox link you can use to check it directly:
Your wildcard certificate is now created:
Once this is done, all that remains is to manually configure the certificates /etc/letsencrypt/live/dominio.com/fullchain.pem and /etc/letsencrypt/live/dominio.com/privkey.pem in the web server you are using.
You can also export it for use on other servers hosting subdomains of the same domain (it will not renew automatically).
Configure the certificates on the web server
Certificate configuration:
In this case, you will need to manually configure the Nginx files to add the certificate paths. Replace the following values in the HTTPS (443) configuration with these paths:
ssl_certificate /etc/letsencrypt/live/ejemplo.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/ejemplo.com/privkey.pem;
include /etc/letsencrypt/options-ssl-nginx.conf;
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;If you wish, you can also add a redirect from TCP port 80 (HTTP) to TCP port 443 (HTTPS) in the corresponding section. Example:
server {
if ($host = ejemplo.com) {
return 301 https://$host$request_uri;
}
listen 80 ;
listen [::]:80 ;
server_name ejemplo.com;
return 404;
}You can also use SSL Checker or an SSL Server Test to verify the Let's Encrypt certificate.
Certificate configuration:
Example Apache configuration file for HTTPS:
<IfModule mod_ssl.c>
<VirtualHost *:443>
# The ServerName directive sets the request scheme, hostname and port that
# the server uses to identify itself. This is used when creating
# redirection URLs. In the context of virtual hosts, the ServerName
# specifies what hostname must appear in the request's Host: header to
# match this virtual host. For the default virtual host (this file) this
# value is not decisive as it is used as a last resort host regardless.
# However, you must set it for any further virtual host explicitly.
#ServerName www.example.com
ServerAdmin webmaster@localhost
DocumentRoot /var/www/html
# Available loglevels: trace8, ..., trace1, debug, info, notice, warn,
# error, crit, alert, emerg.
# It is also possible to configure the loglevel for particular
# modules, e.g.
#LogLevel info ssl:warn
ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined
# For most configuration files from conf-available/, which are
# enabled or disabled at a global level, it is possible to
# include a line for only one particular virtual host. For example the
# following line enables the CGI configuration for this host only
# after it has been globally disabled with "a2disconf".
#Include conf-available/serve-cgi-bin.conf
ServerName ejemplo.com
SSLCertificateFile /etc/letsencrypt/live/ejemplo.com/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/ejemplo.com/privkey.pem
Include /etc/letsencrypt/options-ssl-apache.conf
</VirtualHost>
</IfModule>
Example HTTP-to-HTTPS redirect for an Apache site configuration:
<VirtualHost *:80>
ServerAdmin webmaster@localhost
DocumentRoot /var/www/html
ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined
RewriteEngine on
RewriteCond %{SERVER_NAME} =ejemplo.com
RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]
</VirtualHost>Certificate configuration:
Once this is done, specify the certificate paths for the domain in question in the configuration. If you have access to Webadmin, you can do this in the SSL section of the domain's corresponding virtual host:
| Private Key File | /etc/letsencrypt/live/ejemplo.com/privkey.pem |
| Certificate File | /etc/letsencrypt/live/ejemplo.com/fullchain.pem |
Also remember to enable the Listener on port 443 if it is not already enabled, map the domain, and mark the connection as secure:
In the SSL section, add a certificate to configure SSL and enable support for the necessary protocols, as shown in the following screenshots:
Then configure the certificate under Virtual Hosts:
You can also enable and create a redirect rule:
Redirect rule:
rewriteCond %{HTTPS} !on
rewriteCond %{HTTP:X-Forwarded-Proto} !https
rewriteRule ^(.*)$ https://%{SERVER_NAME}%{REQUEST_URI} [R,L]LiteSpeed certificate configuration
If you are not using CyberPanel, edit the web service configuration file to create or modify the Listener:
# vi /usr/local/lsws/conf/httpd_config.confAn example of adding or modifying the Listener and specifying a certificate's location with vhost mappings:
listener HTTPS {
address *:443
secure 1
keyFile /etc/letsencrypt/live/ejemplo.com/privkey.pem
certFile /etc/letsencrypt/live/ejemplo.com/fullchain.pem
certChain 1
sslProtocol 31
map ejemplo ejemplo.com
map ejemplo2 ejemplo2.com
}
Then you will also need to modify the configuration of the vhost or vhosts (after creating the mapped listener):
# vi /usr/local/lsws/conf/vhosts/ejemplo.com/vhconf.confAn example vhost configuration file with an HTTP-to-HTTPS redirect:
docRoot $VH_ROOT/html/
rewrite {
enable 1
autoLoadHtaccess 1
rules <<<END_rules
rewriteCond %{HTTPS} !on
rewriteCond %{HTTP:X-Forwarded-Proto} !https
rewriteRule ^(.*)$ https://%{SERVER_NAME}%{REQUEST_URI} [R,L]
END_rules
}
vhssl {
keyFile /etc/letsencrypt/live/ejemplo.com/privkey.pem
certFile /etc/letsencrypt/live/ejemplo.com/fullchain.pem
}Remember, if you have any questions about this or anything else related to your Clouding servers, feel free to email soporte@clouding.io. We're here to help with whatever you need. Get in touch!