Let's Encrypt TLS/SSL certificate: learn how to configure it

In this tutorial, we will explain how to configure a Let's Encrypt TLS/SSL certificate on an Ubuntu 16.04 server running Apache as its web server. We will also show you how to automate certificate renewal using cron.

The SSL certificates are used on web servers to encrypt traffic between the server and the client, providing greater security for users who access your website. Let's Encrypt provides an easy way to obtain and install trusted certificates for free.

Requirements for following this tutorial

• An Ubuntu 16.04 server with access to a sudo user
• An Apache server configured with vhosts

Installing the Let's Encrypt client

First, download and install the Let's Encrypt client from the official repositories.

Update the repositories and install the package with apt:

$ sudo apt-get update

$ sudo apt-get install python-letsencrypt-apache

Once installation is complete, you can run the letsencrypt command.

Configuring the TLS/SSL certificate

Generating an SSL certificate for Apache using Let's Encrypt is quite straightforward. You will automatically obtain and install a new SSL certificate valid for the domains provided as parameters.

If you want to add an SSL certificate to a specific domain run the following command:

$ sudo letsencrypt --apache -d dominio.com

If you want to install a single certificate for multiple domains or subdomains, you can pass them as additional parameters. The first domain in the list will be the base domain used by Let's Encrypt to create the certificate, while the remaining domain names will be subdomains or aliases.

$ sudo letsencrypt --apache -d dominio.com -d www.dominio.com -d webmail.dominio.com

The first time you run this command, you will be presented with a step-by-step guide to creating the certificate. You will be asked to provide an email address for lost key recovery and notifications, and you can choose between enabling HTTP and HTTPS access (Easy) or forcing all requests to redirect to HTTPS (Secure).

Once the SSL certificate installation is complete, you should find the generated certificate files at the following path /etc/letsencrypt/live. You can also check the SSL certificate status using the following link (replacing dominio.com with your base domain).

https://www.ssllabs.com/ssltest/analyze.html?d=dominio.com&latest

Configuring automatic renewal

Let's Encrypt certificates are valid for 90 days and renewing them every 60 days is recommended to allow a margin for error. The Let's Encrypt client has a renewal command that automatically checks installed certificates and attempts to renew them if they have fewer than 30 days remaining before expiration. To avoid having to keep track of certificate renewal every 60 days, this process can be automated with cron jobs.

The command to renew all certificates installed on the server is as follows:

$ sudo letsencrypt renew

If you run the command after creating the certificates, you will get output like this:

Keep in mind that if you have created a certificate that includes multiple subdomains, only the base domain name will appear in the output, but the renewal should be valid for all domains included in this certificate. An easy way to ensure that certificates do not expire is to create a cron job to run the renewal command automatically at regular intervals.

The renewal command first checks the expiration date and only performs the renewal if the certificate has fewer than 30 days remaining before expiration. Therefore, it is a good idea to add this command to cron so that it runs every week or even every day.

To do this, create a script for cron to run:

$ sudo vi /root/letsencrypt-renewal.sh

Add the following lines to this new file:

#!/bin/bash
# Clouding.io
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games
log="/var/log/le-renew.log"
echo "" >> $log
/bin/date >> $log
echo "---------------------------------------------" >> $log
/usr/bin/letsencrypt renew >> $log

Save the file and open cron with the following command:

$ sudo crontab -e

Then add the following line at the end of the document:

30 2 * * 1 /root/letsencrypt-renewal.sh

Finally, save and exit the editor. With this line added, you will check every Monday at 2:30 a.m. whether the certificates have fewer than 30 days remaining before expiration. A log will also be created at /var/log/le-renew.log.

Conclusion

With this simple process, your domain now has SSL. Now all that remains is to check in a browser that the domain uses the HTTPS protocol when accessed.