Configuring Let's Encrypt for your HTTP server is now a critical task for any website operator. This guide outlines the key procedures to set up a secure certificate using Certbot.
Prerequisites and Initial Setup
Before launching the configuration, ensure your machine has a public IP pointing to it. You will need root access and a HTTP daemon like Nginx. The Let's Encrypt client package must be installed via your distribution's package manager. For example, on Ubuntu, run: `sudo apt install certbot` or `sudo yum website install certbot`.
Obtaining the Certificate
The simplest method is to use the standalone plugin. For Apache, the `--apache` or `--nginx` plugin can seamlessly modify your configuration file. Run: `sudo certbot --apache -d example.com -d www.example.com`. This starts the verification process. If you prefer a non-intrusive method, use: `sudo certbot certonly --webroot -w /var/www/html -d example.com`. This deposits a validation file in your web directory.
Web Server Configuration Adjustments
After receiving the certificate, you must update your server block to use the correct paths. For Apache, the typical directives are:
- SSLCertificateFile: `/etc/letsencrypt/live/example.com/fullchain.pem`
- ssl_certificate_key: `/etc/letsencrypt/live/example.com/privkey.pem`
Ensure you enable HTTPS redirection from HTTP to HTTPS. A permanent redirect is standard. For Apache, include a `return 301 https://$host$request_uri;` or use `RewriteEngine On` with `RewriteRule`.
Automated Renewal and Verification
Let's Encrypt certificates last 90 days. The client configures a systemd timer to update them without manual intervention. To simulate the renewal process, run: `sudo certbot renew --dry-run`. Check your server logs for warnings. If the renewal encounters a problem, check for firewall issues.
Security Hardening (Optional but Recommended)
To improve security, enable HTTP Strict Transport Security (HSTS) by adding `add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;` in your location block. Also, disable SSLv3 and use secure protocols. A solid configuration safeguards your visitors from downgrade attacks.
By adhering to these guidelines, your application will be protected with a cost-effective Let's Encrypt certificate, ensuring integrity for every request.