Voiced by Amazon Polly |
Introduction
In this guide, we’ll walk through obtaining and installing a Let’s Encrypt SSL certificate for Apache on Ubuntu 20.04 and ensure automatic renewal for continuous protection.
Prerequisites
To proceed with this guide, you’ll require the following:
An Ubuntu 20.04 server is properly configured following the initial server setup instructions for Ubuntu 20.04. Ensure you have created a sudo-enabled user and configured a firewall.
A registered domain name. Throughout this tutorial, we’ll use “your_domain” as an example. You can obtain a domain name from various registrars like Namecheap or Freenom or choose your preferred domain registrar.
DNS records configured for your server:
- An A record that points the public IP address of your server to your_domain.
- An A record is pointing www.your_domain to your server’s public IP address.
- Apache is installed on your Ubuntu 20.04 server per the instructions outlined in “How To Install Apache on Ubuntu 20.04”. Ensure you have set up a virtual host file for your domain, such as /etc/apache2/sites-available/your_domain.conf.
Pioneers in Cloud Consulting & Migration Services
- Reduced infrastructural costs
- Accelerated application deployment
Step-by-Step Guide
Step 1 — Installing Certbot:
The initial step in acquiring an SSL certificate from Let’s Encrypt involves installing the Certbot software on your server. This process utilizes the default Ubuntu package repositories.
Two packages are required: certbot and python3-certbot-apache. The latter acts as a plugin, seamlessly integrating Certbot with Apache. This integration facilitates the automation of certificate acquisition and HTTPS configuration within your web server, streamlining the process into a single command.
1 |
sudo apt install certbot python3-certbot-apache |
Step 2 — Reviewing Your Apache Virtual Host Configuration
To enable Certbot to obtain and configure SSL for your web server automatically, the correct virtual host must be located within your Apache configuration files. The ServerName and ServerAlias directives within your VirtualHost configuration block provide the necessary domain information.
You should configure a VirtualHost block for your domain in the file located at /etc/apache2/sites-available/your_domain.conf.
To verify, open the virtual host file associated with your domain in a text editor like Nano.
1 |
sudo nano /etc/apache2/sites-available/domain.conf |
Check for the presence of the ServerName and ServerAlias lines. They should resemble the following:
If your ServerName and ServerAlias match this setup, you can exit the text editor and proceed to the next step. If you’re using nano, exit by pressing CTRL+X, then confirm by typing Y and pressing ENTER.
If your current virtual host configuration differs from the example provided, update it accordingly. After making the necessary changes, save the file and exit the editor. You can then verify your modifications by running the following command:
1 |
sudo apache2ctl configtest |
Verify that you receive a “Syntax OK” response. Review your virtual host file to fix any typos or missing components if an error occurs. Once the syntax of your configuration file is confirmed as correct, reload Apache to implement the changes:
1 |
sudo systemctl reload apache2 |
With these adjustments, Certbot can identify the VirtualHost block and perform necessary updates accurately.
Step 3 — Configuring the Firewall for HTTPS Traffic
If you’ve activated the UFW firewall, as advised in our prerequisite guides, you must make adjustments to permit HTTPS traffic. When Apache is installed, it registers various UFW application profiles. We can utilize the “Apache Full” profile to enable HTTP and HTTPS traffic on your server.
To inspect the current traffic allowances on your server, execute:
1 |
sudo ufw status |
If you’ve followed one of our Apache installation guides, your output should look similar to the example below, showing that only HTTP traffic on port 80 is currently allowed:
To additionally permit HTTPS traffic, enable the “Apache Full” profile and remove the redundant “Apache” profile:
Your status will now reflect the following changes:
With these adjustments, your server can execute Certbot and procure your SSL certificates.
Step 4 — Obtaining an SSL Certificate
Certbot offers various methods for acquiring SSL certificates through its plugins. The Apache plugin simplifies the process by automatically reconfiguring Apache and reloading the configuration as needed. To utilize this plugin, execute the following command:
1 |
sudo certbot --apache |
This command starts a series of prompts to set up your SSL certificate. First, you must enter a valid email address for renewal notifications and security alerts. Once you’ve provided your email address, continue to the next step.
After submitting a valid email, press ENTER to proceed. Subsequently, you’ll be asked to agree to Let’s Encrypt’s terms of service. Confirm by selecting ‘A’ and then pressing ENTER:
Following this, you’ll be prompted to decide whether you wish to share your email with the Electronic Frontier Foundation (EFF) for receiving updates and news. Select ‘N’ if you prefer not to, or ‘Y’ if you do, and then press ENTER:
1 2 3 4 5 |
Would you be willing to share your email address with the Electronic Frontier Foundation, a founding partner of the Let's Encrypt project and the non-profit organization that develops Certbot? We'd like to send you email about our work encrypting the web, EFF news, campaigns, and ways to support digital freedom. (Y)es/(N)o: N |
Next, Certbot will ask you to choose which domains you wish to secure with HTTPS. It automatically retrieves these domain names from your Apache virtual host configuration. Verify that the ServerName and ServerAlias settings in your virtual host are accurate. At the prompt, you can press ENTER to enable HTTPS for all the displayed domains, enter the numbers corresponding to specific domains, separated by commas or spaces, and then press ENTER.
The output will resemble the following:
1 2 3 4 5 6 7 8 9 10 11 12 13 |
Obtaining a new certificate Performing the following challenges: http-01 challenge for your_domain http-01 challenge for www.your_domain Enabled Apache rewrite module Waiting for verification... Cleaning up challenges Created an SSL vhost at /etc/apache2/sites-available/your_domain-le-ssl.conf Enabled Apache socache_shmcb module Enabled Apache ssl module Deploying Certificate to VirtualHost /etc/apache2/sites-available/your_domain-le-ssl.conf Enabling available site: /etc/apache2/sites-available/your_domain-le-ssl.conf Deploying Certificate to VirtualHost /etc/apache2/sites-available/your_domain-le-ssl.conf |
Following that, you’ll encounter a prompt allowing you to decide whether to redirect HTTP traffic to HTTPS. This choice determines whether visitors accessing your site via unencrypted channels (HTTP) are automatically forwarded to the HTTPS version. Opt for option 2 to activate redirection, ensuring all traffic is securely encrypted, or select option 1 to maintain HTTP and HTTPS as distinct access methods for your website.
1 2 3 4 5 6 7 8 |
Please choose whether or not to redirect HTTP traffic to HTTPS, removing HTTP access. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 1: No redirect - Make no further changes to the webserver configuration. 2: Redirect - Make all requests redirect to secure HTTPS access. Choose this for new sites, or if you're confident your site works on HTTPS. You can undo this change by editing your web server's configuration. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Select the appropriate number [1-2] then [enter] (press 'c' to cancel): 2 |
Upon completing these steps, the configuration process for Certbot is finalized. You’ll receive final remarks regarding your newly acquired certificate, including details on the location of the generated files. Instructions on testing your configuration using an external tool to assess your certificate’s authenticity will also be provided.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 |
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Congratulations! You have successfully enabled https://your_domain and https://www.your_domain You should test your configuration at: https://www.ssllabs.com/ssltest/analyze.html?d=your_domain https://www.ssllabs.com/ssltest/analyze.html?d=www.your_domain - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - IMPORTANT NOTES: - Congratulations! Your certificate and chain have been saved at: /etc/letsencrypt/live/your_domain/fullchain.pem Your key file has been saved at: /etc/letsencrypt/live/your_domain/privkey.pem Your cert will expire on 2020-07-27. To obtain a new or tweaked version of this certificate in the future, simply run certbot again with the "certonly" option. To non-interactively renew *all* of your certificates, run "certbot renew" - Your account credentials have been saved in your Certbot configuration directory at /etc/letsencrypt. You should make a secure backup of this folder now. This configuration directory will also contain certificates and private keys obtained by Certbot so making regular backups of this folder is ideal. - If you like Certbot, please consider supporting our work by: Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate Donating to EFF: https://eff.org/donate-le |
Conclusion
In summary, following the steps outlined in this guide, you have successfully secured your Apache web server with a Let’s Encrypt SSL certificate on Ubuntu 20.04. This setup ensures that the data exchanged between your server and its users remains confidential and intact, enhancing trust and boosting the security of your website.
Drop a query if you have any questions regarding Apache web server and we will get back to you quickly.
Making IT Networks Enterprise-ready – Cloud Management Services
- Accelerated cloud migration
- End-to-end view of the cloud environment
About CloudThat
CloudThat is a leading provider of Cloud Training and Consulting services with a global presence in India, the USA, Asia, Europe, and Africa. Specializing in AWS, Microsoft Azure, GCP, VMware, Databricks, and more, the company serves mid-market and enterprise clients, offering comprehensive expertise in Cloud Migration, Data Platforms, DevOps, IoT, AI/ML, and more.
CloudThat is recognized as a top-tier partner with AWS and Microsoft, including the prestigious ‘Think Big’ partner award from AWS and the Microsoft Superstars FY 2023 award in Asia & India. Having trained 650k+ professionals in 500+ cloud certifications and completed 300+ consulting projects globally, CloudThat is an official AWS Advanced Consulting Partner, Microsoft Gold Partner, AWS Training Partner, AWS Migration Partner, AWS Data and Analytics Partner, AWS DevOps Competency Partner, Amazon QuickSight Service Delivery Partner, Amazon EKS Service Delivery Partner, AWS Microsoft Workload Partners, Amazon EC2 Service Delivery Partner, and many more.
To get started, go through our Consultancy page and Managed Services Package, CloudThat’s offerings.
FAQs
1. What is the validity period of a Let's Encrypt SSL certificate, and when should I renew it?
ANS: – Let’s Encrypt SSL certificates, which have a 90-day validity period. To avoid interruptions in your website’s HTTPS security, you must schedule the renewal process every 60 days.
2. What steps should I take if the automatic renewal of my SSL certificate fails?
ANS: – If you face problems with automatic renewal, start by checking the log files created by Certbot, typically found in /var/log/letsencrypt.
![](https://content.cloudthat.com/resources/wp-content/uploads/2022/11/Samarth.jpg)
WRITTEN BY Samarth Kulkarni
Comments