How to Setup Let’s Encrypt SSL on Ubuntu 18.04

Let’s Encrypt is a certificate authority (CA) providing free SSL/TLS certificates. You can get a valid SSL certificate for your domain at no cost. These certificates can be used for production use as well. The certificates can only be requested from there server where the domain is pointed. Let’s Encrypt do a DNS check for the domain, that domain is pointed to the current server. After that, it issues a certificate for you. This tutorial will help you to install Let’s Encrypt client on your Ubuntu system and issue an SSL certificate for the domain.

Step 1 – Prerequisites

Before starting work on this task, I assume you already have:

  • Running Ubuntu system with sudo privileges shell access.
  • A domain name registered and pointed to your server’s public IP address. For this tutorial, we use example.com and www.example.com, which is pointed to our server.
  • Running web server with VirtualHost configured for example.com and www.example.com on Port 80.

Step 2 – Install Let’s Encrypt Client

Download the certbot-auto Let’s Encrypt client and save under /usr/sbin directory. Use the following command to do this.

sudo wget https://dl.eff.org/certbot-auto -O /usr/sbin/certbot-auto
sudo chmod a+x /usr/sbin/certbot-auto

Step 3 – Get an SSL Certificate

Let’s Encrypt do a strong Domain Validation automatically with multiple challenges to verify the ownership of the domain. Once the Certificate Authority (CA) verified the authenticity of your domain, SSL certificate will be issued.

sudo certbot-auto certonly --standalone -d example.com  -d www.example.com

Above command will prompt for an email address, which is used for sending email alerts related to SSL renewal and expiration. Also, asks a few more questions. After completion, it will issue an SSL certificate and will also create a new VirtualHost configuration file on your system.

Step 4 – Check SSL Certificate

If everything goes fine. A new SSL will be issued at below location. Navigate to below directory and view files.

cd /etc/letsencrypt/live/example.com
ls 

Files List:

  cert.pem
  chain.pem
  fullchain.pem
  privkey.pem

Setp 5 – Configure SSL VirtualHost

Use the following configurations for Apache and Nginx web server. Edit the virtual host configuration file and add below entries for the certificate.

Nginx:

ssl on;
ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

Apache:

SSLEngine on
SSLCertificateFile /etc/letsencrypt/live/example.com/cert.pem
SSLCertificateKeyFile /etc/letsencrypt/live/example.com/privkey.pem
SSLCertificateChainFile /etc/letsencrypt/live/example.com/chain.pem

You need to set above code in .conf file like example.com.conf

sudo nano /etc/apache2/sites-available/default-ssl.conf

<IfModule mod_ssl.c>
    <VirtualHost _default_:443>
        ServerAdmin [email protected]
        DocumentRoot /var/www/html
        ErrorLog ${APACHE_LOG_DIR}/error.log
        CustomLog ${APACHE_LOG_DIR}/access.log combined
        SSLEngine on
        SSLCertificateFile /etc/ssl/certs/ssl-cert-snakeoil.pem
        SSLCertificateKeyFile /etc/ssl/private/ssl-cert-snakeoil.key
        <FilesMatch "\.(cgi|shtml|phtml|php)$">
                        SSLOptions +StdEnvVars
        </FilesMatch>
        <Directory /usr/lib/cgi-bin>
                        SSLOptions +StdEnvVars
        </Directory>
        BrowserMatch "MSIE [2-6]" \
                        nokeepalive ssl-unclean-shutdown \
                        downgrade-1.0 force-response-1.0
        BrowserMatch "MSIE [17-9]" ssl-unclean-shutdown
    </VirtualHost>
</IfModule>

Now that we have configured our SSL-enabled virtual host, we need to enable it.

We can do this by typing:

sudo a2ensite default-ssl.conf

We then need to restart Apache to load our new virtual host file:

sudo service apache2 restart

Step 6 – Configure SSL Auto- Renew

In the end, configure the following job on your server crontab to auto-renew SSL certificate if required.

0 2 * * * sudo /usr/sbin/certbot-auto -q renew

Leave a Reply

Your email address will not be published. Required fields are marked *