HTTPS Certificate from Let's Encrypt

2022-08-10

As part of the “Great Reconstruction” project for this Web site, I got a SSL certificate form Let’s Encrypt. The process was absolutely painless following these instructions: “How to secure Apache with Let’s Encrypt on Ubuntu 18.04”¹.

The Certbot script requested the certificate, created a new SSL site in /etc/apache2/sites-configured and set up the cron job to renew certificate every 90 days. For once something that worked painlessly in Linux :)

I went back to this post and discovered that the instruction page has vanished. To avoid further broken links, here are the instructions from https://linuxvox.com/blog/secure-apache-with-let-s-encrypt-on-ubuntu-18-04/. I assume the Apache server is installed and working.

Configure Firewall #

Ubuntu 18.04 uses ufw (Uncomplicated Firewall) by default. Allow HTTP (port 80) and HTTPS (port 443) traffic:

1. Check UFW Status #

If ufw is inactive, enable it first:

sudo ufw enable

2. Allow Apache Traffic #

Apache registers a UFW profile during installation. Allow “Apache Full” (which permits both HTTP and HTTPS):

sudo ufw allow 'Apache Full'

Verify the rules:

sudo ufw status

You should see:

Status: active

To                         Action      From
--                         ------      ----
Apache Full                ALLOW       Anywhere
Apache Full (v6)           ALLOW       Anywhere (v6)

Install Certbot #

Certbot is Let’s Encrypt’s official tool for obtaining and managing SSL certificates. It automates certificate issuance and Apache configuration.

Install certbot and the python3-certbot-apache plugin (which integrates Certbot with Apache):

sudo apt install certbot python3-certbot-apache -y

Obtain SSL Certificate with Certbot #

The certbot --apache plugin automates SSL setup by:

• Validating domain ownership (via HTTP-01 challenge).
• Installing the SSL certificate.
• Configuring Apache to use HTTPS.
• Optionally redirecting HTTP traffic to HTTPS.

1. Run Certbot #

Replace example.com and www.example.com with your domain(s):

sudo certbot --apache -d example.com -d www.example.com

2. Certbot Prompts #

Certbot will guide you through setup with prompts:

1. Email Address: Enter an email for renewal notices and security alerts.
2. Terms of Service: Agree to Let’s Encrypt’s terms.
3. Share Email: Choose whether to share your email with the Electronic Frontier Foundation (EFF).
4. Redirect HTTP to HTTPS: Select 2 to redirect all HTTP traffic to HTTPS (recommended for security).

3. Success Message #

If successful, you’ll see a message like:

Congratulations! You have successfully enabled https://example.com and https://www.example.com

Verify SSL Configuration #

1. Check Certificate Installation #

Visit your domain in a browser (e.g., https://example.com). You’ll see a padlock icon in the address bar, confirming HTTPS is active.

2. Test SSL with OpenSSL #

Run this command to verify the certificate details:

openssl s_client -connect example.com:443

Look for SSL-Session: and Verify return code: 0 (ok) to confirm the certificate is valid.

3. Inspect Apache Configuration #

Certbot modifies Apache’s virtual host files (e.g., /etc/apache2/sites-available/000-default-le-ssl.conf). Check for SSL settings like:

SSLCertificateFile /etc/letsencrypt/live/example.com/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/example.com/privkey.pem

Set Up Auto-Renewal #

Let’s Encrypt certificates expire after 90 days. Certbot automatically configures a renewal timer to avoid manual updates.

1. Verify Auto-Renewal Setup #

Check if the Certbot timer is active:

sudo systemctl status certbot.timer

You should see active (waiting). If not, enable it:

sudo systemctl enable --now certbot.timer

2. Test Renewal Process #

Simulate a renewal to ensure it works:

sudo certbot renew --dry-run

If successful, you’ll see Congratulations, all simulated renewals succeeded.

History:
2022-08-10 Initial version
2026-08-10 Removed broken linked and inserted actual instructions