<p>Setting up an https for your website becomes a standard those days. Instead of paying $65+ every year with GoDaddy, we can get a free SSL/TLS with Let's encrypt.</p><blockquote><p>A nonprofit Certificate Authority providing TLS certificates to 225 million websites.</p></blockquote><p>Confused about SSL/TLS vs HTTPS? You may checkout this great article explaining <a target="_blank" rel="noopener noreferrer" href="https://howhttps.works/https-ssl-tls-differences/">this</a>, and below is a summary:</p><ol><li><strong>SSL</strong>&nbsp;stands for 'Secure Sockets Layer', which is <i>deprecated</i> now.</li><li><strong>TLS </strong>stands for 'Transport Layer Security', which is the<i> new protocol </i>for secured encryption on the web maintained by IETF.</li><li>When that exchange of data is encrypted with&nbsp;<strong>SSL</strong>/<strong>TLS</strong>, then we call it&nbsp;<strong>HTTPS</strong>.</li></ol><figure class="image"><img src="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?ixlib=rb-1.2.1&amp;q=80&amp;fm=jpg&amp;crop=entropy&amp;cs=tinysrgb&amp;w=1080&amp;fit=max&amp;ixid=eyJhcHBfaWQiOjExODA5M30"><figcaption>Photo by: <a target="_blank" rel="noopener noreferrer" href="https://unsplash.com/@markusspiske?utm_source=unsplash-chrome-extension&amp;utm_medium=referral">Markus Spiske</a></figcaption></figure><p>In this tutorial, we will cover how to set up an HTTPs image server (https://images.deniapps.com) by installing Let's Encrypt FREE TLS certificates on Ubuntu 16.04/18.04/20.04 with Apache.&nbsp;</p><h3>1. SSH to your server</h3><pre><code class="language-plaintext">ssh root@1.2.3.4 //use root, or any user with sudo privileges.</code></pre><h3>2. Add Certbot PPA</h3><p>You'll need to add the Certbot PPA to your list of repositories. To do so, run the following commands on the command line on the machine:</p><pre><code class="language-plaintext">sudo apt-get update
sudo apt-get install software-properties-common
sudo add-apt-repository universe
sudo add-apt-repository ppa:certbot/certbot //no need for Ubuntu 20.04
sudo apt-get update</code></pre><p>* For Ubuntu 20.04, you may not need to add '<i>ppa:certbot/certbot</i>'.</p><h3>3. Install Certbot</h3><p>Run this command on the command line on the machine to install Certbot.</p><pre><code class="language-plaintext">sudo apt-get install certbot python3-certbot-apache</code></pre><h3>4. Update DNS</h3><p>Go to your domain provider, in my case, GoDaddy, to update DNS record, i.e. add A record by pointing “images” to the server's IP, like this:</p><figure class="image"><img src="https://images.deniapps.com/domain-manager.png"></figure><h3>5. Run Certbot to Get a Certificate</h3><pre><code class="language-plaintext">sudo certbot certonly --apache -d images.deniapps.com</code></pre><p>You will be told where your certificates are saved, usually it's under:</p><p><i>/etc/letsencrypt/live/YOUR-DOMAIN-NAME/</i></p><h3>6. Renewal</h3><p>Since certificates from Let’s Encrypt are&nbsp;only valid for 90 days. We should renew before it's expired by running this command:</p><pre><code class="language-plaintext">sudo certbot renew</code></pre><p>You can make this automatically by adding this to your cronjob, for example:</p><pre><code class="language-plaintext">43 6 1 * * certbot renew //run it the first on of each month at 6:43 am</code></pre><h3>7. Set Up Virtual Host</h3><p>Make a web folder for images site, for example: /var/www/images. And then create a Apache configuration File under /etc/apache2/site-avaiable, for example, images.deniapps.com.conf, with the following contents:</p><pre><code class="language-plaintext">&lt;IfModule mod_ssl.c&gt;
&lt;VirtualHost *:443&gt;
 &nbsp;ServerAdmin webmaster@localhost
 &nbsp;ServerName images.deniapps.com
 &nbsp;ServerAlias www.images.deniapps.com
 &nbsp;DocumentRoot /var/www/images
 &nbsp;ErrorLog ${APACHE_LOG_DIR}/error.log
 &nbsp;CustomLog ${APACHE_LOG_DIR}/access.log combined
Include /etc/letsencrypt/options-ssl-apache.conf
SSLCertificateFile /etc/letsencrypt/live/images.deniapps.com/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/images.deniapps.com/privkey.pem
&lt;/VirtualHost&gt;
&lt;/IfModule&gt;</code></pre><p>Then, enable your config by running this command:</p><pre><code class="language-plaintext">sudo a2ensite images.deniapps.com </code></pre><p>Then, you should test your config by running this command:&nbsp;</p><pre><code class="language-plaintext">sudo apachectl configtest</code></pre><p>When you see <strong>Syntax OK, you can run reload the Apache2 to make it live:</strong></p><pre><code class="language-plaintext">sudo /etc/init.d/apache2 reload</code></pre><p>You are all set. Check it out at https://images.deniapps.com</p><h3>Final notes</h3><ul><li>You can have multiple subdomains sharing the same certificate by adding more domains in Step 5:</li></ul><pre><code class="language-plaintext">sudo certbot certonly --apache -d images.deniapps.com -d files.deniapps.com</code></pre><ul><li>Let's Encrypt supports wildcard, but before you choose this, make sure your DNS provider has some kind of API to update TXT records for your domain so you could automate the process to get a wildcard cert. Otherwise, you will need to manually validate the TXT record, i.e., _acme-challenge. every 90 days, which is super annoying. - Since you can run Cerbot anything to get a certificate for your next subdomain, I would say no bother this.</li><li>Installing Let's Encrypt Certification on Nginx is similar, but you would need to restart Nginx after renewing your certification. To fix this, you may add /etc/letsencrypt/cli.ini:</li></ul><pre><code class="language-plaintext">deploy-hook = systemctl reload nginx</code></pre><p><strong>Reference</strong>: <a target="_blank" rel="noopener noreferrer" href="https://certbot.eff.org/">https://certbot.eff.org/</a></p><h3>Updates</h3><p>Dec 28, 2023</p><p>Migrating certificates from one server to another presents difficulties, mainly due to symbolic links in the live folder that reference the latest certificates in the archive folder. When transferring files from the LetsEncrypt folder, it's crucial to ensure the copy includes the symbolic links, not just the actual files. This step is vital for successful certificate renewal later on.</p><p>In case of issues, if the configuration becomes disrupted, follow these steps to regenerate the certificate:</p><ol><li>Disable the site configuration: <code>sudo a2dissite SITE
</code></li><li>Run Certbot to add the certificate: <code>sudo certbot certonly --apache -d YOUR_DOMAIN</code></li><li>Enable the site configuration: <code>sudo a2ensite SITE</code></li><li>Reload Apache to apply the changes: <code>sudo systemctl reload apache2

</code></li></ol>

Setting up an https for your website becomes a standard those days. Instead of paying $65+ every year with GoDaddy, we can get a free SSL/TLS with Let's encrypt. In this tutorial, we will cover how to set up an HTTPs image server (https://images.deniapps.com) by installing Let's Encrypt FREE TLS certificates on Ubuntu 16.04/18.04/20.04 with Apache. 

All Posts In Https