<p>Setting up an https for your website becomes a standard those days. Instead of paying $65+ every year with GoDaddy, we can get a free SSL/TLS with Let's encrypt.</p><blockquote><p>A nonprofit Certificate Authority providing TLS certificates to 225 million websites.</p></blockquote><p>Confused about SSL/TLS vs HTTPS? You may checkout this great article explaining <a target="_blank" rel="noopener noreferrer" href="https://howhttps.works/https-ssl-tls-differences/">this</a>, and below is a summary:</p><ol><li><strong>SSL</strong>&nbsp;stands for 'Secure Sockets Layer', which is <i>deprecated</i> now.</li><li><strong>TLS </strong>stands for 'Transport Layer Security', which is the<i> new protocol </i>for secured encryption on the web maintained by IETF.</li><li>When that exchange of data is encrypted with&nbsp;<strong>SSL</strong>/<strong>TLS</strong>, then we call it&nbsp;<strong>HTTPS</strong>.</li></ol><figure class="image"><img src="https://images.unsplash.com/photo-1526374965328-7f61d4dc18c5?ixlib=rb-1.2.1&amp;q=80&amp;fm=jpg&amp;crop=entropy&amp;cs=tinysrgb&amp;w=1080&amp;fit=max&amp;ixid=eyJhcHBfaWQiOjExODA5M30"><figcaption>Photo by: <a target="_blank" rel="noopener noreferrer" href="https://unsplash.com/@markusspiske?utm_source=unsplash-chrome-extension&amp;utm_medium=referral">Markus Spiske</a></figcaption></figure><p>In this tutorial, we will cover how to set up an HTTPs image server (https://images.deniapps.com) by installing Let's Encrypt FREE TLS certificates on Ubuntu 16.04/18.04/20.04 with Apache.&nbsp;</p><h3>1. SSH to your server</h3><pre><code class="language-plaintext">ssh root@1.2.3.4 //use root, or any user with sudo privileges.</code></pre><h3>2. Add Certbot PPA</h3><p>You'll need to add the Certbot PPA to your list of repositories. To do so, run the following commands on the command line on the machine:</p><pre><code class="language-plaintext">sudo apt-get update
sudo apt-get install software-properties-common
sudo add-apt-repository universe
sudo add-apt-repository ppa:certbot/certbot //no need for Ubuntu 20.04
sudo apt-get update</code></pre><p>* For Ubuntu 20.04, you may not need to add '<i>ppa:certbot/certbot</i>'.</p><h3>3. Install Certbot</h3><p>Run this command on the command line on the machine to install Certbot.</p><pre><code class="language-plaintext">sudo apt-get install certbot python3-certbot-apache</code></pre><h3>4. Update DNS</h3><p>Go to your domain provider, in my case, GoDaddy, to update DNS record, i.e. add A record by pointing “images” to the server's IP, like this:</p><figure class="image"><img src="https://images.deniapps.com/domain-manager.png"></figure><h3>5. Run Certbot to Get a Certificate</h3><pre><code class="language-plaintext">sudo certbot certonly --apache -d images.deniapps.com</code></pre><p>You will be told where your certificates are saved, usually it's under:</p><p><i>/etc/letsencrypt/live/YOUR-DOMAIN-NAME/</i></p><h3>6. Renewal</h3><p>Since certificates from Let’s Encrypt are&nbsp;only valid for 90 days. We should renew before it's expired by running this command:</p><pre><code class="language-plaintext">sudo certbot renew</code></pre><p>You can make this automatically by adding this to your cronjob, for example:</p><pre><code class="language-plaintext">43 6 1 * * certbot renew //run it the first on of each month at 6:43 am</code></pre><h3>7. Set Up Virtual Host</h3><p>Make a web folder for images site, for example: /var/www/images. And then create a Apache configuration File under /etc/apache2/site-avaiable, for example, images.deniapps.com.conf, with the following contents:</p><pre><code class="language-plaintext">&lt;IfModule mod_ssl.c&gt;
&lt;VirtualHost *:443&gt;
 &nbsp;ServerAdmin webmaster@localhost
 &nbsp;ServerName images.deniapps.com
 &nbsp;ServerAlias www.images.deniapps.com
 &nbsp;DocumentRoot /var/www/images
 &nbsp;ErrorLog ${APACHE_LOG_DIR}/error.log
 &nbsp;CustomLog ${APACHE_LOG_DIR}/access.log combined
Include /etc/letsencrypt/options-ssl-apache.conf
SSLCertificateFile /etc/letsencrypt/live/images.deniapps.com/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/images.deniapps.com/privkey.pem
&lt;/VirtualHost&gt;
&lt;/IfModule&gt;</code></pre><p>Then, enable your config by running this command:</p><pre><code class="language-plaintext">sudo a2ensite images.deniapps.com </code></pre><p>Then, you should test your config by running this command:&nbsp;</p><pre><code class="language-plaintext">sudo apachectl configtest</code></pre><p>When you see <strong>Syntax OK, you can run reload the Apache2 to make it live:</strong></p><pre><code class="language-plaintext">sudo /etc/init.d/apache2 reload</code></pre><p>You are all set. Check it out at https://images.deniapps.com</p><h3>Final notes</h3><ul><li>You can have multiple subdomains sharing the same certificate by adding more domains in Step 5:</li></ul><pre><code class="language-plaintext">sudo certbot certonly --apache -d images.deniapps.com -d files.deniapps.com</code></pre><ul><li>Let's Encrypt supports wildcard, but before you choose this, make sure your DNS provider has some kind of API to update TXT records for your domain so you could automate the process to get a wildcard cert. Otherwise, you will need to manually validate the TXT record, i.e., _acme-challenge. every 90 days, which is super annoying. - Since you can run Cerbot anything to get a certificate for your next subdomain, I would say no bother this.</li><li>Installing Let's Encrypt Certification on Nginx is similar, but you would need to restart Nginx after renewing your certification. To fix this, you may add /etc/letsencrypt/cli.ini:</li></ul><pre><code class="language-plaintext">deploy-hook = systemctl reload nginx</code></pre><p><strong>Reference</strong>: <a target="_blank" rel="noopener noreferrer" href="https://certbot.eff.org/">https://certbot.eff.org/</a></p><h3>Updates</h3><p>Dec 28, 2023</p><p>Migrating certificates from one server to another presents difficulties, mainly due to symbolic links in the live folder that reference the latest certificates in the archive folder. When transferring files from the LetsEncrypt folder, it's crucial to ensure the copy includes the symbolic links, not just the actual files. This step is vital for successful certificate renewal later on.</p><p>In case of issues, if the configuration becomes disrupted, follow these steps to regenerate the certificate:</p><ol><li>Disable the site configuration: <code>sudo a2dissite SITE
</code></li><li>Run Certbot to add the certificate: <code>sudo certbot certonly --apache -d YOUR_DOMAIN</code></li><li>Enable the site configuration: <code>sudo a2ensite SITE</code></li><li>Reload Apache to apply the changes: <code>sudo systemctl reload apache2

</code></li></ol>

Setting up an https for your website becomes a standard those days. Instead of paying $65+ every year with GoDaddy, we can get a free SSL/TLS with Let's encrypt. In this tutorial, we will cover how to set up an HTTPs image server (https://images.deniapps.com) by installing Let's Encrypt FREE TLS certificates on Ubuntu 16.04/18.04/20.04 with Apache. 

How to Set Up an HTTPS Image Server

<p>For nearly <strong>three years</strong>, SwimStandards.com has quietly had a problem that I didn’t realize until recently: <strong>Googlebot was failing to crawl </strong><code><strong>www.swimstandards.com</strong></code> due to an SSL error.</p><figure class="image"><img src="https://images.unsplash.com/photo-1614036417651-efe5912149d8?crop=entropy&amp;cs=tinysrgb&amp;fit=max&amp;fm=jpg&amp;ixid=M3wxNTQwMTB8MHwxfHNlYXJjaHw4NHx8Y2VydGlmaWNhdGV8ZW58MHx8fHwxNzUwNjMzNDUzfDA&amp;ixlib=rb-4.1.0&amp;q=80&amp;w=1080"><figcaption>Photo by <a target="_blank" rel="noopener noreferrer" href="https://unsplash.com/@brandsandpeople?utm_source=DNX&amp;utm_medium=referral">Brands&amp;People</a> on <a target="_blank" rel="noopener noreferrer" href="https://unsplash.com/?utm_source=DNX&amp;utm_medium=referral">Unsplash</a></figcaption></figure><p>I always assumed everything was working fine because:</p><p>I only use <code>https://swimstandards.com</code></p><p>Google Search Console didn’t report any errors for the root domain</p><p>I never intentionally promoted the <code>www</code> version</p><p>But last week, I finally looked into a persistent <strong>“High fail rate”</strong> warning from Google Search Console — and I found the root cause.</p><h3>What Happened?</h3><p>When I first set up SSL using Let's Encrypt, I only issued a certificate for:</p><pre><code class="language-plaintext">swimstandards.com</code></pre><p>I didn’t realize that <code><strong>www.swimstandards.com</strong></code><strong> was not included</strong> — and that matters.</p><p>Googlebot (and some users) occasionally try the <code>www</code> version. Since the SSL certificate didn’t cover it, requests to <code>https://www.swimstandards.com</code> <strong>failed with a certificate mismatch</strong>, leading to crawl failures and potentially missed indexing.</p><h3>The Fix (Finally)</h3><p>I reissued the SSL certificate using Certbot with both domains:</p><pre><code class="language-plaintext">sudo certbot --apache -d swimstandards.com -d www.swimstandards.com</code></pre><p>This updated the certificate to include both:</p><pre><code class="language-plaintext">DNS:swimstandards.com
DNS:www.swimstandards.com</code></pre><p>I also added a redirect so that any requests to <code>www.swimstandards.com</code> get properly forwarded to the canonical root domain:</p><pre><code class="language-plaintext">https://swimstandards.com</code></pre><h3>Did This Affect SEO?</h3><p>Honestly — probably <strong>not much</strong>, but it's possible:</p><p>Google favors a consistent, canonical domain structure.</p><p>Failing SSL on <code>www</code> might have prevented some backlinks from being credited correctly.</p><p>Googlebot crawl errors, even if minor, aren’t ideal over a long period.</p><p>If there was any SEO impact, it was likely small, but avoidable.</p><h3>Lesson Learned</h3><p>If you're running a site:</p><p>Always <strong>include both </strong><code><strong>domain.com</strong></code><strong> and </strong><code><strong>www.domain.com</strong></code> when issuing your SSL certificate.</p><p>Always set up <strong>proper redirects</strong> from the non-canonical domain.</p><p>Use tools like <code>curl</code>, <code>openssl</code>, and <a target="_blank" rel="noopener noreferrer" href="https://www.ssllabs.com/ssltest/">SSL Labs</a> to test both versions.</p><p>Check Search Console regularly — <strong>even warnings you think don’t matter</strong>.</p><h3>TL;DR</h3><p>For 3 years, <code>https://www.swimstandards.com</code> was broken due to an SSL oversight. I fixed it in 10 minutes — and I wish I had done it sooner.</p>

For nearly three years, SwimStandards.com has quietly had a problem that I didn’t realize until recently: Googlebot was failing to crawl www.swimstandards.com due to an SSL error.
I always assumed everything was working fine because:
I only use https://swimstandards.com
Google Search Console didn’t report any errors for the root domain

All Posts In Let's Encrypt