Let's Encrypt

certbot[edit | edit source]

app-crypt/certbot Certbot is an easy-to-use automatic client that fetches and deploys SSL/TLS certificates for your web server. Certbot can automatically configure your web server to start serving over HTTPS immediately.

acme-tiny (optional)[edit | edit source]

app-crypt/acme-tiny is a short, auditable Python script which avoids a lot of the bloat included in the official client.

certbot[edit | edit source]

server {
    listen 80;
    server_name example.org;
    return 301 https://$host$request_uri;
}
server {
    listen 443 default_server ssl;
    server_name example.org;
    root /var/www/example/htdocs;
    ssl_certificate /etc/letsencrypt/live/example.org/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.org/privkey.pem;

    location / {
      # set nginx configuration
    }
}

acme-tiny[edit | edit source]

The documentation on [1] is the best place to look for the most up to date information, but has been summarized below:

Make a directory for challenges to be created in:

Add this to the Apache http vhost; IE port 80 vhost:

Alias /.well-known/acme-challenge/ /var/www/localhost/acme-challenge/ 

<Directory /var/www/localhost/acme-challenge/> 
       AllowOverride None 
       Require all granted 
</Directory>

Set these in the Apache https vhost; IE port 443 vhost:

SSLCertificateFile /var/lib/letsencrypt/chained.pem
SSLCertificateKeyFile /var/lib/letsencrypt/domain.key

Make a directory to hold the various files related to LE:

Create an account key, domain key and a CSR (replace www.example.co.uk with your host name):

Register and create the various certificate files: Check let's encrypt currently used intermediate certificate

Reload configs for webserver:

or

or

Sample renewal script:

#!/bin/sh
/usr/bin/acme-tiny --account-key /var/lib/letsencrypt/account.key --csr /var/lib/letsencrypt/domain.csr --acme-dir /var/www/localhost/acme-challenge/ > /var/lib/letsencrypt/signed.crt || exit
wget -O - https://letsencrypt.org/certs/lets-encrypt-r3-cross-signed.pem > intermediate.pem
cat /var/lib/letsencrypt/signed.crt intermediate.pem > /var/lib/letsencrypt/chained.pem
service apache2 reload

Add a monthly cron job:

# Renew Lets Encrypt certificate
0 0 1 * * /usr/local/bin/renew-le-cert.sh 2>> /var/log/acme_tiny.log

certbot[edit | edit source]

letsencrypt [SUBCOMMAND] [options] [-d domain] [-d domain] ...

The Let's Encrypt agent can obtain and install HTTPS/TLS/SSL certificates.  By
default, it will attempt to use a webserver both for obtaining and installing
the cert. Major SUBCOMMANDS are:

  (default) run        Obtain & install a cert in your current webserver
  certonly             Obtain cert, but do not install it (aka "auth")
  install              Install a previously obtained cert in a server
  revoke               Revoke a previously obtained certificate
  rollback             Rollback server configuration changes made during install
  config_changes       Show changes made to server config during installation
  plugins              Display information about installed plugins

Choice of server plugins for obtaining and installing cert:

  (the apache plugin is not installed)
  --standalone      Run a standalone webserver for authentication
  (nginx support is experimental, buggy, and not installed by default)
  --webroot         Place files in a server's webroot folder for authentication

OR use different plugins to obtain (authenticate) the cert and then install it:

  --authenticator standalone --installer apache

More detailed help:

  -h, --help [topic]    print this message, or detailed help on a topic;
                        the available topics are:

   all, automation, paths, security, testing, or any of the subcommands or
   plugins (certonly, install, nginx, apache, standalone, webroot, etc)

acmetiny[edit | edit source]

For those that are not interested in using scripts or want to configure things manually the first time, the author of acme-tiny has provided a webpage that gives step by step instructions along with javascript to help walk you through setting up your certificates. The guide may be found on Get HTTPS for Free website.