The last few weeks were super busy at work, so I accidentally let a few SSL certificates expire. Renewing them is always annoying and time consuming, so I was pushing it until the last minute, and then some.<\/p>\n
Instead of going the usual way for the renewal, I decided to try to the Let’s Encrypt<\/a> deal. (I’ve covered Let’s Encrypt before here<\/a> and here<\/a>.) Basically, Let’s Encrypt is a new Certification Authority, created by Electronic Frontier Foundation<\/a> (EFF), with the backing of Google, Cisco, Mozilla Foundation, and the like. This new CA is issuing well recognized SSL certificates, for free. Which is good. But the best part is that they’ve setup the process to be as automated as possible. All you need is to run a shell command to get the certificate and then another shell command in the crontab to renew the certificate automatically. Certificates are only issued for 3 months, so you’d really want to have them automatically updated.<\/p>\n It took me longer than I expected to figure out how this whole thing works, but that’s because I’m not well versed in SSL, and because they have so many different options, suited for different web servers, and different sysadmin experience levels.<\/p>\n Eventually I made it work, and here is the complete process, so that I don’t have to figure it out again later.<\/p>\n We are running a mix of CentOS 7 and Amazon AMI servers, using both Nginx and Apache. Here’s what I had to do.<\/p>\n First things first. Install the Let’s Encrypt client software. Supposedly there are several options<\/a>, but I went for the official one. Manual way:<\/p>\n Alternatively, you can use geerlingguy’s lets-encrypt-role<\/a> for Ansible.<\/p>\n Secondly, we need to get a new certificate. As I said before, there are multiple options here. I decided to use the certonly<\/em> way, so that I have better control over where things go, and so that I would minimize the web server downtime.<\/p>\n There are a few things that you need to specify for the new SSL certificate. These are:<\/p>\n Now, the command to get the SSL certificate is:<\/p>\n When you run this for the first time, you’ll see that a bunch of additional RPM packages will be installed, for the virtual environment to be created and used. On CentOS 7 this is sufficient. On Amazon AMI, the command will run, install things, and will fail with something like this:<\/p>\n This is useful, but insufficient. Before you can run successfully, you’ll also need to do the following:<\/p>\n Once that is done, run the certbot command with the –debug<\/em> parameter, like so:<\/p>\n This should produce a success message, with “Congratulations!” and all that. The path to your certificate (somewhere in \/etc\/letsencrypt\/live\/example.com\/<\/em>) and its expiration date will be mentioned too.<\/p>\n If you didn’t get the success message, make sure that:<\/p>\n Just drop a simple hello.txt<\/em> to the \/.well-known\/<\/em> folder and see if you can access it with the browser. If you can, then Let’s Encrypt shouldn’t have any issues getting you a certification. If all else fails, RTFM.<\/p>\n Now that you have the certificate generated, you’ll need to add it to the web server’s virtual host configuration. How exactly to do this varies from web server to web server, and even between the different versions of the same web server.<\/p>\n For Apache version >= 2.4.8 you’ll need to do the following:<\/p>\n For Apache version < 2.4.8 you’ll need to do the following:<\/p>\n For Nginx >= 1.3.7 you’ll need to do the following:<\/p>\n You’ll obviously need the additional SSL configuration options for protocols, ciphers and the like, which I won’t go into here, but here are a few useful links:<\/p>\n Once your SSL certificate is issued and web server is configured to use it, all you need is to add an entry to the crontab to renew the certificates which are expiring in 30 days or less. You’ll only need a single entry for all your certificates on this machine. Edit your \/etc\/crontab<\/em> file and add the following (adjust for your web server software, obviously):<\/p>\n That’s about it. Once all is up and running, verify and adjust your SSL configuration, using Qualys SSL<\/a> Labs excellent tool.<\/p>\n\n","protected":false},"excerpt":{"rendered":"\n The last few weeks were super busy at work, so I accidentally let a few SSL certificates expire. Renewing them is always annoying and time consuming, so I was pushing it until the last minute, and then some. Instead of going the usual way for the renewal, I decided to try to the Let’s Encrypt … Continue reading Let’s Encrypt on CentOS 7 and Amazon AMI<\/span><\/a><\/p>\n\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":true,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"Let's Encrypt on CentOS 7 and Amazon AMI #SysAdmin #DevOps #LetsEncrypt #SSL #WebDev #security #privacy","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2},"jetpack_post_was_ever_published":false,"_links_to":"","_links_to_target":""},"categories":[1,6,133,62,1334],"tags":[3270,3476,3085,3246,2366,3427,3164,384,200,3413,1330,2289],"keyring_services":[],"class_list":["post-26208","post","type-post","status-publish","format-standard","hentry","category-general","category-linux","category-sysadmin","category-technology","category-web-work","tag-amazon-aws","tag-amazon-linux-ami","tag-apache","tag-centos-linux","tag-cloud-computing","tag-lets-encrypt","tag-nginx","tag-privacy","tag-security","tag-ssl","tag-web-development","tag-web-hosting"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n# Install requirements\nyum install git bc\ncd \/opt\ngit clone https:\/\/github.com\/certbot\/certbot letsencrypt\n<\/pre>\n
\n
\n\/opt\/letsencrypt\/certbot-auto certonly --webroot --email ssl@example.com --agree-tos -w \/var\/www\/vhosts\/example.com\/ -d example.com -d www.example.com\n<\/pre>\n
\nWARNING: Amazon Linux support is very experimental at present...\nif you would like to work on improving it, please ensure you have backups\nand then run this script again with the --debug flag!\n<\/pre>\n
\nyum install python26-virtualenv\n<\/pre>\n
\n\/opt\/letsencrypt\/certbot-auto certonly --webroot --email ssl@example.com --agree-tos -w \/var\/www\/vhosts\/example.com\/ -d example.com -d www.example.com --debug\n<\/pre>\n
\n
\nSSLEngine on\nSSLCertificateKeyFile \/etc\/letsencrypt\/live\/example.com\/privkey.pem\nSSLCertificateFile \/etc\/letsencrypt\/live\/example.com\/fullchain.pem\n<\/pre>\n
\nSSLEngine on\nSSLCertificateKeyFile \/etc\/letsencrypt\/live\/example.com\/privkey.pem\nSSLCertificateFile \/etc\/letsencrypt\/live\/example.com\/cert.pem\nSSLCertificateChainFile \/etc\/letsencrypt\/live\/example.com\/chain.pem\n<\/pre>\n
\nssl_certificate \/etc\/letsencrypt\/live\/example.com\/fullchain.pem;\nssl_certificate_key \/etc\/letsencrypt\/live\/example.com\/privkey.pem;\n<\/pre>\n
\n
\n# Renew Let's Encrypt certificates at 6pm every Sunday\n0 18 * * 0 root (\/opt\/letsencrypt\/certbot-auto renew && service httpd restart)\n<\/pre>\n