Why should we install security certificates?
I’m a big proponent of protecting data and encrypting communication on the internet regardless of the source or destination. There are just some things that shouldn’t be shared, and it’s the same reason why all envelopes aren’t made entirely of transparent plastic (recycling aside).
This doesn’t just protect your “data” but the transfer of secure information like your credit card numbers and passwords. You should always be cognoscente of the sites you’re sending your data to, and whether you would be okay sharing that information with a perfect stranger.
Note: most people still like to refer to these certificates as SSL certificates. This is referring to an old and obsolete protocol that used to be used for encryption. The new version, and widely accepted standard today is the TLS encryption protocol. At the time of writing this blog, I’ve successfully installed a TLS 1.2 certificate using Certbot with a strong key exchange (ECDHE_RS with P-256), and a strong cipher (AES_128_GCM) according to the security audit in Google Chrome. (Ctrl+Shift+I > Security tab).
Things you’ll need before moving forward.
I’m going to make the assumption that you’ve taken the time to set up your Ubuntu server and install Apache on it. Specifically that you’ve properly configured your (one or more) domains in separate Virtual host files that specify the ServerName.
Let’s get encrypting!
Firstly, you’ll want to add the Certbot repository to your list of software repositories. To do this, run the following command.
sudo add-apt-repository ppa:certbot/certbot
Once that’s finished running its course, you’ll want to pull the latest version of all of your software repositories.
sudo apt-get update
Finally, you can install the Certbot client using the following command.
sudo apt-get install python-certbot-apache
Ubuntu will then take a few moments to install the required software and the client on your system. You’re finally ready to install your TLS certificate on your server.
TLS how to install it! (hah, encryption pun)
This step is actually exceedingly easy. I was very pleased at how simple it was to install, and I think you’ll really enjoy it too.
To run the Certbot installation script and install your certificate into your Virtual Host in one shot, run the following command.
sudo certbot --apache -d yourdomain.com
You can add more domains to this single certificate by specifying multiple domains. Just flag on another -d www.yourdomain.com and you’re flying!
The installation script will walk you through a few questions regarding an administrative email address, accepting their terms of service, and whether or not all traffic will be going through HTTPS or not. It’ll look something like this:
Saving debug log to /var/log/letsencrypt/letsencrypt.log Enter email address (used for urgent renewal and security notices) (Enter 'c' to cancel):support@[redacted] ------------------------------------------------------------------- Please read the Terms of Service at https://letsencrypt.org/documents/LE-SA-v1.1.1-August-1-2016.pdf. You must agree in order to register with the ACME server at https://acme-v01.api.letsencrypt.org/directory ------------------------------------------------------------------- (A)gree/(C)ancel: a ------------------------------------------------------------------- Would you be willing to share your email address with the Electronic Frontier Foundation, a founding partner of the Let's Encrypt project and the non-profit organization that develops Certbot? We'd like to send you email about EFF and our work to encrypt the web, protect its users and defend digital rights. ------------------------------------------------------------------- (Y)es/(N)o: y Obtaining a new certificate Performing the following challenges: tls-sni-01 challenge for [redacted] Enabled Apache socache_shmcb module Enabled Apache ssl module Waiting for verification... Cleaning up challenges Created an SSL vhost at /etc/apache2/sites-available/000-default-le-ssl.conf Enabled Apache socache_shmcb module Enabled Apache ssl module Deploying Certificate for [redacted] to VirtualHost /etc/apache2/sites-available/000-default-le-ssl.conf Enabling available site: /etc/apache2/sites-available/000-default-le-ssl.conf Please choose whether HTTPS access is required or optional. ------------------------------------------------------------------- 1: Easy - Allow both HTTP and HTTPS access to these sites 2: Secure - Make all requests redirect to secure HTTPS access ------------------------------------------------------------------- Select the appropriate number [1-2] then [enter] (press 'c' to cancel): 1 ------------------------------------------------------------------- Congratulations! You have successfully enabled https://[redacted] You should test your configuration at: https://www.ssllabs.com/ssltest/analyze.html?d=[redacted] ------------------------------------------------------------------- IMPORTANT NOTES: - Congratulations! Your certificate and chain have been saved at /etc/letsencrypt/live/[redacted]/fullchain.pem. Your cert will expire on [redacted]. To obtain a new or tweaked version of this certificate in the future, simply run certbot again with the "certonly" option. To non-interactively renew *all* of your certificates, run "certbot renew" - Your account credentials have been saved in your Certbot configuration directory at /etc/letsencrypt. You should make a secure backup of this folder now. This configuration directory will also contain certificates and private keys obtained by Certbot so making regular backups of this folder is ideal. - If you like Certbot, please consider supporting our work by: Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate Donating to EFF: https://eff.org/donate-le
They even offer up an easy way to renew your certificate when it eventually expires! Fantastic!
I have to renew this thing every few months?!
Yep! These free certificates will expire every 90 days. There are technical reasons why they would want you to renew your certificate, like renewing your encryption keys to reduce the risk of decryption. Other than that, it’s nice to automate auto renewal, so you never have to think about this again (almost).
We’ll be using our handy-dandy cron to manage our renewal.
sudo crontab -e
This will prompt you to select a text editor. Vim is my preferred, so I select 3. Add the following line at the bottom of your file to schedule your task to run every day at 4:15am.
15 4 * * * /usr/bin/certbot renew --quiet
:wq to write/quit in Vim and you’ll see a friendly little installation message.
You can opt to run the renewal script less frequently, but since it checks and only updates certificates set to expire in less than thirty days, you won’t be wasting very many precious CPU cycles.
Lastly, since we installed the certificate with the --apache flag, it’ll automatically reconfigure the Apache server every time it renews. This means less server maintenance and downtime!
Final Thoughts
Encryption used to be a very painful process, and even though cPanel and WHM made it easier than before, it was never a simple or pleasant process. I would spend at best 20 minutes to an hour waiting for email verifications, installations, and whatever else these Certificate Authorities required to get everything up and running. With Certbot and Let’s Encrypt, I was encrypting and serving an existing Apache site in less than five minutes.
Overall, I’d have to say I’m very happy with the process. I’m even happier about the cost, time, and effort savings. Now… if they’d only release a logo or badge of some sort for sites that want to promote the use of their services… How am I supposed to let other people know how awesome you are without a sticker on the back of my laptop and the bottom of my website!? 😉
– Cole