#let'sencrypt

Securing your websites with an SSL certificate is now a must for all website admins, else the web browsers will mark the website as unsafe to visit, causing the loss of website traffic. But SSL certificate is not cheap, but there is a way around to get an SSL certificate for free with the only downside that we need to renew SSL cert every 90 days but that process can also be automated. In this tutorial, we will discuss how we can configure an SSL on Nginx with Let’s encrypt. We have already discussed in our previous tutorial, how we can configure SSL cert with Let’s certificate on Apache Web Server, so if you are using Apache you can check that tutorial. Now let’s start with the process to configure SSL on Nginx with Let’s Encrypt. Recommended Read: Simple way to configure Nginx Reverse Proxy Here we will discuss the method for Ubuntu & CentOS/RHEL using a let’s encrypt tool called 'certbot'. So let’s start with Pre-requisites, Also Read: Analyzing APACHE logs in CLI (& GUI) using GoAccess

Pre-Requisites

- We will need a registered Domain address, - We will need a CentOS/RHEL or Ubuntu server with Ngnix installed. Installation steps are mentioned below, Ubuntu Nginx is available with default Ubuntu Repositories. So simply install it using the following command, $ sudo apt-get update && sudo apt-get install nginx CentOS/RHEL We need to add some repos for installing nginx on CentOS & we have created a detailed article here for Nginx installation on CentOS/RHEL. Now start the services & enable it for boot, # systemctl start nginx # systemctl enable nginx Once it's installed, we can move to the next part i.e. installing let's encrypt & issuing of SSL certificate on nginx with let's encrypt for the website.

Let's Encrypt on Ubuntu

Firstly we need to install Certbot on the Ubuntu system, but it's not available with default Ubuntu repositories. Install the Ubuntu repos with the following command, $ sudo apt-get install software-properties-common $ sudo add-apt-repository universe $ sudo add-apt-repository ppa:certbot/certbot $ sudo apt-get update Now to install the Certbot, execute the following command from the terminal, $ sudo apt-get install python-certbot-nginx Now, we will issue a new SSL certificate using certbot command. Use the following command as reference, $ sudo certbot --nginx -d linuxtechlab.com -d www.linuxtechlab.com Here linuxtechlab.com is the name of the website for which the certificate will be issued, replace this with the name of your website. If this is the first time you are using Certbot, you will be asked to enter an Email address & also to agree to the User Agreement,

Now certbot will then check with the let’s encrypt server to verify that you are the web admin of the domain that you are trying to get an SSL for (usually you need to place two files with random text provided by let’s encrypt at location http://domain-name/.well-known/acme-challenge. more details on that HERE). Once site ownership has been confirmed, we will be asked to configure redirect settings for Nginx, you can choose 1 (No-Redirect) or 2 (Redirect). If you choose 1, then you will have to configure redirect yourselves in Nginx configuration afterward, with option 2, the configuration will be updated & Nginx will be reloaded to implement the new changes made.

Our cert is now installed & new configurations also have been loaded. As mentioned above, we need to renew the cert every 90 days, for that, we can create a new cronjob, mentioned at the end of this tutorial. Now let’s discuss the SSL issue procedure for CentOS & RHEL,

Let's Encrypt on CentOS/RHEL

To install Certbot on CentOS, we will need to first install EPEL repositories first on our system. Install EPEL using the following command on your system, RHEL/CentOS 8 $ sudo dnf install https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm RHEL/CentOS 7 # rpm -Uvh https://dl.fedoraproject.org/pub/epel/7/x86_64/Packages/e/epel-release-7-11.noarch.rpm RHEL/CentOS 6 (64 Bit) # rpm -Uvh http://download.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm RHEL/CentOS 6 (32 Bit) # rpm -Uvh http://dl.fedoraproject.org/pub/epel/6/i386/epel-release-6-8.noarch.rpm Now we to install certbot use the following command, # yum install certbot-nginx Once the certbot has been installed, we can then issue the SSL certificate with the same command as mentioned above, # certbot --nginx -d linuxtechlab.com -d www.linuxtechlab.com Now the process will same as has been mentioned above for Ubuntu. Now after the cert has been installed, we need to make sure that the certificate is renewed before 90 days.

Automatic Certificate Renewal

YaCy is a peer-to-peer search engine. Every peer sets up his own client and is able to crawl and index websites. Searches are carried out by contacting all known peers and cumulating their returns. It is not necessary to have a web server for that. You may well install YaCy on your office computer but of course it only works as long as it is connected to the internet. A long time ago I maintained a YaCy peer on my web server. Later I lost interest because there were (and still are) too less peers online to be a reasonable alternative to Google. Usually only a few hundred concurrently. But to flatter my vanity I now decided to set up my own peer again mainly to introduce several websites I am part of the admin team. Main issue now was that my webserver employs Nginx as reverse proxy and I do not want to expose additional ports to the internet (YaCy's default ports are 8090 and 8443). Good luck, due to the Docker image the install procedure proved fairly easy! Both Nginx and YaCy need the default settings only! In order to use Nginx as reverse proxy its configuration needs to contain some special commands. My default proxy_params file is longer than its pendant in the Nginx GitHub repository: proxy_set_header Host $http_host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; client_max_body_size 100M; client_body_buffer_size 1m; proxy_intercept_errors on; proxy_buffering on; proxy_buffer_size 128k; proxy_buffers 256 16k; proxy_busy_buffers_size 256k; proxy_temp_file_write_size 256k; proxy_max_temp_file_size 0; proxy_read_timeout 300; This proved good enough. Installing YaCy from Docker requires only two comands (head over to this particular site to learn how to backup and update your instance): docker pull yacy/yacy_search_server:latest docker run -d --name yacy_search_server -p 8090:8090 -p 8443:8443 -v yacy_search_server_data:/opt/yacy_search_server/DATA --restart unless-stopped --log-opt max-size=200m --log-opt max-file=2 -e YACY_NETWORK_UNIT_AGENT=mypeername yacy/yacy_search_server:latest We do not need settings for TLS in YaCy since this is done bx Nginx (employing Let's Encrypt in this case). Since YaCy's internal links are all relative, we can proxy the localhost without caring for host name and protocol schemen. The following Nginx server is fully operational: server { listen 443 ssl http2; listen [::]:443 ssl http2; server_name my.host.name; root /var/www/my.host.name; index index.html index.htm default.html default.htm; location / { proxy_pass http://127.0.0.1:8090; include /etc/nginx/proxy_params; } access_log /var/log/nginx/my.host.name_access.log; error_log /var/log/nginx/my.host.name_error.log; ssl_certificate /etc/letsencrypt/live/my.host.name/fullchain.pem; # managed by Certbot ssl_certificate_key /etc/letsencrypt/live/my.host.name/privkey.pem; # managed by Certbot } Head over to my search interface. But attention: there is an extended blacklist excluding pseudo science, extremist politics, conspiracy theories and so on (mainly German sites). Use another YaCy instance to get the same search without my exclusions.

Case

You need to issue a SAN (Subject Alternate Name) or Wildcard TLS certificate from Let's Encrypt. You have a Windows or a Linux machine without any Web server installed. You only have one or more registered DNS domains for which you have access to their authoritative DNS server zones. All you need to do is issue Let's Encrypt certificates using Certbot with DNS validation.

Solution

Let's Encrypt works with the Certbot tool (provided by EFF - Electronic Frontier Foundation) to anyone who wishes to issue a free Let's Encrypt certificate. The Certbot tool offers very detailed documentation. Certbox is a CLI tool which comes with a variety of command parameters, to match all possible configurations. Unless you have a Web server installed (Apache, NGinx, IIS, etc) you cannot use the relevant command parameters to utilize your existing online Web server to validate your DNS domains. In this case, if you simply own a few DNS domains and have access to their authoritative DNS server zones, you will have to use a Certbox DNS plugin. A DNS plugin allows you to validate ownership of your DNS domains without an active/live Web server. Alternatively you can use the Certbot manual certificate issuance method by using the --preferred-challenges parameter with value "dns". Also bear in mind that autorenewal of --manual certificates requires the use of an authentication hook script (--manual-auth-hook). Unless you provide the --mannual-auth-hook parameter, you will have to repeat the same certbot manual certificate issuance before the new certificate's expiry date.

Let's Encrypt is a free, automated and open Certification Authority. The objective of Let’s Encrypt and the ACME protocol is to make it possible to set up an HTTPS server and have it automatically obtain a browser-trusted certificate, without any human intervention. This is accomplished by running a certificate management agent on the web server. With our Webhosting service based on Plesk technology you can have free SSL certificates with Let's Encrypt so all your web pages will be secured. Plesk plugin is installed by default on all subscriptions, you just need to enable it if you like to use SSL certificate to protect your web site.  

Creating SSL Certificates with Let's Encrypt

To create your SSL Certificate just logon in your Webhosting portal, click on domain you like to create SSL certificates then click on related icon like show below:

If you still don't have a Webhosting service you can access to Webhosting demo.

  Screenshots

  HTTPS and SEO

Let's Encrypt, alan adı doğrulama ve düzenleme yazılımındaki bir hata nedeniyle 4 Mart Çarşamba günü 3 milyondan fazla sertifikayı iptal edecek. Let's Encrypt'in sertifika yetkilisi (CA) yazılımındaki bir hata, bazı sertifikaların ilişkili bir etki alanı için yapılandırılan Sertifika Yetki Yetkilendirmesi (CAA) aracılığıyla doğrulanmamasına neden oldu. CAA, etki alanı yöneticilerinin söz konusu etki alanı için sertifika vermesine izin verilen sertifika yetkililerini kısıtlayan bir DNS kaydı oluşturmasına olanak tanıyan bir güvenlik özelliğidir. Bu özelliğin kurallarının bir parçası olarak, yetkililer CAA kayıtlarını bir sertifika verilmeden önce en fazla 8 saat önce kontrol etmelidir. CA yazılımlarında Boulder adı verilen bir hata, çok alanlı bir sertifikadaki bir alanın, bir kez kontrol edilen sertifikadaki tüm alan adlarından ziyade birçok kez kontrol edilmesine neden oldu. Bu, bazı etki alanları için doğru CAA denetimleri olmadan sertifikaların verilmesine neden oldu. "Hata: Bir sertifika isteği CAA'nın yeniden denetlenmesini gerektiren N alan adlarını içerdiğinde, Boulder bir alan adı seçer ve N kez kontrol eder. Bunun anlamı, bir abonenin X zamanında bir alan adını doğrulaması ve CAA'nın X'in izin verdiği anda söz konusu alan adına ilişkin kayıtlar Let's Encrypt'in yayınlanmasına izin verdiğinde, bir kullanıcı Let's Encrypt tarafından verilmesini yasaklayan bu alan adına CAA kayıtları yüklese bile, abone bu alan adını içeren bir sertifikayı X + 30 güne kadar yayınlayabilir, " Bu nedenle bugün Let's Encrypt şu anda geçerli olan 3.048.289 sertifikayı iptal edecek. Etkilenenler için Let's Encrypt, sertifikalarını geçersiz hale gelmeden önce yarına kadar yenilemesi gereken kullanıcılara e-posta gönderdi.