Finally it’s here: the chance for people to encrypt their websites free of charge. This can be done with Let’s Encrypt.
Clone the Let’s Encrypt tools
git clone https://github.com/letsencrypt/letsencrypt
Go in the directory
cd letsencrypt/
First time certificate generation
./letsencrypt-auto certonly –server https://acme-v01.api.letsencrypt.org/directory -a webroot –webroot-path=/var/www/www.sysstem.at –agree-dev-preview -d www.sysstem.at
/var/www/www.sysstem.at is my webroot and -www.sysstem.at is my domain.
Make sure your Webserver ist running on port 80, because Let’s Encrypt places a verification file in your webroot and tries to download it.
Set up your Apache VirtualHost like this
#010-www.sysstem.at.conf
<VirtualHost *:443>
ServerAdmin admin@sysstem.at
ServerName www.sysstem.at
DocumentRoot /var/www/www.sysstem.at
ErrorLog ${APACHE_LOG_DIR}/www.sysstem.at_error.log
CustomLog ${APACHE_LOG_DIR}/www.sysstem.at_access.log combined
SSLEngine on
SSLCertificateFile /etc/letsencrypt/live/www.sysstem.at/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/www.sysstem.at/privkey.pem
SSLProtocol all -SSLv2 -SSLv3
SSLHonorCipherOrder on
SSLCipherSuite "ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA"
BrowserMatch "MSIE [2-6]" \
nokeepalive ssl-unclean-shutdown \
downgrade-1.0 force-response-1.0
BrowserMatch "MSIE [17-9]" ssl-unclean-shutdown
</VirtualHost>
enable the site with
a2ensite 010-www.sysstem.at.conf
You may wonder where I got this huge load of cypher suites in the Apache config. Depending on which kind of site you are hosting you can decide for weaker or stronger suites. I chose the Intermediate from the Mozilla Site.
And make sure, that you forward all http traffic to https. This is important, because the Let’s Encrypt client tries to get the verification file from http. With the redirect the client will be able to get the file with https enabled.
#000-catchall.conf
<VirtualHost *:80>
ServerAdmin admin@sysstem.at
ServerName catchall
ErrorLog ${APACHE_LOG_DIR}/catchall.log
LogLevel warn
CustomLog ${APACHE_LOG_DIR}/catchall_access.log combined
RewriteEngine On
# This will enable the Rewrite capabilities
RewriteCond %{HTTPS} !=on
# This checks to make sure the connection is not already HTTPS
RewriteRule ^/?(.*) https://%{SERVER_NAME}/$1 [R,L]
</VirtualHost>
enable the site with
a2ensite 000-catchall.conf
We need to make sure to load every Apache module so that everything in our configuration will work.
Enable the SSL Module and the Rewrite Module with
a2enmod ssl a2enmod rewrite
Restart the Apache Server
service apache2 restart
Let’s do a SSL-test on our site. SSL-Labs is my tool of choice for this job.
My site has a great score for now:
Now we have a certificate which is not valid for a very long time. This is by intention by Let’s encrypt. The goal is that certificate renewals should be automated. For this I wrote a little script.
Place this script in /opt/letsencrypt as letsencrypt-renew.sh
This script makes sure that you get a new certificate for your website. It also has a check enabled for people with a dynamic IP. In case this script runs and your provider switches the IP before your dynamic DNS service (like dynDNS and noip) gets the information about it, it will end.
#!/bin/bash export DOMAIN=www.sysstem.at export DIR=/var/www/www.sysstem.at export LETSENCRYPT=/opt/letsencrypt #if Cert older than 30 days and if IP in DNS is current IP find -L /etc/letsencrypt/live/$DOMAIN/fullchain.pem -mtime +30 | egrep '.*' \ && if [ `dig +short $DOMAIN | head -1` == `curl canihazip.com/s` ];then #then renew cert mkdir -p $DIR && cd $LETSENCRYPT && ./letsencrypt-auto --renew-by-default certonly --server https://acme-v01.api.letsencrypt.org/directory -a webroot --webroot-path=$DIR -d $DOMAIN #reload apache with new Cert service apache2 reload fi
Make changes to comply with your website and make the file executable with
chmod +x letsencrypt-renew.sh
Now we check every day if our certificate is up to date. For this open crontab with
crontab -e
and append the following line
0 1 * * * /opt/letsencrypt/letsencrypt-renew.sh
Now you are ready to host your own websites with HTTPS enabled, a valid certificate and good security.
