In this blog, you will use Certbot to access SSL certificate for Apache on Ubuntu 18.04 and made your certificate renew automatically.
This blog will use an Apache virtual host file instead of the default configuration file.
We recommend building Apache virtual host files for each domain because it helps to deny regular mistakes and maintains the default files as a fallback configuration.
What are the prerequisites needed?
To follow this blog, you will need:
- One Ubuntu 18.04 server was set up by supporting this initial server setup for Ubuntu 18.04 tutorial, adding a sudo non-root user and a firewall.
- A fully designated domain name. This tutorial will use your_domain as an illustration throughout. You can acquire a domain name on Namecheap, get one for easy on Freenom, or use the domain registrar of your choice.
- Both of the resulting DNS records are set up for your server.
A record with your_domain aiming to your server’s IP address.
A record with www.your_domain aiming to your server’s IP address.
What are the steps to secure apache?
- Step 1 — Installing Certbot
The first step to using Let’s Encrypt to acquire an SSL certificate is to establish the
Certbot software on the server.
Certbot is in very rapid growth, so the Certbot packages produced by Ubuntu manage to be outdated. However, the Certbot developers keep a Ubuntu software container with
up-to-date versions, so use that repository instead.
First, include the repository:
sudo add-apt-repository ppa:certbot/certbot
You’ll be required to choose ENTER to accept.
Enable Certbot’s Apache package with apt:
sudo apt install python-certbot-apache
Certbot is now ready to begin, but in order for it to configure SSL for Apache, we need to check
some of Apache’s configuration.
Step 2 — Set Up the SSL Certificate:
Certbot requires to be capable to identify the virtual host in your Apache configuration for it to default configure SSL. Especially, it does this for a ServerName directive that
matches the domain.
You should have a VirtualHost block for your domain at /etc/apache2/sites-available/your_domain.com.conf with the ServerNamedirective already set appropriately.
Start the virtual host file for your domain using directive already set appropriately.
Start the virtual host file for your domain using
Identify the ServerName line. It should display like this:
/etc/apache2/sites-available/your_domain.conf
...
ServerName your_domain;
...
If it does, exit from the editor and follow the next step.
verify the command of your configuration edits:
sudo apache2ctl configtest
If you get a mistake, again open the virtual host file and check for any typos Once your
configuration file’s command is correct, reload Apache at the new configuration:
sudo systemctl reload apache2
Certbot can now identify the suitable VirtualHost block and update it.
Next, update the firewall to enable HTTPS traffic.
Step 3 — Enabling HTTPS Through the Firewall
If you have the ufw firewall access, you’ll need to adjust the settings to enable HTTPS traffic.
Apache registers numerous profiles with ufw upon installation.
You can see the current setting by entering:
sudo ufw status
It will look like this, meaning that only HTTP traffic is accessed to the webserver:
Output
Status: active
To Action From
-- ------ ----
OpenSSH ALLOW Anywhere
Apache ALLOW Anywhere
OpenSSH (v6) ALLOW Anywhere (v6)
Apache (v6) ALLOW Anywhere (v6)
To let in HTTPS traffic, access the Apache Full profile and delete the redundant Apache profile allowance:
sudo ufw allow 'Apache Full'
sudo ufw delete allow 'Apache'
Your syntax should now look like this:
sudo ufw status
Output
Status: active
To Action From
-- ------ ----
OpenSSH ALLOW Anywhere
Apache Full ALLOW Anywhere
OpenSSH (v6) ALLOW Anywhere (v6)
Apache Full (v6) ALLOW Anywhere (v6)
Next, let’s execute Certbot and fetch our certificates.
Step 4 — Obtaining an SSL Certificate
Certbot gives multiple ways to access SSL certificates through plugins.
The Apache plugin will reconfigure Apache and reload
the config whenever necessary. enter the following:
sudo certbot --apache -d your_domain -d www.your_domain
This executes certbot with the --apache plugin, using -d to make the names you’d like the certificate to be valid for.
while executing certbot, you will be prompted to type an email address and agree to the terms of service. If that’s correct, certbot will ask how you’d like to configure your HTTPS settings:
Output
Please choose whether or not to redirect HTTP traffic to HTTPS, removing HTTP access.
-------------------------------------------------------------------------------
1: No redirect - Make no further changes to the webserver configuration.
2: Redirect - Make all requests redirect to secure HTTPS access. Choose this for
new sites, or if you're confident your site works on HTTPS. You can undo this
change by editing your web server's configuration.
-------------------------------------------------------------------------------
Select the correct number [1-2] then [enter] (press 'c' to cancel):
Select your option then hit ENTER. The configuration will be renewed, and Apache will reload to pick up the new settings. certbot will wrap up with a note telling you the method was corrected and where your certificates are kept:
Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate
Donating to EFF: https://eff.org/donate-le
Your certificates are enabled, installed, and loaded. Try reloading your website using https:// and notice your browser’s safety indicator. It should indicate that
The site is properly safer, usually with a green lock icon.
Step 5 — Verifying Certbot Auto-Renewal
The certbot package we enabled takes care of renewals by adding a renew script to /etc/cron.d, which is directed by a systemctl service called certbot.timer
To check the status of this service and make sure it’s active and executing, you can use:
sudo systemctl status certbot.timer
You’ll get output like to this:
Output
certbot.timer - Run certbot twice daily
Loaded: loaded (/lib/systemd/system/certbot.timer; enabled; vendor preset: enabled)
Active: active (waiting) since Tue 2020-04-28 17:57:48 UTC; 17h ago
Trigger: Wed 2020-04-29 23:50:31 UTC; 12h left
Triggers: certbot.service
Apr 28 17:57:48 fine-turtle systemd[1]: Started Run certbot twice daily.
you can do a dry execute with certbot:
sudo certbot renew --dry-run
Conclusion
In this blog, you enabled the Let’s Encrypt client certbot, downloaded SSL certificates for your domain, configured Apache to use these certificates and set up
automatic certificate renewal.
If you have any doubts about how to secure Apache, Don’t hesitate to contact us through the below email. Airzero Cloud will be your digital partner. Email: [email protected]
Author - Johnson Augustine
Cloud Architect, Ethical hacker
Founder: Airo Global Software Inc
LinkedIn Profile: www.linkedin.com/in/johnsontaugustine/
Author - Johnson Augustine
Author - Johnson Augustine
Author - Johnson Augustine
