Configuring LetsEncrypt for your HTTP server is now a fundamental step for any website operator. This guide outlines the essential steps to set up a secure certificate using the official ACME client.
Prerequisites and Initial Setup
Before beginning the configuration, verify your server has a reachable domain pointing to it. You will need administrator rights and a web server like Apache. The Let's Encrypt client package must be added via your distribution's package manager. For example, on Ubuntu, run: `sudo apt install certbot` or `sudo yum install certbot`.
Obtaining the Certificate
The simplest method is to use the standalone plugin. For Nginx, the `--apache` or `--nginx` plugin can automatically modify your configuration file. Run: `sudo certbot --apache -d example.com -d www.example.com`. This initiates the verification process. If you prefer the webroot approach, use: `sudo certbot certonly --webroot -w /var/www/html -d example.com`. This deposits a validation file in your web directory.
Web Server Configuration Adjustments
After receiving the certificate, you must update your site configuration to use the correct paths. For Apache, the usual directives are:
- SSLCertificateFile: `/etc/letsencrypt/live/example.com/fullchain.pem`
- SSLCertificateKeyFile: `/etc/letsencrypt/live/example.com/privkey.pem`
Ensure you activate HTTPS forwarding from HTTP to HTTPS. A 301 redirect is best practice. For Nginx, include a `return 301 https://$host$request_uri;` or use `RewriteEngine On` with `RewriteRule`.
Automated Renewal and Verification
Let's Encrypt certificates are valid for 90 days. The client sets up a scheduled task to refresh them on a regular basis. To test the renewal process, run: `sudo certbot here renew --dry-run`. Check your system logs for warnings. If the renewal does not work, investigate for DNS issues.
Security Hardening (Optional but Recommended)
To improve security, implement HSTS by adding `add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;` in your server block. Also, remove SSLv3 and prefer modern ciphers. A robust configuration protects your visitors from vulnerabilities.
By implementing these steps, your site will be protected with a cost-effective Let's Encrypt certificate, ensuring trust for every request.