Let's Encrypt Free SSL Certificates

See also Using LetsEncrypt SSL Certificates with Zimbra

Home Page: https://letsencrypt.org/certificates/

Documentation: https://certbot.eff.org/all-instructions/

Webmin: https://doxfer.webmin.com/Webmin/Let's_Encrypt

CAA records authorize SSL certificate issuance by certain certificate authorities.

For Virtualmin managed domains, manually enter something like:

hostname.domain.tld.	IN	CAA	0 issue "letsencrypt.org"

Test Your Certs: https://www.digicert.com/help/

• Free new service with goal of 100% HTTPS for web traffic
  • By the non-profit Internet Security Research Group (ISRG)
• Trusted by most all browsers
  • Currently due to cross-signing by IdenTrust
  • Let’s Encrypt Authority X3 (issuer)
  • DST Root CA X3 (IdenTrust cross-signing CA chain certificate)
• SAN certificates
  • Add multiple Subject Alternative Names

Home: https://certifytheweb.com/

Single: https://support.centrestack.com/hc/en-us/articles/360010229973-Obtaining-a-Server-Certificate-from-Let-s-Encrypt-Using-Certify-The-Web

Wildcard: https://support.centrestack.com/hc/en-us/articles/360010235053-Obtaining-a-Wildcard-Certificate-from-Let-s-Encrypt-Using-Certify-The-Web

Home: https://github.com/PKISharp/win-acme/wiki/Basic-usage

How to Run: https://github.com/PKISharp/win-acme/wiki/How-to-Run

This is a simple CLI tool that automates a great deal while allowing for numerous configurations.

This script is still under heavy development.

Exchange 2016 HowTo: https://www.netometer.com/video/tutorials/How-to-Install-LetsEncrypt-Certificate-in-Exchange-Server/

Exchange 2016 HowTo: https://mediarealm.com.au/articles/lets-encrypt-microsoft-exchange-installation/

Make sure the site works as desired before attempting to acquire a LetsEncrypt cert!

If you need to add a SAN (Subject Alternative Name) to a LetsEncrypt cert, you first have to make the web server serve that SAN. One way is to add a ServerAlias to the site's Apache configuration file:

Virtualmin → <vserver> → Services → Configure Website → Edit Directives

or edit /etc/apache2/sites-available/yourdomain.tld.conf, adding:

ServerAlias desiredalias.yourdomain.tld

With LetsEncrypt, it's currently difficult to add the SAN and redirect it to a folder. Here we just redirect it

This will install Apache if not already installed.

https://www.digitalocean.com/community/tutorials/how-to-secure-apache-with-let-s-encrypt-on-ubuntu-16-04

https://certbot.eff.org/lets-encrypt/ubuntuxenial-apache

apt-get update && apt-get -y install software-properties-common
add-apt-repository ppa:certbot/certbot
apt-get update && apt-get -y install python-certbot-apache

certbot renew --dry-run

Make sure the site works as desired before attempting to acquire a LetsEncrypt cert!

Virtualmin supports Let's Encrypt SSL certificates for hosted virtual servers.

1. Edit the desired virtual server
   1. Enable SSL
2. Request a Let's Encrypt certificate

Virtualmin → <domain> → Edit Virtual Server → Apache SSL website → Enable → Save

Virtualmin → <domain> → Server Configuration → Manage SSL Certificate → Let's Encrypt

https://www.virtualmin.com/comment/785483#comment-785483

https://serverfault.com/questions/750902/how-to-use-lets-encrypt-dns-challenge-validation

https://certbot.eff.org/docs/using.html#manual

Add this for testing:

--staging

apt install certbot

certbot -d hostname.yourdomain.tld --manual --preferred-challenges dns certonly

certbot renew --dry-run

certbot certificates

Documentation: https://doxfer.webmin.com/Webmin/Let's_Encrypt

More Info: http://webmin.com/ssl.html

Webmin also supports Let's Encrypt SSL certificates.

Webmin → Webmin → Webmin Configuration → SSL Encryption → Let's Encrypt

Certbot has its own log rotation.

/etc/logrotate.d/letsencrypt

/var/log/letsencrypt/letsencrypt.log {
  daily
  rotate 0
  firstaction
    /usr/bin/find /var/log/letsencrypt/ -name "letsencrypt.log.*" -mtime +100 -delete
  endscript
  nocreate
  missingok
  notifempty
}

Test:

ll /var/log/letsencrypt/   #before
logrotate -f /etc/logrotate.d/letsencrypt
ll /var/log/letsencrypt/   #after

Remove scheduled task and registry key (HKEY_LOCAL_MACHINE\Software\letsencrypt-win-simple), then perform an iisreset as an administrator.

Increase verbosity:

--verbose