User Tools

Site Tools


internet:security:ssl_cert_letsencrypt

This is an old revision of the document!


Let's Encrypt Free SSL Certificates

SSL Certificate Testing

Test Your Certs: https://www.digicert.com/help/

  • Free new service with goal of 100% HTTPS for web traffic
    • By the non-profit Internet Security Research Group (ISRG)
  • Trusted by most all browsers
    • Currently due to cross-signing by IdenTrust
    • Let’s Encrypt Authority X3 (issuer)
    • DST Root CA X3 (IdenTrust cross-signing CA chain certificate)
  • SAN certificates
    • Add multiple Subject Alternative Names

Microsoft Windows

Certify the Web

win-acme

Home: https://github.com/PKISharp/win-acme/wiki/Basic-usage

How to Run: https://github.com/PKISharp/win-acme/wiki/How-to-Run

This is a simple CLI tool that automates a great deal while allowing for numerous configurations.

This script is still under heavy development.

Microsoft Exchange

Apache

:!: Make sure the site works as desired before attempting to acquire a LetsEncrypt cert!

ServerAlias

If you need to add a SAN (Subject Alternative Name) to a LetsEncrypt cert, you first have to make the web server serve that SAN. One way is to add a ServerAlias to the site's Apache configuration file:

Virtualmin → <vserver> → Services → Configure Website → Edit Directives

or edit /etc/apache2/sites-available/yourdomain.tld.conf, adding:

ServerAlias desiredalias.yourdomain.tld

:!: With LetsEncrypt, it's currently difficult to add the SAN and redirect it to a folder. Here we just redirect it

Ubuntu 16.04

https://www.digitalocean.com/community/tutorials/how-to-secure-apache-with-let-s-encrypt-on-ubuntu-16-04

https://certbot.eff.org/lets-encrypt/ubuntuxenial-apache

apt-get update && apt-get -y install software-properties-common
add-apt-repository ppa:certbot/certbot
apt-get update && apt-get -y install python-certbot-apache

Renewal

certbot renew --dry-run

Troubleshooting

Remove scheduled task and registry key (HKEY_LOCAL_MACHINE\Software\letsencrypt-win-simple), then perform an iisreset as an administrator.

Increase verbosity:

--verbose

Virtualmin

:!: Make sure the site works as desired before attempting to acquire a LetsEncrypt cert!

Virtualmin supports Let's Encrypt SSL certificates for hosted virtual servers.

  1. Edit the desired virtual server
    1. Enable SSL
  2. Request a Let's Encrypt certificate

Virtualmin → <domain> → Edit Virtual Server → Apache SSL website → Enable → Save

Virtualmin → <domain> → Server Configuration → Manage SSL Certificate → Let's Encrypt

mail.domain.tld

Webmin

Documentation: https://doxfer.webmin.com/Webmin/Let's_Encrypt

More Info: http://webmin.com/ssl.html

Webmin also supports Let's Encrypt SSL certificates.

Webmin → Webmin → Webmin Configuration → SSL Encryption → Let's Encrypt

Request a Let's Encrypt Cert

Successful

Resultant Webmin SSL Settings

internet/security/ssl_cert_letsencrypt.1550939899.txt.gz · Last modified: 2019/02/23 09:38 by gcooper