As part of protecting your domains, choose Let's Encrypt! Discover how to easily use it to generate your certificates.
Real-world use case
You want to encrypt your domains without paying for a commercial certificate: discover how to set up Let's Encrypt.
Let's Encrypt: a free, valid certificate
The SSL certificate has been an essential trust element since Edward Snowden's revelations in 2013. On top of that, secure sites are favored in search results. In our case, we'll use the Let's Encrypt service, which is open source (GitHub) and funded by major names on the web, like Mozilla for example.
Info: In this article, we'll use our SSL certificate with the Pound reverse proxy and make certificate renewal easier (since it's only valid for 90 days).
A service that's simple to use
In every use case, Let's Encrypt requires a prerequisite before deployment. Your domain's (or subdomain's) A record needs to point to the server that will use the certificate(s). Next, we'll get the project's sources via git and move into its directory:
git clone https://github.com/letsencrypt/letsencrypt && cd letsencrypt
Let's Encrypt requires that the http and https ports not be listening on the server, so let's stop the Pound service:
service pound stop
Here's a usage example for generating certificates with the main domain and a single subdomain:
./letsencrypt-auto --standalone certonly -d kassianoff.fr -d www.kassianoff.fr --rsa-key-size 4096
For reference:
- certonly: this only generates the certificate and its keys in the /etc/letsencrypt/live/ directory.
- -d (or --domains): this lets you pass domains and subdomains as arguments.
- --rsa-key-size: the RSA key size is 4096 bits (2048 bits by default, not recommended).
The result should look like this:
Requesting root privileges to run letsencrypt...
/root/.local/share/letsencrypt/bin/letsencrypt --standalone certonly -d kassianoff.fr -d www.kassianoff.fr --rsa-key-size 4096
IMPORTANT NOTES:
- Congratulations! Your certificate and chain have been saved at
/etc/letsencrypt/live/kassianoff.fr/fullchain.pem. Your cert will
expire on 2016-07-24. To obtain a new version of the certificate in
the future, simply run Let's Encrypt again.
- If you like Let's Encrypt, please consider supporting our work by:
Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate
Donating to EFF: https://eff.org/donate-le
Once successful, our certificate is now available in the kassianoff.fr folder:
cd /etc/letsencrypt/live/kassianoff.fr/
So we have the following files:
cert.pem chain.pem fullchain.pem privkey.pem
The two files we're interested in are privkey.pem and cert.pem, which we'll concatenate for Pound:
cat /etc/letsencrypt/live/kassianoff.fr/privkey.pem /etc/letsencrypt/live/kassianoff.fr/fullchain.pem > /etc/pound/kassianoff.pem
For this to work, let's add the following to Pound's configuration file, /etc/pound/pound.cfg:
Cert "/etc/pound/kassianoff.pem"
The Pound service can then be started:
service pound start
We now have a valid, signed 90-day certificate in place on our domains and subdomain!
Simplified creation or renewal
I'll admit having a certificate with Let's Encrypt is convenient. However, it can be worth creating and renewing your certificates even more simply. In my case, I created my own script:
git clone https://github.com/ffonaissak/letsencrypt-pound.git && cd letsencrypt-pound
You just need to make the script executable:
chmod +x letsencrypt-pound.sh
Then:
./letsencrypt-pound.sh
An error can occur if, for example, another service is listening on port http or https, such as, in this case, a Docker container:
The program docker (process ID 5427) is already listening on TCP port 80. This
will prevent us from binding to that port. Please stop the docker program
temporarily and then try again.
-------------------------------------------------------------------------------
Press Enter to Continue
At least one of the (possibly) required ports is already taken.
cat: /etc/letsencrypt/live/kassianoff.fr/privkey.pem: No such file or directory
cat: /etc/letsencrypt/live/kassianoff.fr/fullchain.pem: No such file or directory
[....] Starting reverse proxy and load balancer: poundstarting...
. ok
To fix this temporary problem before deploying my patch, locate the service:
ps aux | grep "5427"
root 5427 0.0 0.1 116292 11672 ? Sl 18:45 0:00 docker-proxy -proto tcp -host-ip 0.0.0.0 -host-port 80 -container-ip 172.17.0.72 -container-port 80
Docker is holding onto the http port with a running container, let's stop it:
docker stop my_container
Just run the script again like this:
./letsencrypt-pound.sh
Your first domain (ex:kassianoff.fr)
kassianoff.fr
Your second domain (ex:www.kassianoff.fr)
www.kassianoff.fr
Your third domain (ex:www2.kassianoff.fr)
www2.kassianoff.fr
You domains are : [kassianoff.fr] [www.kassianoff.fr] [www2.kassianoff.fr], Do you want to continue ? [Y/N]
Y
Cloning into 'letsencrypt'...
remote: Counting objects: 34827, done.
remote: Total 34827 (delta 0), reused 0 (delta 0), pack-reused 34827
Receiving objects: 100% (34827/34827), 9.30 MiB | 6.53 MiB/s, done.
Resolving deltas: 100% (24741/24741), done.
[ ok ] Stopping reverse proxy and load balancer: pound.
Your email contact for the certificat (ex:[email protected])
[email protected]
Checking for new version...
Requesting root privileges to run letsencrypt...
/root/.local/share/letsencrypt/bin/letsencrypt --text --email [email protected] --domains kassianoff.fr -d www.kassianoff.fr -d www2.kassianoff.fr --agree-tos --standalone certonly --rsa-key-size 4096
IMPORTANT NOTES:
- Congratulations! Your certificate and chain have been saved at
/etc/letsencrypt/live/kassianoff.fr/fullchain.pem. Your
cert will expire on 2016-07-24. To obtain a new version of the
certificate in the future, simply run Let's Encrypt again.
- If you like Let's Encrypt, please consider supporting our work by:
Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate
Donating to EFF: https://eff.org/donate-le
[....] Starting reverse proxy and load balancer: poundstarting...
. ok
While my script is still young and has a few bugs, I'd like to improve my code!
Feel free to share your feedback with me. I hope this article has helped you secure your domains.