Securing your Apache site with Let’s Encrypt

Improving the security of your website through data encryption, even on the most basic hosting/server environments, can increase your visitors’ trust in your site.
Configuring encryption on your web server was complicated and expensive until recently, which often discouraged administrators whose web applications may depend on users. Let’s Encrypt aims to change this by making it easier to implement encryption on any site. As an open-source project, Let’s Encrypt makes it possible to obtain and install certificates using simple, relatively automated commands.

This guide explains how to install the service on a Linux server running Apache2.

As a new certificate authority, Let’s Encrypt can issue cross-signed certificates that work with modern browsers.

Installing Let’s Encrypt

Let’s Encrypt greatly simplifies certificate handling and management by obtaining them through a series of simple commands. Renewal is performed using a regular task (Wiki: Cron task) that is easy to set up.

The installation process varies across Linux distributions. The easiest option is to follow the instructions on the official website if your server is not running Ubuntu (minimum version 16.04) or Debian (minimum version 8).

Installation is performed from the command line:

sudo apt-get install apache2 python-letsencrypt-apache

 

Once the package is installed, check that it is available with:

letsencrypt --help

If you get the usage instructions for letsencrypt, the installation was successful and you can set up the software.

 

Automatically creating certificates

The Let’s Encrypt service will validate your domains by attempting to identify the server (see the explanation at the end of this article) and verify that the two match. Your domains and subdomains must therefore point to existing directories, and the sites must be accessible over HTTP.

 

Installing Let’s Encrypt on Apache has been greatly simplified, and certificates are automatically configured with a simple command:

sudo letsencrypt --apache

This starts the interactive installation of the service with a few simple questions:

1. If you have an existing configuration, select « No ». Otherwise, « Yes » will use your current VHOSTs, meaning your existing configuration.
2. You can enter your server’s domain names and those of your various sites, separating them with commas.
3. Enter a contact email address to receive an email in case of an issue, particularly for certificate renewals.
4. Confirm that you agree to the service terms of use.
5. Select strict security mode if this matters to you (for SEO, for example), or simple mode, which will allow existing HTTP connections to continue (« Easy »). We recommend « Easy » mode if you already have sites installed.
6. If everything worked correctly, a « Congratulations » message will confirm that the process completed successfully. A link to SSL Labs will also allow you to confirm the certificate’s validity.

 

Please note that if you encounter issues, they are probably related to access to your server or an incorrectly named subdomain.

Reload the Apache configuration to finally see HTTPS appear on your sites:

sudo service apache2 reload

 

Automatically renewing your certificates

At the end of the installation, the script tells you that renewal must take place every 3 months. Fortunately, nothing could be simpler: Let’s Encrypt has also planned for this.

A simple command is all that is needed:

sudo letsencrypt renew --agree-tos

If this command worked correctly, you can now make it a daily cron/automated task by using:

sudo letsencrypt renew

The installation and setup are complete. Reload the Apache configuration one final time and you are done. This command should also be added as a daily automated/cron task.

sudo service apache2 reload

Your certificates will now be renewed automatically and free of charge every quarter!

 

How the service authenticates the server

The service validates the domain on which it is installed in a manner similar to a traditional process, by identifying the server administrator through a public key. The client generates a new key pair when interacting with Let’s Encrypt servers for the first time and aims to prove to the certificate authority that the host controls a particular domain in at least one of the following two ways:

• Testing DNS records on the subdomain.
• Testing access to a unique file specifically created in the correct directory.