How To Secure Apache With Let's Encrypt On Ubuntu 20.04 - DigitalOcean
How To Secure Apache With Let's Encrypt On Ubuntu 20.04 - DigitalOcean
04 | DigitalOcean
CONTENTS
Prerequisites
Step 1 — Installing Certbot
Step 2 — Checking your Apache Virtual Host Configuration
Step 3 — Allowing HTTPS Through the Firewall
Step 4 — Obtaining an SSL Certificate
Step 5 — Verifying Certbot Auto-Renewal
Conclusion
R E L AT E D
// Tutorial //
Published
This site usesoncookies
April 29,
and 2020
related· technologies,
Updated on asApril 29, 2020
described in our MANAGE CHOICES
privacy policy,
policy, for purposes that may include site operation, analytics,
enhanced userLet's
experience,
Encryptor advertising. You may choose to consent
to Apache
our use of these technologies,Ubuntu 20.04
or manage your own preferences. AGREE & PROCEED
https://www.digitalocean.com/community/tutorials/how-to-secure-apache-with-let-s-encrypt-on-ubuntu-20-04 1/19
5/12/22, 22:13 How To Secure Apache with Let's Encrypt on Ubuntu 20.04 | DigitalOcean
Introduction
Let’s Encrypt is a Certificate Authority (CA) that facilitates obtaining and installing free
TLS/SSL certificates, thereby enabling encrypted HTTPS on web servers. It simplifies the
process by providing a software client, Certbot, that attempts to automate most (if not all)
of the required steps. Currently, the entire process of obtaining and installing a certificate
is fully automated on both Apache and Nginx.
In this
This site guide,
uses we’ll use
cookies and Certbot
related to obtain aasfree
technologies, SSL certificate
described in our for Apache on Ubuntu 20.04,
and make
privacy policysure
policy, this certificate
, for purposes that mayisinclude
set upsite
to renew automatically.
operation, analytics,
enhanced user experience, or advertising. You may choose to consent
toThis tutorial
our use of theseusestechnologies,
a separateorvirtual
managehostyourfileowninstead of Apache’s default configuration file
preferences.
for setting up the website that will be secured by Let’s Encrypt. We recommend creating
https://www.digitalocean.com/community/tutorials/how-to-secure-apache-with-let-s-encrypt-on-ubuntu-20-04 2/19
5/12/22, 22:13 How To Secure Apache with Let's Encrypt on Ubuntu 20.04 | DigitalOcean
new Apache virtual host files for each domain hosted in a server, because it helps to avoid
common mistakes and maintains the default configuration files as a fallback setup.
Prerequisites
In order to obtain an SSL certificate with Let’s Encrypt, we’ll first need to install the Certbot
software on your server. We’ll use the default Ubuntu package repositories for that.
We need two packages: certbot , and python3-certbot-apache . The latter is a plugin that
integrates Certbot with Apache, making it possible to automate obtaining a certificate and
configuring HTTPS within your web server with a single command.
$ sudo apt install certbot python3-certbot-apache Copy
You will be prompted to confirm the installation by pressing Y , then ENTER .
Certbot is now installed on your server. In the next step, we’ll verify Apache’s configuration
to make
This site
surecookies
uses
your virtual
and
hosttechnologies,
related
is set appropriately.
as
Thisin our
described
will ensure that the certbot client
script policy,
privacy will be, forable
policy to detect
purposes yourinclude
that may domainssiteand reconfigure
operation, analytics,your web server to use your
newly generated
enhanced SSL certificate
user experience, automatically.
or advertising. You may choose to consent
to our use of these technologies, or manage your own preferences.
https://www.digitalocean.com/community/tutorials/how-to-secure-apache-with-let-s-encrypt-on-ubuntu-20-04 3/19
5/12/22, 22:13 How To Secure Apache with Let's Encrypt on Ubuntu 20.04 | DigitalOcean
Configuration
In order to be able to automatically obtain and configure SSL for your web server, Certbot
needs to find the correct virtual host within your Apache configuration files. Your server
domain name(s) will be retrieved from the ServerName and ServerAlias directives defined
within your VirtualHost configuration block.
If you followed the virtual host setup step in the Apache installation tutorial, you should
have a VirtualHost block set up for your domain at /etc/apache2/sites-
available/ your_domain .conf with the ServerName and also the ServerAlias directives
already set appropriately.
To check this up, open the virtual host file for your domain using nano or your preferred
text editor:
$ sudo nano /etc/apache2/sites-available/ your_domain .conf Copy
Find the existing ServerName and ServerAlias lines. They should look like this:
/etc/apache2/sites-available/your_domain.conf
...
ServerName your_domain
ServerAlias www.your_domain
...
If you already have your ServerName and ServerAlias set up like this, you can exit your
text editor and move on to the next step. If you’re using nano , you can exit by typing
CTRL+X , then Y and ENTER to confirm.
If your current virtual host configuration doesn’t match the example, update it accordingly.
When you’re done, save the file and quit the editor. Then, run the following command to
validate your changes:
$ sudo apache2ctl configtest Copy
This
Yousiteshould
uses cookies
get and related
a Syntax OK astechnologies,
ainclude
response. as Ifdescribed inanourerror, reopen the virtual host file
you getanalytics,
privacy policy
policy,
and check , for purposes that may site operation,
enhanced userforexperience,
any typosororadvertising.
missing characters.
You may choose Onceto your
consentconfiguration file’s syntax is
tocorrect,
our use ofreload
theseApache so thator manage
technologies, the changes
your owntakepreferences.
effect:
https://www.digitalocean.com/community/tutorials/how-to-secure-apache-with-let-s-encrypt-on-ubuntu-20-04 4/19
5/12/22, 22:13 How To Secure Apache with Let's Encrypt on Ubuntu 20.04 | DigitalOcean
If you have the UFW firewall enabled, as recommended by the prerequisite guides, you’ll
need to adjust the settings to allow HTTPS traffic. Upon installation, Apache registers a few
different UFW application profiles. We can leverage the Apache Full profile to allow both
HTTP and HTTPS traffic on your server.
To verify what kind of traffic is currently allowed on your server, you can use:
$ sudo ufw status Copy
If you have followed one of our Apache installation guides, your output should look
something like this, meaning that only HTTP traffic on port 80 is currently allowed:
Web hosting without headaches. Try Cloudways with $100 in free We're Blog Docs Get Sales
credit! Sign up ->
Output
hiring Support
Status: active
To Action From
-- ------ ----
OpenSSH ALLOW Anywhere
Tutorials Questions Learning Paths For Businesses Product Docs Social Impact
Apache ALLOW Anywhere
OpenSSH (v6) ALLOW Anywhere (v6)
Apache (v6) ALLOW Anywhere (v6)
To additionally let in HTTPS traffic, allow the “Apache Full” profile and delete the redundant
“Apache” profile:
$ sudo ufw allow 'Apache Full' Copy
$ sudo ufw delete allow 'Apache'
Output
Status: active
To Action From
-- ------ ----
OpenSSH ALLOW Anywhere
Apache Full ALLOW Anywhere
OpenSSH (v6) ALLOW Anywhere (v6)
Apache Full (v6) ALLOW Anywhere (v6)
You are now ready to run Certbot and obtain your certificates.
Step 4 — Obtaining an SSL Certificate
Certbot provides a variety of ways to obtain SSL certificates through plugins. The Apache
plugin will take care of reconfiguring Apache and reloading the configuration whenever
necessary. To use this plugin, type the following:
$ sudo certbot --apache Copy
This script will prompt you to answer a series of questions in order to configure your SSL
certificate. First, it will ask you for a valid e-mail address. This email will be used for
renewal notifications and security notices:
Output
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator apache, Installer apache
Enter email address (used for urgent renewal and security notices) (Enter 'c' to
cancel): you@your_domain
After providing a valid e-mail address, hit ENTER to proceed to the next step. You will then
be prompted to confirm if you agree to Let’s Encrypt terms of service. You can confirm by
pressing A and then ENTER :
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Please read the Terms of Service at
This site uses cookies and related technologies, as described in our
https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf. You must
privacy policy,
policy, for purposes that may include site operation, analytics,
agree in order to register with the ACME server at
enhanced user experience, or advertising. You may choose to consent
https://acme-v02.api.letsencrypt.org/directory
to our use of these technologies, or manage your own preferences.
https://www.digitalocean.com/community/tutorials/how-to-secure-apache-with-let-s-encrypt-on-ubuntu-20-04 6/19
5/12/22, 22:13 How To Secure Apache with Let's Encrypt on Ubuntu 20.04 | DigitalOcean
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(A)gree/(C)ancel: A
Next, you’ll be asked if you would like to share your email with the Electronic Frontier
Foundation to receive news and other information. If you do not want to subscribe to their
content, type N . Otherwise, type Y . Then, hit ENTER to proceed to the next step.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Would you be willing to share your email address with the Electronic Frontier
Foundation, a founding partner of the Let's Encrypt project and the non-profit
organization that develops Certbot? We'd like to send you email about our work
encrypting the web, EFF news, campaigns, and ways to support digital freedom.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: N
The next step will prompt you to inform Certbot of which domains you’d like to activate
HTTPS for. The listed domain names are automatically obtained from your Apache virtual
host configuration, that’s why it’s important to make sure you have the correct ServerName
and ServerAlias settings configured in your virtual host. If you’d like to enable HTTPS for
all listed domain names (recommended), you can leave the prompt blank and hit ENTER to
proceed. Otherwise, select the domains you want to enable HTTPS for by listing each
appropriate number, separated by commas and/ or spaces, then hit ENTER .
Which names would you like to activate HTTPS for?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
1: your_domain
2: www. your_domain
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Select the appropriate numbers separated by commas and/or spaces, or leave input
blank to select all options shown (Enter 'c' to cancel):
https://www.digitalocean.com/community/tutorials/how-to-secure-apache-with-let-s-encrypt-on-ubuntu-20-04 7/19
5/12/22, 22:13 How To Secure Apache with Let's Encrypt on Ubuntu 20.04 | DigitalOcean
Next, you’ll be prompted to select whether or not you want HTTP traffic redirected to
HTTPS. In practice, that means when someone visits your website through unencrypted
channels (HTTP), they will be automatically redirected to the HTTPS address of your
website. Choose 2 to enable the redirection, or 1 if you want to keep both HTTP and
HTTPS as separate methods of accessing your website.
Please choose whether or not to redirect HTTP traffic to HTTPS, removing HTTP acc
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
1: No redirect - Make no further changes to the webserver configuration.
2: Redirect - Make all requests redirect to secure HTTPS access. Choose this for
new sites, or if you're confident your site works on HTTPS. You can undo this
change by editing your web server's configuration.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Select the appropriate number [1-2] then [enter] (press 'c' to cancel): 2
After this step, Certbot’s configuration is finished, and you will be presented with the final
remarks about your new certificate, where to locate the generated files, and how to test
your configuration using an external tool that analyzes your certificate’s authenticity:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Congratulations! You have successfully enabled https:// your_domain and
https://www. your_domain
IMPORTANT NOTES:
- Congratulations! Your certificate and chain have been saved at:
/etc/letsencrypt/live/ your_domain /fullchain.pem
Your key file has been saved at:
This site uses cookies and related technologies, as described in our
/etc/letsencrypt/live/ your_domain /privkey.pem
privacy policy,
policy, for purposes that may include site operation, analytics,
Your cert will expire on 2020-07-27. To obtain a new or tweaked
enhanced user experience, or advertising. You may choose to consent
to our use of these technologies, or manage your own preferences.
version of this certificate in the future, simply run certbot again
with the "certonly" option. To non-interactively renew *all* of
your certificates, run "certbot renew"
https://www.digitalocean.com/community/tutorials/how-to-secure-apache-with-let-s-encrypt-on-ubuntu-20-04 8/19
5/12/22, 22:13 How To Secure Apache with Let's Encrypt on Ubuntu 20.04 | DigitalOcean
Your certificate is now installed and loaded into Apache’s configuration. Try reloading your
website using https:// and notice your browser’s security indicator. It should point out
that your site is properly secured, typically by including a lock icon in the address bar.
You can use the SSL Labs Server Test to verify your certificate’s grade and obtain detailed
information about it, from the perspective of an external service.
In the next and final step, we’ll test the auto-renewal feature of Certbot, which guarantees
that your certificate will be renewed automatically before the expiration date.
Step 5 — Verifying Certbot Auto-Renewal
Let’s Encrypt’s certificates are only valid for ninety days. This is to encourage users to
automate their certificate renewal process, as well as to ensure that misused certificates or
stolen keys will expire sooner rather than later.
The certbot package we installed takes care of renewals by including a renew script to
/etc/cron.d , which is managed by a systemctl service called certbot.timer . This script
runs twice a day and will automatically renew any certificate that’s within thirty days of
expiration.
To check the status of this service and make sure it’s active and running, you can use:
$ sudo systemctl status certbot.timer Copy
You’ll get output similar to this:
ThisOutput
site uses cookies and related technologies, as described in our
privacy policy, for purposes
policy, thatcertbot
may include site daily
operation, analytics,
enhanced user experience,
● certbot.timer
or
- Run
advertising. You
twice
may choose to consent
to our useLoaded:
of these technologies, or manage your own preferences.
loaded (/lib/systemd/system/certbot.timer; enabled;
Active: active (waiting) since Tue 2020-04-28 17:57:48 UTC;
vendor preset: e
17h ago
https://www.digitalocean.com/community/tutorials/how-to-secure-apache-with-let-s-encrypt-on-ubuntu-20-04 9/19
5/12/22, 22:13 How To Secure Apache with Let's Encrypt on Ubuntu 20.04 | DigitalOcean
To test the renewal process, you can do a dry run with certbot :
$ sudo certbot renew --dry-run Copy
If you see no errors, you’re all set. When necessary, Certbot will renew your certificates and
reload Apache to pick up the changes. If the automated renewal process ever fails, Let’s
Encrypt will send a message to the email you specified, warning you when your certificate
is about to expire.
Conclusion
In this tutorial, you’ve installed the Let’s Encrypt client certbot , configured and installed an
SSL certificate for your domain, and confirmed that Certbot’s automatic renewal service is
active within systemctl . If you have further questions about using Certbot, their
documentation is a good place to start.
help you grow as a developer and scale your project or business, and subscribe to
topics of interest.
Sign up now ->
Comments
10 Comments
This site uses cookies and related technologies, as described in our
privacy policy,
policy, for purposes that may include site operation, analytics,
enhanced user experience, or advertising. You may choose to consent
to our use of these technologies, or manage your own preferences.
https://www.digitalocean.com/community/tutorials/how-to-secure-apache-with-let-s-encrypt-on-ubuntu-20-04 11/19
5/12/22, 22:13 How To Secure Apache with Let's Encrypt on Ubuntu 20.04 | DigitalOcean
Leave a comment...
Thanks to Andreas for making his PPA available temporarily to fixed the problem
I hope this will help people who want to upgrade to 20.04
Show replies Reply
Solution: remove whitespace or extra lines are there in .conf file after
</VirtualHost> at End of File
Reply
Click below to sign up and get $200 of credit to try our products over 60 days!
Sign up ->
Linux Basics
JavaScript
React
Python
Security
MySQL
Docker
Kubernetes
Browse all topic tags
Free Managed Hosting ->
Questions
Q&A Forum
Ask a question
DigitalOcean Support
BECOME A CONTRIBUTOR
You get paid; we donate to tech
nonprofits.
Uptime