Let's Encrypt for SSL Certificates

18/02/2025

Why Use Let's Encrypt?

Let's Encrypt provides free SSL/TLS certificates, allowing you to secure your website with HTTPS. This improves security, protects user data, and avoids browser warnings about "Not Secure" websites.

Let's Encrypt certificates are valid for 90 days but can be automatically renewed using a simple cron job or systemd timer.

Installing Certbot

Certbot is the recommended tool for obtaining and managing Let's Encrypt certificates.

Installing Certbot on Debian/Ubuntu

sudo apt update && sudo apt install certbot python3-certbot-nginx -y

For Apache, install:

sudo apt install certbot python3-certbot-apache -y

Installing Certbot on Other Distributions

Check Certbot's website for distribution-specific installation instructions.

Obtaining a Certificate

Ensure your domain points to your server
Make sure your domain's DNS records are correctly set up to point to your server's IP.
Run Certbot for Nginx
```
sudo certbot --nginx
```
Or for Apache:
```
sudo certbot --apache
```
Follow the prompts to select your domain and enable HTTPS.
Manual Certificate Request (If Needed) If you're using another web server or need a standalone certificate:
```
sudo certbot certonly --standalone -d example.com -d www.example.com
```
Ensure no web server is running on port 80 before running this command.

Auto-Renewing the Certificate

Let's Encrypt certificates expire every 90 days. Certbot automatically sets up renewal, but you can manually test it:

sudo certbot renew --dry-run

To check existing certificates:

sudo certbot certificates

To renew manually:

sudo certbot renew

Configuring Auto-Renewal

To ensure automatic renewal, add a cron job:

sudo crontab -e

Add the following line:

0 3 * * * certbot renew --quiet

This runs the renewal process every day at 03:00.

Alternatively, use a systemd timer:

sudo systemctl enable certbot.timer

Conclusion

By using Let's Encrypt, you can easily secure your self-hosted website with a free SSL certificate. Automatic renewal ensures your site remains secure without manual intervention. For additional security, consider setting up UFW to manage your firewall rules.