It looks like you're new here. If you want to get involved, click one of these buttons!Sign In Register
It looks like you're new here. If you want to get involved, click one of these buttons!
Let's Encrypt is a certificate authority that provides free certificates in a fully automated process.
In this guide, you will learn how to set up a TLS/SSL certificate from Let’s Encrypt on an Centos 7 / AlmaLinux 8 servers running Apache as a web server.
Before enabling the Let's Encrypt certificate, make sure you have Apache Web Server installed on your server. If not, you can check out our Apache web server installation guide.
You also need to create a virtual host configuration file by typing this command (if you didn't do it during Apache installation):
Add these lines to the configuration file:
<VirtualHost *:80> ServerAdmin [email protected] DocumentRoot "/var/www/html" DirectoryIndex index.html ServerName yourdomain.ltd ErrorLog "/var/log/httpd/yourdomain.ltd.error_log" CustomLog "/var/log/httpd/yourdomain.ltd.access_log" common </VirtualHost>
After editing, you can save changes and exit.
To create an index.html file for testing, run this command:
Enter the text for testing in the file:
<html> Page for testing purposes </html>
After that, you can save the file and exit.
Now you need to change the owner of the ‘/var/www/html/index.html’ file to Apache by entering this command:
chown -R apache:apache /var/www/html/index.html
This means that Apache can now read this file.
On Centos 7 follow these steps to install Cerbot:
yum install epel-release
yum install certbot python2-certbot-apache mod_ssl
On AlmaLinux 8 follow these steps to install Cerbot:
dnf install epel-release
dnf install certbot python3-certbot-apache
To set up the SSL for domain, run this command:
certbot --apache -d yourdomain.ltd
You can install certificate for multiple domains and subdomains by following this command:
certbot --apache -d yourdomain.ltd -d www.yourdomain.ltd -d yourdomain2.ltd -d subdomain.yourdomain2.ltd
When issuing a certificate, you will need to provide an email, that you specified previously in virtual host configuration file ([email protected]).
You will also need to agree to the Terms of Service (mandatory) and agree or disagree to share your email address with Electronic Frontier.
When issuing a certificate, you may receive the following error message:
Cancel the certificate issue process (enter 'c') and restart Apache service with the following command:
systemctl restart httpd
After that, try to issue the certificate again.
Enter this command to check if SSL issued successfully:
You should see the following output:
cert.pem chain.pem fullchain.pem privkey.pem
You can also check SSL in your browser. Open your website and click on the padlock icon in the address bar to see information about certificate.
Let’s Encrypt certificates are valid for 90 days.
You can manually renew certificate with this command:
certbot renew --dry-run
If the certificate is less than 30 days away from expiration, this command will renew it.
If you want to specify auto-renewal, you can edit the crontab and create cronjob to run the above command twice a day automatically.:
Add this line to the crontab:
* */12 * * * root /usr/bin/certbot renew >/dev/null 2>&1
You're all set. When necessary, certbot will renew your certificates and reload Apache to pick up the changes.
If, after activating the certificate, your site is still not available and you receive "Secure Connection Failed" error, make sure to allow traffic via HTTPS (port 443), which could be blocked in firewalld by default.
You can check if HTTPS enabled, using this command:
The output will provide you information about enabled services. In this screenshot, you can see that port 443 is enabled:
If 443 port disabled, you can enable it with firewalld or iptables.
To enable https service in firewalld, use this command:
firewall-cmd --permanent --add-service=https
To enable https in iptables, use this command:
iptables -I INPUT -p tcp -m tcp --dport 443 -j ACCEPT