Differences

This shows you the differences between two versions of the page.

--- install [2021/03/06 02:34] – rene
+++ install [2024/08/05 17:28] (current) – rene
@@ Line 322: / Line 322: @@
 ===== KONFIMINE =====
+==== letsencrypt / HTTPS ====
+  * https://www.digitalocean.com/community/tutorials/how-to-secure-apache-with-let-s-encrypt-on-ubuntu-20-04
+  * https://certbot.eff.org/docs/using.html#certbot-commands
+== Adding HTTPS to a new subomain ==
+First make a copy of current files so that you can view diff afterwards:
+    cp /etc/apache2/sites-enabled/rene-le-ssl.conf /etc/apache2/sites-enabled/rene-le-ssl.conf_orig
+    cp /etc/apache2/sites-enabled/rene.conf /etc/apache2/sites-enabled/rene.conf_orig
+Look at a sample conf for example for "bikes.rene.ee"
+Make sure that in your apache conf (/etc/apache2/sites-enabled/rene.conf) ServerName and ServerAlias are correct! ServerName=base domain; ServerAlias=actual subdomain
+Run the following command and select the virtual hosts you want to upgrade to HTTPS
+You can there select only the new ones you want to add
+    certbot --apache
+# NB! For some odd reason this process tends to mess up bernard.ee conf (/etc/apache2/sites-enabled/rene-le-ssl.conf)! Probleemid:
+  - The main ServerAlias is changed to the new domain and also certificate files point wrongly. The wrong certificate locations should have been added to the new conf section, but they are missing from there Restore right values manually based on the diff with originla conf files.
+  - Make sure the new conf starts with "<VirtualHost *:443>" and not with "<VirtualHost *:80>"
+  - Make sure the new conf section has "SSLCertificateFile" and "SSLCertificateKeyFile". Keep in mind that the cert file locations are custom to that particular subdomain and not generic to the base domain!!!
+# it does also add some rewrite rules into your own base conf (/etc/apache2/sites-enabled/rene.conf), but these seem to be just fine.
+== Renewal (new) ==
+Open up port 80 in Apache conf:
+  vi /etc/apache2/ports.conf
+Generate new certs (select option "3" and give correct base dir): /media/ssd/www/bernard.ee/):
+  certbot certonly --force-renewal -d bernard.ee
+Check what was the new folder name created for new certs:
+  l /etc/letsencrypt/live/
+Change cert folder in Apache conf (SSLCertificateFile / SSLCertificateKeyFile):
+  apache_conf
+Restart apache:
+  apache_restart
+If new cert works then remove old certs directory:
+  rm -rf /etc/letsencrypt/live/bernard.ee-0002
+# Updating rene.ee....
+NB! Ilmselt tuleb DNS'i verificationit kasutada, sest wildcard serti ei saa HTTP'ga uuendada.... vist.... Seega all olev päris ei tööta...
+Disable index preview (as we need to make rene.ee publicly accessible for renewal)
+  /etc/apache2/sites-available/rene-le-ssl.conf
+  apatche_restart
+Removce htaccess to make rene.ee publicly accessible:
+  mv /media/ssd/www/rene.ee/.htaccess /media/ssd/www/rene.ee/xhtaccess
+Rund the command (NB! Mind that it's wildcard!) (/media/ssd/www/rene.ee):
+certbot certonly --force-renewal -d *.rene.ee
+Enable index htaccess
+  mv /media/ssd/www/rene.ee/xhtaccess /media/ssd/www/rene.ee/.htaccess
+Enable index showing
+  /etc/apache2/sites-available/rene-le-ssl.conf
+  apatche_restart
+Clean up afterwards from here (not needed for web server):
+  /etc/letsencrypt/renewal
+Close port 80:
+  vi /etc/apache2/ports.conf
+== Renewal (original) ==
+Certificates expire in 90 days. Renewal can only be automatic if port 80 is open... Which by default is not...
+You can check that the daemon is working:
+    systemctl status certbot.timer
+Renewal can be forced with the following command
+PS. Seems that this doesn't change any configurations just the certs. So it's harmless.
+    certbot renew --force-renewal
 ==== nVidia draiveri fix ====