Trying to generate a wildcard certificate using Certbot for an Apache webserver?
The wildcard certificate authenticates the identity of a website and helps to encrypt the transferred data.
At Bobcares, we often receive requests to generate SSL certificates, as a part of our Server Management Services.
Today, we’ll see how our Support Engineers make use of Certbot to install SSL.
What is a Certbot generated wildcard certificate?
Let’s Encrypt is an open Certificate Authority(CA). It provides free certificates for Transport Layer Security (TLS) encryption.
Certbot is a tool for using Let’s encrypt on manually administered websites. And thereby it enables HTTPS.
Among many SSL certificates available today, a wildcard certificate will help to secure a domain and its subdomains.
To generate a valid wildcard certificate using Certbot, it involves multiple steps. Let’s see how our Support Engineers generate it using Certbot.
- Initially, we check whether the Certbot is previously installed on the server.
- Thereafter, we generate the certificate using Certbot
- Finally, we add the DNS TXT record for verification.
How to generate a wildcard certificate using Certbot?
Here, we use an Ubuntu 18.04 server with the Apache webserver running in it.
Installing Certbot in Apache
Usually, Certbot is not available in the default Ubuntu package manager repository. So we add the Certbot PPA using the commands,
apt update
apt install software-properties-common
add-apt-repository universe
add-apt-repository ppa:certbot/certbot
apt updateLater to install Certbot, we run,
apt install certbot python-certbot-apacheThis installs Certbot and its dependencies.
Generating a wildcard certificate using Certbot
By running a single command we can generate a wildcard certificate.
For instance, the command used for an example domain is,
certbot certonly --manual --preferred-challenges=dns --email admin@example.com --server https://acme-v02.api.letsencrypt.org/directory --agree-tos -d *.example.comAfter executing the command, the prompt asks for certain questions. We reply to it with yes or no.
Finally, the prompt will provide a text string. We add this TXT record to the webserver’s DNS entry. The prompt appears as,
Adding TXT record
Then we configure the DNS server to add the TXT record to the domain.
The DNS record modification has a propagation delay. After this we press enter, so that Let’s encrypt can verify the domain. Finally, we receive a success message with the certificate location.
The location of the certificate will be,
/etc/letsencrypt/live/your_domain/fullchain.pemAnd the location of the key will be at
/etc/letsencrypt/live/your_domain/privkey.pemFor verifying, the certificate we use the following command.
certbot certificatesIt will provide the certificate name, domain name, expiry and certificate location. The certificate is valid for 90 days, therefore, we have to renew it before the expiry.
Then, we update the certificate locations in the Apache virtual host. And finally, we reload the Apache to load the new configuration.
Later, to automate the SSL renewal process, we add the certbot command in the crontab of the server.
[Need assistance to generate a wildcard certificate using Certbot? We’ll help you.]
Conclusion
In short, Certbot is a client that fetches certificates from Let’s Encrypt. Today, we saw how our Support Engineers generated a wildcard certificate using Certbot in an Apache webserver.
Thanks a lot!
How can I automate the renewal of the wildcard certificate?
You can use the “renew” command to renew the certificate using the Certbot tool:
certbot renew –force-renewal
Also,you can auto-renew your wildcard certificate using the cron job.
You can test automatic renewal for your certificates by running this command:
./certbot-auto renew –dry-run
If you’re sure that this command executes successfully without human intervention, you can add the command to crontab without –dry-run flag. Let’s Encrypt Certificates are only renewed when they’re near to expiry, the command can run on a regular basis, like every week or every day. You can also add pre-hook and post-hook to this command. Like –
./certbot-auto renew –pre-hook “service nginx stop” –post-hook “service nginx start”
or
./certbot-auto renew –post-hook “service nginx restart”