Call Us! 1-800-383-5193
Call Us! 1-800-383-5193

Need Help?

Our experts will login to your server within 30 minutes to fix urgent issues.

We will keep your servers stable, secure and fast at all times for one fixed price.

How to setup Certbot wildcard certificate on Apache

Trying to generate a wildcard certificate using Certbot for an Apache webserver?

The wildcard certificate authenticates the identity of a website and helps to encrypt the transferred data.

At Bobcares, we often receive requests to generate SSL certificates, as a part of our Server Management Services.

Today, we’ll see how our Support Engineers make use of Certbot to install SSL.

 

What is a Certbot generated wildcard certificate?

Let’s Encrypt is an open Certificate Authority(CA). It provides free certificates for Transport Layer Security (TLS) encryption.

Certbot is a tool for using Let’s encrypt on manually administered websites. And thereby it enables HTTPS.

Among many SSL certificates available today, a wildcard certificate will help to secure a domain and its subdomains.

To generate a valid wildcard certificate using Certbot, it involves multiple steps. Let’s see how our Support Engineers generate it using Certbot.

  • Initially, we check whether the Certbot is previously installed on the server.
  • Thereafter, we generate the certificate using Certbot
  • Finally, we add the DNS TXT record for verification.

 

How to generate a wildcard certificate using Certbot?

Here, we use an Ubuntu 18.04 server with the Apache webserver running in it.

 

Installing Certbot in Apache

Usually, Certbot is not available in the default Ubuntu package manager repository. So we add the Certbot PPA using the commands,

apt update
apt install software-properties-common
add-apt-repository universe
add-apt-repository ppa:certbot/certbot
apt update

Later to install Certbot, we run,

apt install certbot python-certbot-apache

This installs Certbot and its dependencies.

 

Generating a wildcard certificate using Certbot

By running a single command we can generate a wildcard certificate.

For instance, the command used for an example domain is,

certbot certonly --manual --preferred-challenges=dns --email admin@example.com --server https://acme-v02.api.letsencrypt.org/directory --agree-tos -d *.example.com

After executing the command, the prompt asks for certain questions. We reply to it with yes or no.

Finally, the prompt will provide a text string. We add this TXT record to the webserver’s DNS entry. The prompt appears as,

Certbot wildcard certificate Apache.

 

Adding TXT record

Then we configure the DNS server to add the TXT record to the domain.

The DNS record modification has a propagation delay. After this we press enter, so that Let’s encrypt can verify the domain. Finally, we receive a success message with the certificate location.

The location of the certificate will be,

/etc/letsencrypt/live/your_domain/fullchain.pem

And the location of the key will be at

/etc/letsencrypt/live/your_domain/privkey.pem

For verifying, the certificate we use the following command.

certbot certificates

It will provide the certificate name, domain name, expiry and certificate location. The certificate is valid for 90 days, therefore, we have to renew it before the expiry.

Then, we update the certificate locations in the Apache virtual host. And finally, we reload the Apache to load the new configuration.

Later, to automate the SSL renewal process, we add the certbot command in the crontab of the server.

 

[Need assistance to generate a wildcard certificate using Certbot? We’ll help you.]

 

Conclusion

In short, Certbot is a client that fetches certificates from Let’s Encrypt. Today, we saw how our Support Engineers generated a wildcard certificate using Certbot in an Apache webserver.


PREVENT YOUR SERVER FROM CRASHING!

Never again lose customers to poor server speed! Let us help you.

Our server experts will monitor & maintain your server 24/7 so that it remains lightning fast and secure.

GET STARTED

Submit a Comment

Your email address will not be published. Required fields are marked *