{"id":2726,"date":"2016-01-06T08:51:16","date_gmt":"2016-01-06T13:51:16","guid":{"rendered":"http:\/\/antipaucity.com\/?p=2726"},"modified":"2016-01-06T08:51:16","modified_gmt":"2016-01-06T13:51:16","slug":"lets-encrypt-centos-6-truly-free-ssl","status":"publish","type":"post","link":"https:\/\/merikebi.warrenmyers.com\/?p=2726","title":{"rendered":"let’s encrypt centos 6 – truly free ssl"},"content":{"rendered":"

There’s been quite a bit of excitement<\/a> surrounding<\/a> Let’s Encrypt<\/a> recently – a truly 100% free {{SSL}} issuer.<\/p>\n

Last week I helped a friend of mine get his first Let’s Encrypt certificate generated and configured for his website. One of the things I found incredibly frustrating is that Let’s Encrypt does not have a package for {{Red Hat}}\/{{CentOS}}\/{{Fedora}}! Ignoring such a massive installed base seems monumentally dumb – so I hope that they correct it soon. Until they do, however, here’s a tutorial that should cover the gotchas for getting Let’s Encrypt to work on a {{CentOS}} 6 server with {{Apache 2}}.<\/p>\n

The documentation<\/a>\u00a0(as of 06 Jan 2015)\u00a0on the Let’s Encrypt website is in error in a few places (or, at least, not as correct as is could\/should be). One big thing to note, for example, is that it says {{Python}} 2.6<\/a> is supported<\/a> (the current release for {{RHEL}}\/{{CentOS}} 6). If you run the certificate generator without the --debug<\/code> flag, though, it will error-out saying {{Python 2.6}} is not<\/em> supported.<\/p>\n

While I used an existing {{CentOS 6}} server, I’ll start this tutorial as I have many others – by telling you to go get a {{CentOS 6}} server from Digital Ocean<\/a>\u00a0or Chunk Host<\/a>.<\/p>\n

Preliminaries<\/h3>\n

Login as root (or a sudo-privileged account – but root is easier), and install {{Apache}}, {{Python}}, and {{SSL}} – yum install httpd python mod_ssl<\/code>.<\/p>\n

Also enable the EPEL<\/a> repository: yum install epel-repository<\/code> (available<\/a> from the {{CentOS}} Extras<\/a> repository. I’m going to assume you are familiar with configuring {{Apache}}, and will only provide the relevant snippets from ssl.conf<\/code> herein.<\/p>\n

Now that the basics are done, let’s move to Let’s Encrypt. I ran the tool in interactive mode (which is going to require {{ncurses}} to be available – it’s probably already installed on your system) – but you’ll want to add a crontab<\/a> entry since Let’s Encrypt certs expire after 90 days, so I’ll compact the interactive session into a single command-line call at the end, which you’ll need to “know” how to do, since the --help<\/code> argument doesn’t do anything yet (that I could find).<\/p>\n

Initial Certificate Creation<\/h3>\n

First, grab the latest Let’s Encrypt from {{GitHub}}:
\ngit clone https:\/\/github.com\/letsencrypt\/letsencrypt &&\u00a0cd letsencrypt<\/code><\/p>\n

Stop {{Apache}}: service httpd stop<\/code>. Let’s Encrypt is going to try to bind to ports 80 and 443 to ensure you have control the domain.<\/p>\n

Now run the letsencrypt-auto<\/code> tool – in debug mode so it’ll work with {{Python 2.6}}: .\/letsencrypt-auto --debug certonly<\/code>.<\/p>\n

Use certonly<\/code> because the plugins to automate installing for {{Apache}} and {{Nginx}} don’t work on {{CentOS}} yet.<\/p>\n

Enter your domain name(s) for which you want to issue a certificate. If you accept incoming connections to www.domain.tld and domain.tld, be sure to put both in the list (likewise, if you have, say, blog.domain.tld that you want included).<\/p>\n

Enter an administrative email address.<\/p>\n

When the tool finishes, it’ll put symlinks in \/etc\/letsencrypt\/live\/domain.tld<\/code>, with the “actual” certs in \/etc\/letsencrypt\/archive\/domain.tld<\/code>. We’re going to reference the symlinks in \/etc\/letsencrypt\/live\/domain.tld<\/code> next.<\/p>\n

Edit \/etc\/httpd\/conf.d\/ssl.conf<\/code> (I prefer {{emacs}} – but use whatever you prefer), and add the following lines in your VirtualHost directive:
\nSSLCertificateFile \/etc\/letsencrypt\/live\/domain.tld\/fullchain.pem
\nSSLCertificateKeyFile \/etc\/letsencrypt\/live\/domain.tld\/privkey.pem
\nSSLCACertificateFile \/etc\/letsencrypt\/live\/domain.tld\/cert.pem
\n<\/code><\/p>\n

Restart {{Apache}} – service httpd start<\/code>.<\/p>\n

Try hitting https:\/\/domain.tld<\/code> in your web browser – and you should be golden!<\/p>\n

Automating Renewal<\/h3>\n

Create a small shell script called renew-LE-certs.sh<\/code> somewhere you’ll remember where it is – like \/root<\/code>:
\nservice httpd stop
\n# add additional '-d' entries for more subdomains
\n\/path\/to\/letsencrypt\/letsencrypt-auto --debug --keep --agree-tos --rsa-key-size 2048 certonly -m ssladmin@domain.tld -d domain.tld -d www.domain.tld
\nservice httpd start<\/code><\/p>\n

For your crontab entry, do the following to setup monthly<\/a> cert renewal:
\n@monthly \/path\/to\/renew-LE-certs.sh<\/code><\/p>\n","protected":false},"excerpt":{"rendered":"

There’s been quite a bit of excitement surrounding Let’s Encrypt recently – a truly 100% free {{SSL}} issuer. Last week I helped a friend of mine get his first Let’s Encrypt certificate generated and configured for his website. One of the things I found incredibly frustrating is that Let’s Encrypt does not have a package …
Continue reading let’s encrypt centos 6 – truly free ssl<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_hide_featured_image":false,"_jetpack_featured_image_duplicate_dismissed":0,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[45],"tags":[166,390,713],"keyring_services":[],"class_list":["post-2726","post","type-post","status-publish","format-standard","hentry","category-tutorial","tag-centos","tag-how-to","tag-ssl"],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/posts\/2726","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2726"}],"version-history":[{"count":0,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/posts\/2726\/revisions"}],"wp:attachment":[{"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2726"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2726"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2726"},{"taxonomy":"keyring_services","embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Fkeyring_services&post=2726"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}