Let's Encrypt

Preparing

Let's Encrypt requires a few preparations for it to work.

Install A Self-Signed Certificate

An attempt to install an LE certificate will be made if the current certificate is untrusted or is near its expiration. Install a self-signed certificate to make your site's certificate untrusted, and hence, kick off the Let's Encrypt process the following morning around 5am pacific time.

Managing Certs In admin.he.net

Log into https://admin.he.net and select the Manage Secure Certificates command.

The Manage Secure Certificates command in admin.he.net.

Generate a Certificate Signing Request (CSR) by filling out the form and pressing the generate button.

The form to fill out to generate a Certificate Signing Request.

The CSR will appear at the bottom of the page. Here is my CSR.

Go to the tab labeled "Step 2: Install Self-Signed Certificate" and press install now.

Install the self-signed certificate so that Let's Encrypt will attempt to generate and install a valid certificate the next morning around 5AM.

Copy the CSR to the Server

Let's Encrypt looks for a CSR in ~/.certs/. Go back to "Step 1" of manage secure certificates on admin.he.net. Copy the entire CSR including -----BEGIN CERTIFICATE REQUEST----- and -----END CERTIFICATE REQUEST----- and save it to a file called www.example.com.csr in ~/.certs/, where www.example.com is your domain. If the .certs folder doesn't exist, make it.

The domain name in the file name must have a subdomain. If it does not, add www. The CSR for this site was named blog.jschmedes.corp.he.net.csr. If it were for he.net the correct file would be www.he.net.csr with www as the subdomain.

The `ls` command shows the files that are in ~/.certs/, which is blog.jschmedes.corp.he.net.csr, the CSR for this domain. `cat` outputs its contents; the CSR generated in the first step.

An Important Note!

A CSR has a corresponding private key, which is created when the CSR is generated. The CSR in the ~/.certs/ folder must be the counterpart to the private key on the server. If at anytime during the process a new CSR is generated then that CSR must be placed in the ~/.certs/ folder. Otherwise the CSR won't match the private key and the certificate installation will fail with a MISMATCH error.

Check Access To /.well-known/

After it has been determined the site needs a new certificate and the appropriate certificate signing request has been found in ~/.certs/, Let's Encrypt will need to verify ownership of the domain by checking for a secret in <http://www.example.com/.well-known/>.

The /.well-known/ folder is described in RFC5785. It is a location to store meta-data about a website. URL rewriting and access control can interfere with access to /.well-known/, preventing applications that use it, like Let's Encrypt, from working.

Make sure that Let's Encrypt can access that part of your site by placing a file in ~/public_html/.well-known/ and trying to view that file.

For example, to test this site I made a TXT file with the contents "Hello World" and put it in ~/public_html/.well-known/hello-world.txt. Then I went to http://tools.jschmedes.corp.he.net/blog/.well-known/hello-world.txt. The website displayed "Hello World" so access to the .well-known folder isn't blocked or redirected.

http://tools.jschmedes.corp.he.net/blog/.well-known/hello-world.txt shows "Hello World" and not an error.

If instead of "Hello World" I saw an error page or a blank page then Let's Encrypt won't be able to reach it either and the certificate will not be installed.

More often than not an Apache rewrite rule in .htaccess is preventing access to .well-known. Adding this rule before all other rewrite rules will allow the test to pass:

RewriteRule ^.well-known/ - [L,NC]

The certificate will be valid for secondary domains as well, but if any of the secondary domains cannot be verified no certificate will be installed. So this step needs to be repeated for each of the secondary domains on the account to make sure their /.well-known/'s aren't blocked either.

An Important Note!

Secondary domains can cause the certificate installation to fail resulting in all domains not having a valid certificate. Always verify that secondary domains added to the account don't interfere with requests for /.well-known/.

Checking For Success

If all goes according to plan, after following the steps above the certificate will be installed the next morning around 5AM pacific time. Clear your browser cache and go to your website using https://. The certificate should be a new and valid Let's Encrypt certificate.

Renewal

The certificate will automatically renew itself about two weeks before expiring. Changing the domains on the account or accidentally redirecting requests for /.well-known/ can cause the certificate renewal to fail.

The first expiration or two should be monitored to make sure the certificate renewal happens. If an LE certificate is set to expire in less than a week, there may be something preventing it from renewing.

HTTPS:// Doesn't Show The Site

You might expect to see your website when using https://, but instead see a template about a website coming soon. Check out the article about the webroot at https://tools.jschmedes.corp.he.net/blog/articles/basic/the-server-20190204.html#webroot to learn ways to make your site available over https://.