|
1 2 3 |
git clone https://github.com/letsencrypt/letsencrypt cd letsencrypt ./letsencrypt-auto |
If this command doesn’t work, you can try the following manual way
|
1 |
./letsencrypt-auto certonly --email youremail@domain.com --webroot -w /var/www/vhosts/yourdomain.com -d yourdomain.com -d www.yourdomain.com |
You can add multiple domains under the same certificate
|
1 |
./letsencrypt-auto certonly --email youremail@domain.com --webroot -w /var/www/vhosts/yourdomain.com -d yourdomain.com -d www.yourdomain.com -w /var/www/vhosts/yourdomain2.com -d yourdomain2.com -d www.yourdomain2.com |
Update your Apache configuration to use the new certificate:
|
1 2 3 4 |
SSLEngine on SSLCertificateKeyFile /etc/letsencrypt/live/yourdomain.com/privkey.pem SSLCertificateFile /etc/letsencrypt/live/yourdomain.com/cert.pem SSLCertificateChainFile /etc/letsencrypt/live/yourdomain.com/chain.pem |
Check domain:
https://crt.sh/?q=%25yourdomain.com
Renew the certificate with a script set in a cron (set every 2 months – certificate expires every 3)
|
1 2 |
# run on the 1st of Odd Months at midnight | Renew certificates 0 0 1 1-11/2 * root /root/letsencrypt/renew.sh >/dev/null 2>&1 |
renew.sh script:
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 |
#!/bin/bash MAIL=youremail@domain.com LOG=/var/log/letsencrypt/renew.log SENDMAIL=/usr/sbin/sendmail CMD="renew" /root/letsencrypt/letsencrypt-auto $CMD > $LOG 2>&1 if [ $? -eq 0 ] ; then service httpd graceful else echo -e "Subject: [letsencrypt] SSL automatic renewal FAILED\n$(cat $LOG)" | $SENDMAIL $MAIL exit 1 fi |
Sources:
https://letsencrypt.org/getting-started/
https://www.a2hosting.com/kb/security/ssl/securing-your-site-with-a-lets-encrypt-ssl-certificate