DEV Community

Cover image for How To Secure Apache with Let's Encrypt
Riky Fahri Hasibuan
Riky Fahri Hasibuan

Posted on • Originally published at codenoun.com

How To Secure Apache with Let's Encrypt

#linux #ubuntu #beginners #tutorial

Securing your website with SSL (Secure Socket Layer) is an essential step to protect users’ data and build trust. One of the easiest and most cost-effective ways to achieve this is by using Let’s Encrypt SSL, a free, automated, and open certificate authority that provides SSL certificates.

In this guide, you’ll learn how to secure Apache on Ubuntu with Let’s Encrypt SSL and configure Apache for SSL.

Prerequisites

Before you proceed, ensure that the following are in place:

  • A domain name pointing to your Ubuntu server (e.g., example.com)
  • A non-root user with sudo privileges
  • Apache web server installed on Ubuntu
  • Ports 80 and 443 opened on your firewall

Step 1: Install Apache on Ubuntu

First, you need to install Apache if it's not already installed. Run the following commands to install and enable Apache:

sudo apt update
sudo apt install apache2
sudo systemctl start apache2
sudo systemctl enable apache2
Enter fullscreen mode Exit fullscreen mode

To verify that Apache is installed and running, visit your server’s IP address in a web browser:

http://your-server-ip
Enter fullscreen mode Exit fullscreen mode

If you see the default Apache page, your installation is successful.

Step 2: Install Certbot for Let’s Encrypt

Certbot is a command-line tool that simplifies the process of obtaining SSL certificates from Let’s Encrypt. Certbot automatically configures Apache with the new SSL certificate. Install Certbot by running the following commands:

Install Certbot and Apache plugin 

sudo apt update
sudo apt install certbot python3-certbot-apache
Enter fullscreen mode Exit fullscreen mode

This command installs Certbot and the Apache plugin, which automates the SSL configuration process.

Step 3: Obtain Let’s Encrypt SSL Certificate

With Certbot installed, you can now obtain your SSL certificate. Certbot will request certificates, configure your Apache server, and automatically redirect HTTP traffic to HTTPS.

Run the following command to obtain your SSL certificate 

sudo certbot --apache -d example.com -d www.example.com
Enter fullscreen mode Exit fullscreen mode
  • Replace example.com with your actual domain name.
  • Certbot will prompt you to enter your email for recovery purposes and agree to the terms of service.

Certbot will ask if you want to redirect HTTP to HTTPS. Choose:

Option 2: Redirect - Make all requests redirect to secure HTTPS access.
Enter fullscreen mode Exit fullscreen mode

After this process, Certbot will obtain and install the SSL certificates, and your Apache configuration will be updated automatically.

Sample output:

Successfully received certificate.
Certificate is saved at: /etc/letsencrypt/live/example.com/fullchain.pem
Key is saved at: /etc/letsencrypt/live/example.com/privkey.pem
Enter fullscreen mode Exit fullscreen mode

The certificate will be valid for 90 days, and Certbot will automatically renew it (covered in Step 5).

Step 4: Apache SSL Configuration

Once Let’s Encrypt SSL is installed, it’s important to verify that your Apache SSL configuration is correct. Apache uses the .conf files located in /etc/apache2/sites-available/.

Check Apache Virtual Hosts

You can verify the configuration for your domain by viewing the Apache configuration file:

sudo nano /etc/apache2/sites-available/example.com.conf
Enter fullscreen mode Exit fullscreen mode

Ensure the following SSL-related lines are included in your Virtual Host configuration for port 443:

<VirtualHost *:443>
    ServerName example.com
    ServerAlias www.example.com

    DocumentRoot /var/www/html

    SSLEngine on
    SSLCertificateFile /etc/letsencrypt/live/example.com/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/example.com/privkey.pem
    Include /etc/letsencrypt/options-ssl-apache.conf
</VirtualHost>
Enter fullscreen mode Exit fullscreen mode

Enable SSL Module

If not already enabled, enable the SSL module:

sudo a2enmod ssl
Enter fullscreen mode Exit fullscreen mode

After editing the Apache configuration, restart Apache for the changes to take effect:

sudo systemctl restart apache2
Enter fullscreen mode Exit fullscreen mode

Redirect HTTP to HTTPS

Certbot should have automatically set up an HTTP to HTTPS redirect. If not, ensure that your configuration for port 80 includes the following redirect lines:

<VirtualHost *:80>
    ServerName example.com
    ServerAlias www.example.com

    RewriteEngine On
    RewriteCond %{HTTPS} off
    RewriteRule ^/?(.*) https://%{SERVER_NAME}/$1 [R=301,L]
</VirtualHost>
Enter fullscreen mode Exit fullscreen mode

This configuration will ensure all HTTP traffic is automatically redirected to HTTPS.

Step 5: Set Up Automatic SSL Certificate Renewal

Let’s Encrypt SSL certificates are valid for 90 days, but Certbot can automatically renew them for you.

Check the Cron Job

Certbot installs a cron job that automatically renews certificates and reloads Apache. You can verify the cron job by running:

sudo systemctl status certbot.timer
Enter fullscreen mode Exit fullscreen mode

Test Renewal Process

To test the automatic renewal process, use the following command:

sudo certbot renew --dry-run
Enter fullscreen mode Exit fullscreen mode

If the dry-run completes successfully, the automatic renewal process is set up correctly.

Step 6: Testing the SSL Configuration

After the setup, it’s important to test your SSL configuration to ensure everything works as expected.

Verify HTTPS Access

Visit your domain via HTTPS to check that the certificate is correctly installed:

https://example.com
Enter fullscreen mode Exit fullscreen mode

You should see the padlock icon in your browser, indicating that the connection is secure.

Test SSL Configuration

Use SSL Labs to test your server's SSL configuration. Go to SSL Labs Test Page and enter your domain name. This will give you a detailed report on your SSL setup, including security vulnerabilities and performance optimization.

Conclusion

Securing Apache with Let’s Encrypt SSL on Ubuntu is a straightforward process, thanks to Certbot's automation. The steps above guide you through obtaining a free SSL certificate, configuring Apache for SSL, setting up automatic renewals, and testing the configuration. With Let’s Encrypt SSL, your website is more secure, and you’ll instill greater confidence in your visitors by encrypting their data.

Commands Cheat Sheet

Command Description
sudo apt install apache2 Installs the Apache web server
sudo apt install certbot Installs Certbot for obtaining SSL certificates
sudo certbot --apache Obtains and installs SSL certificate automatically
sudo certbot renew --dry-run Tests automatic renewal of SSL certificates
sudo systemctl restart apache2 Restarts Apache to apply changes

By following this comprehensive guide, you can easily implement Let’s Encrypt SSL and manage Apache SSL configuration on Ubuntu. Always ensure that your SSL certificates are up-to-date to maintain security and compliance with modern web standards.

Related Article

Top comments (0)

Read next

muthuraja_r profile image

Using Guard Clauses Instead of Try-Catch in Async/Await: A Clean Coding Technique for Readable and Maintainable Code 🦄🚀

muthu raja -

chintanonweb profile image

10 TypeScript Secrets to Boost Your Development Expertise

chintanonweb -

dionarodrigues profile image

From useEffect to React Query: Modernizing your data management in react

Diona Rodrigues -

sukhrobtech profile image

Big O notation

Sukhrob Tech -