In this supplementary Listen we'll take a look at getting started with letting crept on in Genex.
So first of all what is little encrypt the let's encrypt service is a relatively new provider of free
automated SSL certificates something virtually unheard of only a couple of years ago.
The service itself then aims to encourage the use of SSL over HTP.
So hgt s as this has become the new standard and plain insecure htb is just no longer acceptable.
Now having the let's encrypt service is one thing but in order to generate certificates and automate
their renewal we'll use a tool called CERT bot which will form the basis of this lesson to demonstrate
I've again created a server on digital ocean.
This being a bold of a boon to 16 zeal.
But the lesson will apply to whichever operating system you decide to use.
The main factor being the use of Search bot and Litz encrypt with in generics.
Important to note I also have a domain configured for the server.
Let's encrypt dot steck academy dot TV.
This being as let's encrypt won't issue certificates for IP addresses so a valid reachable domain is
required of course at the moment if I try and access this domain it's unreachable as there's no web
server running.
So let's begin by installing engine X over my terminal SS H to the server with SSA charge a or Wooding
my.
Is this a key root act.
Let's encrypt the steck Academy TV.
And I'm connected.
Update at get just good practice to make sure we have all the latest versions of the package repo's
clear this install engine X worth about yet install engine X..
Confirm.
And once that's done we can check if engine Xist already running worth process.
A You X checking for engine X with grep.
There we have it the master process and a single worker process.
We can test this by performing a request to the server Col hgt let's encrypt adot steck academy not
TV.
And sure enough we get the HD Mel from the engine X holding page meaning engine X is up and listening
on the server which looks like this in the browser in my editor.
Then I'll open the engine configuration file from that server's new engine exe install this being the
file at each c slash engine X slash engine X dot conf.
Remove the bulk of this as we're only looking to test SSL certificate Sonia leave the event block as
that's required.
Get rid of all this.
Create a new server block inside the HTP context listening on port 80 for now so plain HTP with a router
location block that simply returns a two hundred status.
And hello from Engine x.
Save that reload engine X engine X with it s flag reload.
Form the same code command to the server and we get that new response.
So everything working as expected.
If however I changed this protocol to hgt P S we get an error.
So let's generate some SSL certificates and get this working with the help of search bot and lit encrypt
will install search bot first navigate to CERT bot.
E F F dot org.
Select the relevant server software in genetics and the corresponding server OS.
In my case a boon to 16 zele which gives us this detailed set of instructions for installing cert bot
and even automating the renewal of those certificates all of which will cover start with the search
bot install commands.
I've already run this app get updates prior to installing engine X so copy this.
Installing the software propertys common package already installed for this version of a burn to add
the cert bot back each repo.
Run update again to pull the packages from that newly added rebo.
And finally install the said Bob backage install by phon cert bot in Genex.
Yes.
All done.
Meaning we should now have the word bot tools available all clear this run server bot help.
And there we have it.
OK now that we have the command line tools available.
Let's go ahead and generate this acel Certificates via the lit and crypt service.
First off though it's important to assess the specific needs of your web server before continuing with
generating certificates as you can see said.
Bot allows us to generate certificates with out installing them or by default installs them meaning
your engine X configuration file will be edited with all the necessary directives to listen for hgt
s connections.
This is often very useful search bot will also configure the correct cipher shoot and a host of other
SSL parameters but might not be ideal on an existing server configuration where edits could cause trouble.
Just something to consider and decide on.
For this demonstration however I'll have said bot install the certificates as well to generate and install
certificates for our engine server then we can run cert bot with an engine X flag.
If however you were to run this with the cert only command skipping the installation then you'd also
have to provided deflate gate with the relevant domain name for this certificate.
The reason we don't need to specify the domain when also installing the certificate is.
That said bot will inspect the existing configuration forrard domain or server name and use that also
allowing a to know where the SSL configuration needs to be at it.
Right now we don't actually have a server name specified so I'll add that server name let's encrypt
not steck academy Don TV save for that.
Reload engine x.
And run the default search by command for engine X..
We are prompted for an email address.
Agree to the terms of use.
You want to share your email address.
I'll opt for no in this case.
And then we're presented with a selection of domains found in the engine X configuration file to choose
from.
This being the reason added the server name directive to that configuration.
I only have the one so enter one enter this certificate gets generated and the domain verified.
And finally we can choose to add a redirect to our engine XT configuration in order to redirect all
HDB traffic to HTP s.
I'll just say no for now.
Or option 1 enter and that's all done.
Congratulations you have successfully enabled.
H t d b s.
Let's encrypt steck academy or TV with some notes and path's to the generated certificates listed here.
We can check the contents of that directory t see slash letting crypt containing all of the list encrypt
files certificates configurations etc..
Slash life slash my domain and there we see the generator to defecates said bot has also reloaded our
engine configuration after adding the certificates.
So test this over hgt s again.
Hello from Engine x.
So working this time.
Easiest that I'll check this in the browser.
H T T P S.
And there we have it lock and all we can see what modifications said bot may to our engineers second
file.
It's added a listen director on port for 4 3 being the default h.t. to be export links to their newly
generated certificates for this domain and an include called Options SSL engine ixtoc.
I'll clean this up a bit.
Copy that path to the configuration include so we can see what this contains.
There.
This is the convenience of having said bot install your certificates for you.
We have this acel session configurations and a selection of preferred ciphers or added security so very
convenient.
The next point then is cert renewal.
Unlike traditional SSL certificates that was valid for one or two years at a time.
Let's encrypt certificates are valid for 90 days only now without getting into the nitty gritty details
of why this is.
It's a good thing I fling to some content in the list and resources should you want to read more about
the reasons for the shorter difficult life renewing your certificates will have to happen fairly frequently
then and as part of this renewal will also see how to automate this.
Meaning you should never have to worry about certificate renewal again first then to renew certificates
manually.
We can run cert bot renew into giving us cert.
Not yet you for renewal skipped.
So no nasty errors just the silane skip.
We can however force a test renewal to make sure this will work once the certificates become due.
Same command again this time with a flag dry run.
We get that verification again.
And done on Graduation's all renewals succeeded.
Now for certificates to be renewed.
They don't actually have to be expired.
Only close to expiring which is good as we don't want a second of having expired certificates.
This also means that we can safely run the renewals daily if they're not due.
Nothing will happen if they're close.
They'll get renewed to do this then to attempt to figure renewal daily will use a simple cron job clear
this run krung tab with it.
E flag.
So editing the crunch job.
Entry's I'll edit with no.
No I don't have any cron jobs at the moment so add a new one right at the bottom of this file at daily.
Been a convenience expression for running a cron job at midnight each day and the command cert bot renew
right this outwith control o exit.
And if I left out my crohn entries we see that daily renewal which is all there is to renewing your
certificates automatically that we will leave this listen.
You should now be comfortable installing search bot generating and installing new lights encrypt certificates
and automating the renewal process.
If you're interested in digging deeper to search but I've linked to some good articles in the list and
resources and as always there's the official said by documentation to help you explore some of the other
commands.