Servers 101: Setting up a Web Server part 3 - SSL

You can read the previous part of the series, by clicking here

Other stuff in the series:

• Intro and getting into your server
• Basic Server Security

---

In the webserver series, we will configure a web server. We will install Apache, PHP 7.1 and MySQL, we will setup a Let's Encrypt bot, and a bandwidth monitor. We will also setup Wordpress, phpMyAdmin and we will open the needed ports on UFW.

What we WON'T do, is to install an FTP server. When time comes, I will help you configure Filezilla to use your private key (the one we made on the 3rd part of the "Basic Server Security" series), and you will upload anything you want via this.

This series will be split into 3 or 4 parts, as it is large as well. Writing everything in one post is counter productive for me.

---

On the previous part we configured our server software (Apache, MySQL, PHP etc..) On this part we will only install a certificate and make it auto-renew with Let's Encrypt!

---

Install Let's Encrypt's certbot:

sudo apt-get install python-certbot-apache

---

Prepare Apache

Before we begin, we must configure a hostname on Apache default config. Go ahead and do that:

sudo nano /etc/apache2/sites-available/000-default.conf

Just above ServerAdmin webmaster@localhost put these lines, but change them to read your domain name:

    ServerName exampledomain.com
    ServerAlias www.exampledomain.com

If you are just hosting a subdomain, for example this.exampledomain.com, and you don't want to add the "www." infront, just skip ServerAlias and you are good to go

Save, exit and test your config changes

    sudo apache2ctl configtest

If you get Syntax OK, then you are good to go. Otherwise you've got an error. Recheck what you typed in!

---

Generate and install a certificate!

Run this command to start Certbot

sudo certbot --apache

You will get something like this:

Press 1 (or the number corresponding to the domain name you want to install a certificate for) and then Enter.

First, we need to give an email for expiry and renewal notifications.

We also need to read the terms and confirm we agree.

Then we will get asked if we only want HTTPS access, or if it is optional.

I strongly suggest that you say "Secure" (Everything goes HTTPS), by typing 2 and then enter

---

Autorenewing Let's Encrypt

Let's Encrypt certificates are valid for 90 days. This is something done to make sure that all certificates, especially ones maliciously generated, are expiring fast.

In order to have peace of mind, and not renewing your certificate manually every 90 days, we will setup certbot to check your certificates twice every week (on my servers, this runs every Monday and Thursday)

The renew command is this:

sudo certbot renew

If you run it, the check will run immediately and if any certificate is near its expiration date (that is, less than 30 days before expiration date), it will be renewed.

To make it automated, we will use crontab! crontab means "cron table". A table is a table (duh!), and cron is a job scheduler in Linux and other Unix-like operating systems. To start the editor, type

crontab -e

If it is the first time you run crontab, you will get this prompt:

no crontab for root - using an empty one

Select an editor. To change later, run 'select-editor'.

1. /bin/ed
2. /bin/nano <---- easiest
3. /usr/bin/vim.basic
4. /usr/bin/vim.tiny

Choose 1-4 [2]:

Choose nano (input 2 and press enter), unless you prefer any of the other editors that exist in the list.

A cronjob syntax is this:

Minute Hour DayOfMonth Month DayOfWeek Command To Execute

Filling something with an asterisk means that you want to run this on every instance of the field. For example, this:

* 1 * * * ls /var/www

will list the contents of /var/www every minute, when it is 1 hour after midnight, every day.

So, I want to run the renew command every Monday (day 1) and every Thursday (day 4) at 3:35:

35 3 * * 1,4 /usr/bin/certbot renew >> /var/log/le-renew.log

Put this inside the crontab nano, (change the minutes/hours/days if you want to) and save it. When time comes, the check will happen. You can review the log file every now and then to make sure everything went fine by typing

sudo nano /var/log/le-renew.log

---

That's it for now! What we have left to do, is make Apache to use multiple virtual hosts and create a password protected directory where we will make vnstati generate some graphs to monitor our bandwidth usage easily.

Thank you for reading. If you liked my small tutorial, or have any questions, feel free to leave a comment.

• Main image courtesy of Neurobin

---

The next part, and finale of the Web server series, is now available. Click here

If you need a place to host your servers consider Vultr, Digital Ocean and BuyVM.

These are affiliate links. If you sign up through them, you support me and I will have more free time to write more content like this.

Also If you signup for Digital Ocean through my affiliate link, you will get $10 to try them out. Note: to battle abusers of this offer, you'll have to make a $5 deposit via Paypal or add your credit/debit card, so they can confirm that you are a new user. I did a deposit via Paypal to test them out, and then I added my credit card so I won't have to deposit money manually every now and then.

---

Also, I am running a witness server. Please consider voting me for a witness.

You can read my witness declaration here