{"id":27,"date":"2018-12-02T13:31:29","date_gmt":"2018-12-02T20:31:29","guid":{"rendered":"https:\/\/www.stauber.org\/?p=27"},"modified":"2018-12-05T07:59:15","modified_gmt":"2018-12-05T14:59:15","slug":"creating-a-wildcard-ssl-certificate-for-a-digitalocean-droplet","status":"publish","type":"post","link":"https:\/\/www.stauber.org\/index.php\/2018\/12\/02\/creating-a-wildcard-ssl-certificate-for-a-digitalocean-droplet\/","title":{"rendered":"Creating a Wildcard SSL Certificate for a DigitalOcean Droplet"},"content":{"rendered":"

This post will tell you how to create a Certificate Authority (CA) signed SSL certificate for a Droplet hosted on DigitalOcean<\/a> with its own domain name. This assumes you own a domain name and have it pointing to an Ubuntu server.<\/p>\n

Let’s Encrypt<\/a> provides signed SSL certificates for free as long as their site can verify that you do manage a domain name.\u00a0 They do it by having you make a few temporary entries to the DNS records pertaining to the domain name that they can match to the machine making the request.\u00a0 This is how it is done.<\/p>\n

Install the client (the official Let’s Encrypt ACME client)<\/p>\n

\r\nsudo add-apt-repository ppa:certbot\/certbot\r\nsudo apt-get update\r\nsudo apt-get install certbot\r\n<\/pre>\n
Create the request for the wildcard certificate. Let’s say you own example.com<\/strong>. Your certificate will be valid for any subdomains of that, such as www.example.com, mail.example.com, etc., but not simply example.com. For that you’ll need to add an extra term in the request, and add a second entry to your DNS records for Let’s Encrypt.\u00a0 Execute the following command, enter ‘Y’ to have your IP logged, but do not hit enter until after adding the entries, in the next step.<\/p>\n
\r\nsudo certbot certonly --server https:\/\/acme-v02.api.letsencrypt.org\/directory --agree-tos --manual --preferred-challenges dns -d example.com -d *.example.com\r\n<\/pre>\n
Saving debug log to \/var\/log\/letsencrypt\/letsencrypt.log\r\nPlugins selected: Authenticator manual, Installer None\r\nObtaining a new certificate\r\nPerforming the following challenges:\r\ndns-01 challenge for example.com\r\ndns-01 challenge for example.com\r\n\r\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\r\nNOTE: The IP of this machine will be publicly logged as having requested this\r\ncertificate. If you're running certbot in manual mode on a machine that is not\r\nyour server, please ensure you're okay with that.\r\n\r\nAre you OK with your IP being logged?\r\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\r\n(Y)es\/(N)o: Y<\/strong>\r\n\r\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\r\nPlease deploy a DNS TXT record under the name\r\n_acme-challenge.example.com with the following value:\r\n\r\nyvKpslex2Qxd5G8altPOv2K_dfTBgIxNEiwVFXD_Ex8\r\n\r\nBefore continuing, verify the record is deployed.\r\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\r\nPress Enter to Continue<\/pre>\n
Go to your DigitalOcean Networking panel and access the records for example.com\u00a0 add a TXT entry with the specifics provided by the certbot client (sample shown above).\u00a0 You’ll need to paste the long string of gibberish into the VALUE field and type _acme-challenge<\/strong> into the\u00a0 HOSTNAME.\u00a0 Note, do not<\/em> type the .example.com<\/strong> domain ending, as it is added automatically on DigitalOcean (and many other providers).<\/p>\n
\"\"
Adding a DNS challenge entry for Let’s Encrypt<\/figcaption><\/figure>\n
Now<\/em> go back and hit Enter in your certbot client.\u00a0 You’ll have to do this\u00a0twice<\/em>, once for example.com<\/strong>, and once for *.example.com<\/strong>.\u00a0 Once done, you’ll see something like the following, which will tell you how to renew your certificates in ninety days, when they expire (but they’re free, and it’s literally a one line command to renew them).<\/p>\n
IMPORTANT NOTES:\r\n - Congratulations! Your certificate and chain have been saved at:\r\n   \/etc\/letsencrypt\/live\/example.com\/fullchain.pem\r\n   Your key file has been saved at:\r\n   \/etc\/letsencrypt\/live\/example.com\/privkey.pem\r\n   Your cert will expire on 2019-01-17. To obtain a new or tweaked\r\n   version of this certificate in the future, simply run certbot\r\n   again. To non-interactively renew *all* of your certificates, run\r\n   \"certbot renew\"\r\n - If you like Certbot, please consider supporting our work by:\r\n\r\n   Donating to ISRG \/ Let's Encrypt:   https:\/\/letsencrypt.org\/donate\r\n   Donating to EFF:                    https:\/\/eff.org\/donate-le<\/pre>\n
You may now delete those TXT entries in the DNS records.\u00a0 Your certificates are in a non-standard place, not \/etc\/ssl\/cert and \/etc\/ssl\/private, so be sure to update your Apache or Nginx configuration files accordingly.<\/p>\n","protected":false},"excerpt":{"rendered":"
This post will tell you how to create a Certificate Authority (CA) signed SSL certificate for a Droplet hosted on DigitalOcean with its own domain name. This assumes you own a domain name and have it pointing to an Ubuntu server. Let’s Encrypt provides signed SSL certificates for free as long as their site can … <\/p>\n
Continue reading “Creating a Wildcard SSL Certificate for a DigitalOcean Droplet”<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[8],"tags":[],"class_list":["post-27","post","type-post","status-publish","format-standard","hentry","category-security"],"_links":{"self":[{"href":"https:\/\/www.stauber.org\/index.php\/wp-json\/wp\/v2\/posts\/27","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.stauber.org\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.stauber.org\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.stauber.org\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.stauber.org\/index.php\/wp-json\/wp\/v2\/comments?post=27"}],"version-history":[{"count":9,"href":"https:\/\/www.stauber.org\/index.php\/wp-json\/wp\/v2\/posts\/27\/revisions"}],"predecessor-version":[{"id":86,"href":"https:\/\/www.stauber.org\/index.php\/wp-json\/wp\/v2\/posts\/27\/revisions\/86"}],"wp:attachment":[{"href":"https:\/\/www.stauber.org\/index.php\/wp-json\/wp\/v2\/media?parent=27"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.stauber.org\/index.php\/wp-json\/wp\/v2\/categories?post=27"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.stauber.org\/index.php\/wp-json\/wp\/v2\/tags?post=27"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}