web hosting – Kev's Development Toolbox

After purchasing SSL certs for many years for my personal project websites, I recently switched to creating free Let’s Encrypt certs using CertBot instead.

To install with python and pip on Debian based Linux, for nginx (from here):

Install deps and install:

sudo apt install python3 python3-dev python3-venv libaugeas-dev gcc
sudo python3 -m venv /opt/certbot/
sudo /opt/certbot/bin/pip install --upgrade pip

sudo /opt/certbot/bin/pip install certbot certbot-nginx
sudo ln -s /opt/certbot/bin/certbot /usr/local/bin/certbot

To generate certificate and renew manually (same command):

sudo certbot certonly -v --reinstall --webroot --webroot-path=/var/www/html/ --email your@email --agree-tos --no-eff-email -d your.domain.name

To view current status of your certificates:

certbot certificates

For websites not on the public internet where the validation step can’t use the webserver to host a validation file, certbot also can validate using a DNS record with a generated value – follow the prompts to use this approach:

certbot certonly --manual --preferred-challenges dns -d your.domain.name

When you purchase an SSL certificate for a domain, e.g. to secure HTTPS usage with your web server, your certificate download may provide you several files like this:

youdomain.com.crt : this is your domain certificate

Files that look this are the root and intermediate certificates:

USERTrust_RSA_Certification_Authority.crt

Sectigo_RSA_Domain_Validation_Secure_Server_CA.crt

Depending how your SSL vendor supplies these files, the second two files may be provided already bundled in one file or two separate files.

To combine them together into one bundle file, use cat to concat the files:

cat yourdomain_com.crt USERTrustRSAAddTrustCA.crt AddTrustExternalCARoot.crt > domain_com.ca-bundle.crt

Open the file and check that each start and end comment for each cert are on their own line and not on the same line (see here).

Tag: web hosting

Creating and renewing Let’s Encrypt SSL certificates with certbot

Creating a single SSL certificate bundle from CA root and intermediate certificates