Setting up SSL with Let's Encrypt [CentOS + Nginx Edition]

Tadashi Shigeoka ·  Tue, June 12, 2018

I’ll introduce how to set up SSL with Let’s Encrypt on a server with CentOS + Nginx configuration.

Let's Encrypt

Installing certbot

While there’s a method to install with yum, Python dependencies seemed troublesome, so I decided to download and use it as a zip from GitHub.

cd /usr/local/

wget https://github.com/certbot/certbot/archive/master.zip
unzip master.zip
mv certbot-master certbot

cd certbot/

Checking the certbot-auto Command

Verify that the certbot-auto command can be executed.

$ ./certbot-auto --help
Usage: certbot-auto [OPTIONS]
A self-updating wrapper script for the Certbot ACME client. When run, updates
to both this script and certbot will be downloaded and installed. After
ensuring you have the latest versions installed, certbot will be invoked with
all arguments you have provided.

Help for certbot itself cannot be provided until it is installed.

  --debug                                   attempt experimental installation
  -h, --help                                print this help
  -n, --non-interactive, --noninteractive   run without asking for user input
  --no-bootstrap                            do not install OS dependencies
  --no-self-upgrade                         do not download updates
  --os-packages-only                        install OS dependencies and exit
  --install-only                            install certbot, upgrade if needed, and exit
  -v, --verbose                             provide more output
  -q, --quiet                               provide only update/error output;
                                            implies --non-interactive

All arguments are accepted and forwarded to the Certbot client when run.

Obtaining SSL Certificate

Execute the certbot-auto command as follows:

./certbot-auto certonly --standalone \\
-d example.com \\
-m [email protected] \\
--agree-tos \\
--non-interactive

Failure Example

By the way, executing ./certbot-auto certonly --standalone while Nginx is running will fail.

Problem binding to port 80: Could not bind to IPv4 or IPv6.

IMPORTANT NOTES:
 - Your account credentials have been saved in your Certbot
   configuration directory at /etc/letsencrypt. You should make a
   secure backup of this folder now. This configuration directory will
   also contain certificates and private keys obtained by Certbot so
   making regular backups of this folder is ideal.

Stop Nginx:

service nginx stop

Execute ./certbot-auto certonly --standalone again, and this time it succeeded.

IMPORTANT NOTES:
 - Congratulations! Your certificate and chain have been saved at:
   /etc/letsencrypt/live/codenote.net/fullchain.pem
   Your key file has been saved at:
   /etc/letsencrypt/live/codenote.net/privkey.pem
   Your cert will expire on 2018-09-09. To obtain a new or tweaked
   version of this certificate in the future, simply run certbot-auto
   again. To non-interactively renew *all* of your certificates, run
   "certbot-auto renew"
 - If you like Certbot, please consider supporting our work by:

   Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
   Donating to EFF:                    https://eff.org/donate-le

Checking Let's Encrypt Retrieved Files

Finally, let’s verify the files retrieved by the ./certbot-auto certonly command.

/etc/letsencrypt/
|-- accounts # Account information
|-- archive # Retrieved certificate files are saved in directories for each domain
|   `-- example.com
|       |-- cert1.pem
|       |-- chain1.pem
|       |-- fullchain1.pem
|       `-- privkey1.pem
|-- csr
|-- keys
|-- live # Symbolic links to the latest certificates are created
|   `-- example.com
|       |-- README
|       |-- cert.pem -> ../../archive/example.com/cert1.pem
|       |-- chain.pem -> ../../archive/example.com/chain1.pem
|       |-- fullchain.pem -> ../../archive/example.com/fullchain1.pem
|       `-- privkey.pem -> ../../archive/example.com/privkey1.pem
|-- renewal
|   `-- example.com.conf
`-- renewal-hooks

Once you’ve obtained the SSL certificate, you need to add SSL configuration to Nginx, but I’ll explain that method in a separate article.

That’s all from the Gemba where I obtained an SSL certificate with Let’s Encrypt.

Reference Information