azurenginx

Bitnami How-To Guides for Microsoft Azure

Generate and Install a Let's Encrypt SSL Certificate for a Bitnami Application

Introduction

Let’s Encrypt is a free Certificate Authority (CA) that issues SSL certificates. You can use these SSL certificates to secure traffic to and from your Bitnami application host.

This guide walks you through the process of generating a Let’s Encrypt SSL certificate for your domain and installing and configuring it to work with your Bitnami application stack.

Assumptions and prerequisites

This guide assumes that:

  • You have deployed a Bitnami application and the application is available at a public IP address.
  • You have the necessary credentials to log in to the Bitnami application instance.
  • You own one or more domain names.
  • You have configured the domain name’s DNS record to point to the public IP address of your Bitnami application instance.

Use the Bitnami HTTPS Configuration Tool

IMPORTANT: The Bitnami HTTPS Configuration Tool does not support configuring NGINX web servers yet. If you use NGINX, please refer to the legacy script section.

The Bitnami HTTPS Configuration Tool is a command line tool for configuring mainly HTTPS certificates on Bitnami stacks, but also common features such as automatic renewals, redirections (e.g. HTTP to HTTPS), etc. This tool is located in the installation directory of the stack at /opt/bitnami.

To launch the Bitnami HTTPS Configuration Tool, execute the following command:

$ sudo /opt/bitnami/bncert-tool

Refer to the How-To Guide for more information on this, or in case the tool doesn’t exist within your Bitnami stack.

NOTE: To manually generate and install Let’s Encrypt certificates, follow this alternative approach.

Use the legacy Bitnami auto-configuration script

IMPORTANT: This script will be deprecated soon, please use the Bitnami HTTPS Configuration Tool if your installation supports it.

Some Bitnami stacks include a small script that takes care of generating a valid certificate using Let’s Encrypt and configuring the web server to use it. That script uses Lego to run the Let’s Encrypt certificate generation commands. You can find the script inside the /opt/bitnami/letsencrypt/ directory.

To auto-configure a Let’s Encrypt certificate in your stack for a domain, execute the script both with and without the www prefix parameters. Replace the YOURMAIL and YOURDOMAIN placeholders with your current email address and with the domain name.

$ sudo /opt/bitnami/letsencrypt/scripts/generate-certificate.sh -m YOURMAIL -d YOURDOMAIN -d www.YOURDOMAIN

NOTE: You can use more than one domain by specifying the -d option as many times as domains you want to specify. When supplying multiple domains, Lego creates a SAN (Subject Alternate Names) certificate which results in only one certificate valid for all domains you entered. The first domain in your list will be added as the “CommonName” of the certificate and the rest, will be added as “DNSNames” to the SAN extension within the certificate.

This video shows you how easy it is to generate a valid certificate for your stack using the Bitnami auto-configure Let’s Encrypt tool:

Once the certificate is generated and installed, the tool will also automatically create a cron job for certificate renewal. You can opt to skip this step and instead create the cron job manually by following these steps:

  • Execute the following command to open the crontab editor:

    $ sudo crontab -e
    
  • Add the following lines to the crontab file and save it:

    0 0 1 * * /opt/bitnami/letsencrypt/lego --tls --email="YOURMAIL" --domains="YOURDOMAIN" --domains="www.YOURDOMAIN" renew && /opt/bitnami/apache2/bin/httpd -f /opt/bitnami/apache2/conf/httpd.conf -k graceful
    

NOTE: If renewing multiple domains, remember to update the previous command to include the additional domain name(s) in the lego command.

Add one or more domains to an existing certificate

To add one or more domains to an existing certificate, follow these instructions:

  • Delete the existing certificates.
  • Restore the Bitnami configuration.
  • Execute the command to generate a new certificate as shown below:

    Remembering to include the new domain(s) with additional -d options in the command line. Replace the YOURMAIL, YOURDOMAIN and YOUROTHERDOMAIN placeholders with your current email address, the current domain name and the additional domain name to be added.

    $ cd /opt/bitnami/apache2/conf/
    $ sudo rm -rf YOURDOMAIN*
    $ cd bitnami
    $ sudo mv bitnami.conf.back bitnami.conf
    $ sudo /opt/bitnami/letsencrypt/scripts/generate-certificate.sh -m YOURMAIL -d YOURDOMAIN -d www.YOURDOMAIN -d YOUROTHERDOMAIN
    

NOTE: To manually generate and install Let’s Encrypt certificates, follow this alternative approach.

Alternative approach

If your Bitnami image does not include the auto-configuration script or the /opt/bitnami/letsencrypt/ directory, you can manually install the Lego client and generate and install the Let’s Encrypt certificates. Follow the steps below.

Step 1: Install the Lego client

The Lego client simplifies the process of Let’s Encrypt certificate generate. To use it, follow these steps:

  • Log in to the server console as the bitnami user.
  • Run the following commands to install the Lego client. Note that you will need to replace the X.Y.Z placeholder with the actual version number of the downloaded archive:

    $ cd /tmp
    $ curl -Ls https://api.github.com/repos/xenolf/lego/releases/latest | grep browser_download_url | grep linux_amd64 | cut -d '"' -f 4 | wget -i -
    $ tar xf lego_vX.Y.Z_linux_amd64.tar.gz
    $ sudo mkdir -p /opt/bitnami/letsencrypt
    $ sudo mv lego /opt/bitnami/letsencrypt/lego
    

These steps will download, extract and copy the Lego client to a directory in your path.

Step 2: Generate a Let’s Encrypt certificate for your domain

NOTE: Before proceeding with this step, ensure that your domain name points to the public IP address of the Bitnami application host.

The next step is to generate a Let’s Encrypt certificate for your domain.

  • Turn off all Bitnami services:

    $ sudo /opt/bitnami/ctlscript.sh stop
    
  • Request a new certificate for your domain as below, both with and without the www prefix. Remember to replace the DOMAIN placeholder with your actual domain name, and the EMAIL-ADDRESS placeholder with your email address.

    $ sudo /opt/bitnami/letsencrypt/lego --tls --email="EMAIL-ADDRESS" --domains="DOMAIN" --domains="www.DOMAIN" --path="/opt/bitnami/letsencrypt" run
    

    NOTE: You can use more than one domain (for example, DOMAIN and www.DOMAIN) by specifying the --domains option as many times as the number of domains you want to specify. When supplying multiple domains, Lego creates a SAN (Subject Alternate Names) certificate which results in only one certificate valid for all domains you entered. The first domain in your list will be added as the “CommonName” of the certificate and the rest, will be added as “DNSNames” to the SAN extension within the certificate.

  • Agree to the terms of service.

A set of certificates will now be generated in the /opt/bitnami/letsencrypt/certificates directory. This set includes the server certificate file DOMAIN.crt and the server certificate key file DOMAIN.key.

An output message will provide some information, including the expiry date of the certificate. Note this expiry date carefully as you will need to renew your certificate before that date in order for it to remain valid.

An example certificate is shown below:

Let's Encrypt CA certificate

Step 3: Configure the Web server to use the Let’s Encrypt certificate

Next, tell the Web server about the new certificate, as follows:

  • Link the new SSL certificate and certificate key file to the correct locations, depending on which Web server you’re using. Update the file permissions to make them readable by the root user only. Remember to replace the DOMAIN placeholder with your actual domain name.

    For Apache:

    $ sudo mv /opt/bitnami/apache2/conf/server.crt /opt/bitnami/apache2/conf/server.crt.old
    $ sudo mv /opt/bitnami/apache2/conf/server.key /opt/bitnami/apache2/conf/server.key.old
    $ sudo mv /opt/bitnami/apache2/conf/server.csr /opt/bitnami/apache2/conf/server.csr.old
    $ sudo ln -sf /opt/bitnami/letsencrypt/certificates/DOMAIN.key /opt/bitnami/apache2/conf/server.key
    $ sudo ln -sf /opt/bitnami/letsencrypt/certificates/DOMAIN.crt /opt/bitnami/apache2/conf/server.crt
    $ sudo chown root:root /opt/bitnami/apache2/conf/server*
    $ sudo chmod 600 /opt/bitnami/apache2/conf/server*
    

    For NGINX:

    $ sudo mv /opt/bitnami/nginx/conf/server.crt /opt/bitnami/nginx/conf/server.crt.old
    $ sudo mv /opt/bitnami/nginx/conf/server.key /opt/bitnami/nginx/conf/server.key.old
    $ sudo mv /opt/bitnami/nginx/conf/server.csr /opt/bitnami/nginx/conf/server.csr.old
    $ sudo ln -sf /opt/bitnami/letsencrypt/certificates/DOMAIN.key /opt/bitnami/nginx/conf/server.key
    $ sudo ln -sf /opt/bitnami/letsencrypt/certificates/DOMAIN.crt /opt/bitnami/nginx/conf/server.crt
    $ sudo chown root:root /opt/bitnami/nginx/conf/server*
    $ sudo chmod 600 /opt/bitnami/nginx/conf/server*
    

    TIP: To find out if your Bitnami stack uses Apache or nginx, check the output of the command sudo /opt/bitnami/ctlscript.sh status.

  • Restart all Bitnami services:

    $ sudo /opt/bitnami/ctlscript.sh start
    

To add one or more domains to an existing certificate, simply repeat Steps 2 and 3 again, ensuring the same order of domain names is maintained in the lego command and adding the new domain name(s) to the end with additional –domains arguments.

Step 4: Test the configuration

After reconfirming that your domain name points to the public IP address of the Bitnami application instance, you can test it by browsing to https://DOMAIN (replace the DOMAIN placeholder with the correct domain name).

This should display the secure welcome page of the Bitnami application. Clicking the padlock icon in the browser address bar should display the details of the domain and SSL certificate.

Let's Encrypt certificate in action

Step 5: Renew the Let’s Encrypt certificate

Let’s Encrypt certificates are only valid for 90 days. To renew the certificate before it expires, run the following commands from the server console as the bitnami user. Remember to replace the DOMAIN placeholder with your actual domain name, and the EMAIL-ADDRESS placeholder with your email address.

    $ sudo /opt/bitnami/ctlscript.sh stop
    $ sudo /opt/bitnami/letsencrypt/lego --tls --email="EMAIL-ADDRESS" --domains="DOMAIN" --path="/opt/bitnami/letsencrypt" renew --days 90
    $ sudo /opt/bitnami/ctlscript.sh start

To automatically renew your certificates before they expire, write a script to perform the above tasks and schedule a cron job to run the script periodically. To do this:

  • Create a script at /opt/bitnami/letsencrypt/scripts/renew-certificate.sh with the following content. Remember to replace the DOMAIN placeholder with your actual domain name, and the EMAIL-ADDRESS placeholder with your email address.

    #!/bin/bash
    
    sudo /opt/bitnami/ctlscript.sh stop apache
    sudo /opt/bitnami/letsencrypt/lego --tls --email="EMAIL-ADDRESS" --domains="DOMAIN" --path="/opt/bitnami/letsencrypt" renew --days 90
    sudo /opt/bitnami/ctlscript.sh start apache
    
  • Make the script executable:

    $ chmod +x /opt/bitnami/letsencrypt/scripts/renew-certificate.sh
    
  • Execute the following command to open the crontab editor:

    $ sudo crontab -e
    
  • Add the following lines to the crontab file and save it:

    0 0 1 * * /opt/bitnami/letsencrypt/scripts/renew-certificate.sh 2> /dev/null
    

NOTE: If renewing multiple domains, remember to update the /opt/bitnami/letsencrypt/renew-certificate.sh script to include the additional domain name(s) in the lego command.

To learn more about the topics discussed in this guide, consider visiting the following links:

Last modification May 13, 2019