EMZETT.
Login

Emzett Wiki

Let's Encrypt and TLS certificates

Properties1
tagsletsencrypt, tls, zertifikat, https, certbot

2 min read

Let’s Encrypt and TLS certificates

In short: For HTTPS a server needs a certificate that confirms: “this key belongs to this domain.” Let’s Encrypt issues such certificates for free and automatically.

How the check works (ACME)

The protocol ACME lets the server prove that it owns the domain:

  • HTTP-01: Let’s Encrypt fetches a certain file at http://domain/.well-known/acme-challenge/.... Port 80 must be reachable.
  • DNS-01: you create a certain TXT record in DNS (DNS). Needed for wildcard certificates (*.example.com) and servers without public access.

With certbot

sudo apt install certbot python3-certbot-nginx
sudo certbot --nginx -d example.com -d www.example.com
sudo certbot renew --dry-run      # test renewal

Certificates are valid for only 90 days, so a timer renews them automatically (usually from 30 days remaining). Caddy does everything without an extra tool, see Web servers compared.

What is in the certificate

Domain names, validity, public key and the issuer’s signature. The browser checks the chain up to a trusted authority, see Digital signature and TLS and HTTPS.

Typical problems

  1. Port 80/443 blocked by the firewall.
  2. DNS still points to the old address.
  3. Too many requests (there are limits per domain and week).
  4. Renewal does not run because the timer is missing: check regularly.

See also: WireGuard: a lean VPN

Backlinks