Certbot (Let's Encrypt) SSL Certificates

Certbot (formerly known as Let's Encrypt) can be used to obtain free TLS certificates to encrypt connections to any website you own. This guide assumes that you already own a fully qualified domain name with a DNS record pointing to the IP address of your Whatbox slot.

Prerequisites

Because Certbot exists as a python pip package, it can be easily installed into an existing virtualenv. After setting up a basic virtualenv and nginx installation, certbot can be installed as follows.

Certbot Installation

  • Install certbot and its dependencies:
pip install certbot
pip install pip -U
pip install virtualenv -U
pip install zope.interface -U
pip install certbot -U
  • Create certificate/work/configuration directories
mkdir -p ~/.certbot
mkdir -p ~/.certbot/work
mkdir -p ~/.certbot/logs

Usage Notes

  • Certbot is now functional, but we must specify our custom directories when invoking the certbot command:

certbot --config-dir=~/.certbot --work-dir=~/.certbot/work --logs-dir=~/.certbot/logs However, this can be simplified with an alias added to ~/.bashrc:

echo 'alias certbot="certbot --config-dir=~/.certbot --work-dir=~/.certbot/work --logs-dir=~/.certbot/logs"' >> ~/.bashrc
source ~/.bashrc
  • Certbot will not work with the webroot option. When certbot attempts to verify your domain, it will only connect to port 80 or port 443, which is not available to you. You will need to use the --preferred-challenges dns option to make it work correctly. You will be asked to create a dns TXT record for your domain for verification.

Also keep in mind that since your server is shared that your private key is not protected compared with the Certbot default installation on a private server. For further Certbot usage documentation, see Certbot's user guide.

  • After obtaining your certificate, configure your nginx instance to use the certificate and adjust your configuration accordingly.