Install ACME for Apache & NGINX

Debian OS

There are three main ways to install Certbot on Debian-compatible operating systems: via the standard apt package manager, using the snap package, and using Python and the pip library.

Each method has its own characteristics: installation via apt is convenient and integrated with the system, but may not provide the latest version of Certbot; installation via snap is recommended by Certbot developers and provides automatic updates to the latest version; the pip option is more suitable for advanced users and cases where a custom installation in an isolated environment or custom configuration is required.

Installing Certbot using apt package manager

1. Update package list

                                               sudo apt update
                                           

2. Now install Certbot and, if necessary, a plugin for your web server (Apache or Nginx)

                                               Apache:sudo apt install certbot python3-certbot-apache
                                           

                                               Nginx:sudo apt install certbot python3-certbot-nginx
                                           

Installing Certbot using snap package manager

1. Make sure snapd is up to date

                                               sudo snap install
                                               
   
                                               sudo snap refresh
                                           

2. Install Certbot via snap

                                               sudo snap install --classic certbot
                                           

3. Create a symbolic link

                                               sudo ln -s /snap/bin/certbot /usr/bin/certbot
                                           

Red Hat OS

There are three main ways to install Certbot on Red Hat operating systems: via the system package manager dnf or yum with preliminary connection of the EPEL repository (Extra Packages for Enterprise Linux), which contains the necessary packages, using the snap package, and also using Python and the pip library.

Each of the methods has its own characteristics: installation via dnf or yum is convenient and integrated with the system, but may not provide the latest version of Certbot; installation via snap is recommended by Certbot developers and provides automatic updates to the latest version; the pip option is more suitable for advanced users and cases where a custom installation in an isolated environment is required or a non-standard configuration is set up.

Installing Certbot using dnf or yum package manager

1. First you need to enable the EPEL repository

                                               sudo dnf install epel-release
                                               
   
                                               OR
                                                sudo yum install epel-release
                                           

2. Then refresh the repository list

                                               sudo  dnf clean all
                                               
   
                                               sudo  dnf update
                                               
   
                                              OR
                                               sudo  yum clean all
                                               
   
                                               sudo  yum update
                                           

3. Now install Certbot and, if necessary, the plugin for your web server

                                               Apache:
                                               sudo dnf install certbot python3-certbot-apache
                                               OR
                                               sudo yum install certbot python-certbot-apache
                                           

                                               NGINX:
                                               sudo dnf install certbot python3-certbot-nginx
                                               OR
                                               sudo yum install certbot python-certbot-nginx
                                           

Installing Certbot using snap package manager

1. Make sure snap is up to date

                                               sudo snap install core
                                                
   
                                               sudo snap refresh core
   
                                           

2. Install Certbot via snap

                                               sudo snap install --classic certbot
                                           

3. Create a symbolic link

                                               sudo ln -s /snap/bin/certbot /usr/bin/certbot
                                           

Certbot configuration

Certbot can be configured both in fully automatic mode, which means it not only receives a certificate but also automatically configures the web server (Nginx or Apache), but also in manual mode if you want to make settings in the web server yourself.

Automatic installation of the certificate

An example of automatic installation and validation of a certificate using the http validation method. Certbot automatically determines the directory in which the website is located and creates the necessary files for validation.

                                sudo certbot --nginx --non-interactive --agree-tos --server <acme-direcotry> --email <your-email> --eab-kid <your-eab-kid> --eab-hmac-key <your-hmac-key> --domain your-domain> --cert-name <your-certificate-name>
                                

• --nginx or --apache specifies the web server on which the certificate will be installed
• --non-interactive do not enable interactive mode used in CI/CD or cron scripts
• --agree-tos automatic confirmation with conditions
• --server ACME directory is provided when purchasing a certificate and may differ from the vendor and product
• --email client email to which notifications about the imminent expiration of the certificate are sent
• --eab-kid and --eab-hmac-key identification keys that are issued when purchasing an ACME account
• --domain for which domain or domains the certificate should be issued
• --cert-name is used to identify the certificate within the system

Example command for automatic certificate installation using Sectigo server

                                    sudo certbot --nginx --non-interactive --agree-tos --email admin@example.com --server https://acme.sectigo.com/v2/DV --eab-kid <your-eab-kid> --eab-hmac-key <your-hmac-key> --domain example.com --domain www.example.com --domain api.example.com --cert-name my-example-certificate

To install the certificate to Apache, you need to change --nginx to --apache

                                         sudo certbot --apache --non-interactive --agree-tos --email admin@example.com --server https://acme.sectigo.com/v2/DV --eab-kid <your-eab-kid> --eab-hmac-key <your-hmac-key> --domain example.com --domain www.example.com --domain api.example.com --cert-name my-example-certificate