Install ACME for Apache & NGINX
-
Installing Certbot may vary depending on the operating system you are using. However, it is important to note that Certbot requires an up-to-date version of the operating system with support for the necessary dependencies and packages to function correctly. Using an outdated OS may result in installation errors or failure to obtain an SSL certificate.
It is also important to note that installing Certbot requires full access to the operating system (root).
-
-
*
Debian OS
There are three main ways to install Certbot on Debian-compatible operating systems: via the standard apt package manager, using the snap package, and using Python and the pip library.
Each method has its own characteristics: installation via apt is convenient and integrated with the system, but may not provide the latest version of Certbot; installation via snap is recommended by Certbot developers and provides automatic updates to the latest version; the pip option is more suitable for advanced users and cases where a custom installation in an isolated environment or custom configuration is required.
-
1
Installing Certbot using apt package manager
- Update package list
sudo apt update - Now install Certbot and, if necessary, a plugin for your web server (Apache or Nginx)
Apache:sudo apt install certbot python3-certbot-apacheNginx:sudo apt install certbot python3-certbot-nginx
- Update package list
-
2
Installing Certbot using snap package manager
- Make sure snapd is up to date
sudo snap install sudo snap refresh - Install Certbot via snap
sudo snap install --classic certbot - Create a symbolic link
sudo ln -s /snap/bin/certbot /usr/bin/certbot
- Make sure snapd is up to date
-
-
-
*
Red Hat OS
There are three main ways to install Certbot on Red Hat operating systems: via the system package manager dnf or yum with preliminary connection of the EPEL repository (Extra Packages for Enterprise Linux), which contains the necessary packages, using the snap package, and also using Python and the pip library.
Each of the methods has its own characteristics: installation via dnf or yum is convenient and integrated with the system, but may not provide the latest version of Certbot; installation via snap is recommended by Certbot developers and provides automatic updates to the latest version; the pip option is more suitable for advanced users and cases where a custom installation in an isolated environment is required or a non-standard configuration is set up.
-
1
Installing Certbot using dnf or yum package manager
- First you need to enable the EPEL repository
sudo dnf install epel-release OR sudo yum install epel-release - Then refresh the repository list
sudo dnf clean all sudo dnf update OR sudo yum clean all sudo yum update - Now install Certbot and, if necessary, the plugin for your web server
Apache: sudo dnf install certbot python3-certbot-apache OR sudo yum install certbot python-certbot-apacheNGINX: sudo dnf install certbot python3-certbot-nginx OR sudo yum install certbot python-certbot-nginx
- First you need to enable the EPEL repository
-
2
Installing Certbot using snap package manager
- Make sure snap is up to date
sudo snap install core sudo snap refresh core - Install Certbot via snap
sudo snap install --classic certbot - Create a symbolic link
sudo ln -s /snap/bin/certbot /usr/bin/certbot
- Make sure snap is up to date
-
-
-
*
Certbot configuration
Certbot can be configured both in fully automatic mode, which means it not only receives a certificate but also automatically configures the web server (Nginx or Apache), but also in manual mode if you want to make settings in the web server yourself.
-
*
Automatic installation of the certificate
An example of automatic installation and validation of a certificate using the http validation method. Certbot automatically determines the directory in which the website is located and creates the necessary files for validation.
sudo certbot --nginx --non-interactive --agree-tos --server <acme-direcotry> --email <your-email> --eab-kid <your-eab-kid> --eab-hmac-key <your-hmac-key> --domain <your-domain> --cert-name <your-certificate-name>- --nginx or --apache specifies the web server on which the certificate will be installed
- --non-interactive do not enable interactive mode used in CI/CD or cron scripts
- --agree-tos automatic confirmation with conditions
- --server ACME directory is provided when purchasing a certificate and may differ from the vendor and product
- --email client email to which notifications about the imminent expiration of the certificate are sent
- --eab-kid and --eab-hmac-key identification keys that are issued when purchasing an ACME account
- --domain for which domain or domains the certificate should be issued
- --cert-name is used to identify the certificate within the system
Example command for automatic certificate installation using Sectigo serversudo certbot --nginx --non-interactive --agree-tos --email admin@example.com --server https://acme.sectigo.com/v2/DV --eab-kid <your-eab-kid> --eab-hmac-key <your-hmac-key> --domain example.com --domain www.example.com --domain api.example.com --cert-name my-example-certificateTo install the certificate to Apache, you need to change --nginx to --apache
sudo certbot --apache --non-interactive --agree-tos --email admin@example.com --server https://acme.sectigo.com/v2/DV --eab-kid <your-eab-kid> --eab-hmac-key <your-hmac-key> --domain example.com --domain www.example.com --domain api.example.com --cert-name my-example-certificate
-
