Quick answer
Certbot turns a multi-hour certificate process into one command.
Certbot turns a multi-hour certificate process into one command. The only real work is making sure renewal keeps working unattended.
What you need: Apache, certbot, and a domain whose DNS already points at the server.
Install certbot
Install the certbot and python3-certbot-apache packages, then let the Apache plugin do the heavy lifting.
Issue the certificate
Run certbot with –apache and pick your domains. The plugin edits the vhost, adds the redirect, and reloads Apache.
Verify auto-renewal
The installer drops a systemd timer in place. Do a dry run to confirm the renewal path works before the 90-day window closes.
apt install certbot python3-certbot-apache
certbot --apache -d example.com -d www.example.com
certbot renew --dry-runHow it works, in detail
Certbot automates the HTTP-01 challenge by placing a token on your server and proving control of the domain, then rewrites the vhost to add the certificate and a redirect. The certificate is only valid for 90 days, so the renewal timer is the part that keeps the site secure long after the initial joy fades. The installer drops a systemd timer in place, but verifying it actually fires with a dry run is the difference between a site that stays secure and one that silently expires.
Common pitfalls
- Assuming renewal works without ever running a dry run.
- Forgetting to renew a certificate for a subdomain added later.
Pro tip
Schedule a monthly certbot renew –dry-run and watch its output for failures before the 90-day window closes.
The certificate is the easy part. The discipline is checking that the renew timer actually fires — set a calendar reminder for day 80.
0 Comments