How To Secure Apache With Let's Encrypt On Ubuntu 20.04

5/12/22, 22:13 How To Secure Apache with Let's Encrypt on Ubuntu 20.
04 | DigitalOcean
CONTENTS
Prerequisites
Step 1 — Installing Certbot
Step 2 — Checking your Apache Virtual Host Configuration
Step 3 — Allowing HTTPS Through the Firewall
Step 4 — Obtaining an SSL Certificate
Step 5 — Verifying Certbot Auto-Renewal
Conclusion
R E L AT E D
How To Install Linux, Apache, MySQL, PHP (LAMP) stack on Ubuntu

View
How To Install Rails, Apache, and MySQL on Ubuntu with Passenger
View
// Tutorial //
How To Secure Apache with Let's Encrypt on Ubuntu 20.04
Published
This site usesoncookies
April 29,
and 2020
related· technologies,
Updated on asApril 29, 2020
described in our MANAGE CHOICES
privacy policy,
policy, for purposes that may include site operation, analytics,
enhanced userLet's
experience,
Encryptor advertising. You may choose to consent
to Apache
our use of these technologies,Ubuntu 20.04
or manage your own preferences. AGREE & PROCEED
https://www.digitalocean.com/community/tutorials/how-to-secure-apache-with-let-s-encrypt-on-ubuntu-20-04 1/19
5/12/22, 22:13 How To Secure Apache with Let's Encrypt on Ubuntu 20.04 | DigitalOcean
By Erika Heidi English

Developer Advocate
Not using Ubuntu 20.04? Ubuntu 20.04

Choose a different version or distribution.
Introduction
Let’s Encrypt is a Certificate Authority (CA) that facilitates obtaining and installing free
TLS/SSL certificates, thereby enabling encrypted HTTPS on web servers. It simplifies the
process by providing a software client, Certbot, that attempts to automate most (if not all)
of the required steps. Currently, the entire process of obtaining and installing a certificate
is fully automated on both Apache and Nginx.
In this
This site guide,
uses we’ll use
cookies and Certbot
related to obtain aasfree
technologies, SSL certificate
described in our for Apache on Ubuntu 20.04,
and make
privacy policysure
policy, this certificate
, for purposes that mayisinclude
set upsite
to renew automatically.
operation, analytics,
enhanced user experience, or advertising. You may choose to consent
toThis tutorial
our use of theseusestechnologies,
a separateorvirtual
managehostyourfileowninstead of Apache’s default configuration file
preferences.
for setting up the website that will be secured by Let’s Encrypt. We recommend creating
new Apache virtual host files for each domain hosted in a server, because it helps to avoid
common mistakes and maintains the default configuration files as a fallback setup.
Prerequisites
To follow this tutorial, you will need:

One Ubuntu 20.04 server set up by following this initial server setup for Ubuntu 20.04
tutorial, including a sudo non-root user and a firewall.
A fully registered domain name. This tutorial will use your_domain as an example
throughout. You can purchase a domain name on Namecheap, get one for free on
Freenom, or use the domain registrar of your choice.
Both of the following DNS records set up for your server. You can follow this
introduction to DigitalOcean DNS for details on how to add them.
An A record with your_domain pointing to your server’s public IP address.
An A record with www. your_domain pointing to your server’s public IP address.
Apache installed by following How To Install Apache on Ubuntu 20.04. Be sure that
you have a virtual host file for your domain. This tutorial will use /etc/apache2/sites-
available/ your_domain .conf as an example.
Step 1 — Installing Certbot
In order to obtain an SSL certificate with Let’s Encrypt, we’ll first need to install the Certbot
software on your server. We’ll use the default Ubuntu package repositories for that.
We need two packages: certbot , and python3-certbot-apache . The latter is a plugin that
integrates Certbot with Apache, making it possible to automate obtaining a certificate and
configuring HTTPS within your web server with a single command.
$ sudo apt install certbot python3-certbot-apache Copy
You will be prompted to confirm the installation by pressing Y , then ENTER .
Certbot is now installed on your server. In the next step, we’ll verify Apache’s configuration
to make
This site
surecookies
uses
your virtual
and
hosttechnologies,
related
is set appropriately.
as
Thisin our
described
will ensure that the certbot client
script policy,
privacy will be, forable
policy to detect
purposes yourinclude
that may domainssiteand reconfigure
operation, analytics,your web server to use your
newly generated
enhanced SSL certificate
user experience, automatically.
or advertising. You may choose to consent
to our use of these technologies, or manage your own preferences.
Step 2 — Checking your Apache Virtual Host
Configuration
In order to be able to automatically obtain and configure SSL for your web server, Certbot
needs to find the correct virtual host within your Apache configuration files. Your server
domain name(s) will be retrieved from the ServerName and ServerAlias directives defined
within your VirtualHost configuration block.
If you followed the virtual host setup step in the Apache installation tutorial, you should
have a VirtualHost block set up for your domain at /etc/apache2/sites-
available/ your_domain .conf with the ServerName and also the ServerAlias directives
already set appropriately.
To check this up, open the virtual host file for your domain using nano or your preferred
text editor:
$ sudo nano /etc/apache2/sites-available/ your_domain .conf Copy
Find the existing ServerName and ServerAlias lines. They should look like this:
/etc/apache2/sites-available/your_domain.conf
...
ServerName your_domain
ServerAlias www.your_domain
...
If you already have your ServerName and ServerAlias set up like this, you can exit your
text editor and move on to the next step. If you’re using nano , you can exit by typing
CTRL+X , then Y and ENTER to confirm.
If your current virtual host configuration doesn’t match the example, update it accordingly.
When you’re done, save the file and quit the editor. Then, run the following command to
validate your changes:
$ sudo apache2ctl configtest Copy
This
Yousiteshould
uses cookies
get and related
a Syntax OK astechnologies,
ainclude
response. as Ifdescribed inanourerror, reopen the virtual host file
you getanalytics,
privacy policy
policy,
and check , for purposes that may site operation,
enhanced userforexperience,
any typosororadvertising.
missing characters.
You may choose Onceto your
consentconfiguration file’s syntax is
tocorrect,
our use ofreload
theseApache so thator manage
technologies, the changes
your owntakepreferences.
effect:
$ sudo systemctl reload apache2 Copy

With these changes, Certbot will be able to find the correct VirtualHost block and update it.
Next, we’ll update the firewall to allow HTTPS traffic.
Step 3 — Allowing HTTPS Through the Firewall
If you have the UFW firewall enabled, as recommended by the prerequisite guides, you’ll
need to adjust the settings to allow HTTPS traffic. Upon installation, Apache registers a few
different UFW application profiles. We can leverage the Apache Full profile to allow both
HTTP and HTTPS traffic on your server.
To verify what kind of traffic is currently allowed on your server, you can use:
$ sudo ufw status Copy
If you have followed one of our Apache installation guides, your output should look
something like this, meaning that only HTTP traffic on port 80 is currently allowed:
Web hosting without headaches. Try Cloudways with $100 in free We're Blog Docs Get Sales
credit! Sign up ->
Output
hiring Support
Status: active
To Action From
-- ------ ----
OpenSSH ALLOW Anywhere
Tutorials Questions Learning Paths For Businesses Product Docs Social Impact
Apache ALLOW Anywhere
OpenSSH (v6) ALLOW Anywhere (v6)
Apache (v6) ALLOW Anywhere (v6)
To additionally let in HTTPS traffic, allow the “Apache Full” profile and delete the redundant
“Apache” profile:
$ sudo ufw allow 'Apache Full' Copy
$ sudo ufw delete allow 'Apache'
Your status will now look like this:

This site uses cookies and related technologies, as described in our
privacy policy,
enhanced
$ sudo userufwexperience,
status or advertising. You may choose to consent Copy
Output
Status: active
To Action From
-- ------ ----
OpenSSH ALLOW Anywhere
Apache Full ALLOW Anywhere
OpenSSH (v6) ALLOW Anywhere (v6)
Apache Full (v6) ALLOW Anywhere (v6)
You are now ready to run Certbot and obtain your certificates.
Step 4 — Obtaining an SSL Certificate
Certbot provides a variety of ways to obtain SSL certificates through plugins. The Apache
plugin will take care of reconfiguring Apache and reloading the configuration whenever
necessary. To use this plugin, type the following:
$ sudo certbot --apache Copy
This script will prompt you to answer a series of questions in order to configure your SSL
certificate. First, it will ask you for a valid e-mail address. This email will be used for
renewal notifications and security notices:
Output
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator apache, Installer apache
Enter email address (used for urgent renewal and security notices) (Enter 'c' to
cancel): you@your_domain
After providing a valid e-mail address, hit ENTER to proceed to the next step. You will then
be prompted to confirm if you agree to Let’s Encrypt terms of service. You can confirm by
pressing A and then ENTER :
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Please read the Terms of Service at
https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf. You must
privacy policy,
agree in order to register with the ACME server at
https://acme-v02.api.letsencrypt.org/directory
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(A)gree/(C)ancel: A
Next, you’ll be asked if you would like to share your email with the Electronic Frontier
Foundation to receive news and other information. If you do not want to subscribe to their
content, type N . Otherwise, type Y . Then, hit ENTER to proceed to the next step.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Would you be willing to share your email address with the Electronic Frontier
Foundation, a founding partner of the Let's Encrypt project and the non-profit
organization that develops Certbot? We'd like to send you email about our work
encrypting the web, EFF news, campaigns, and ways to support digital freedom.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: N
The next step will prompt you to inform Certbot of which domains you’d like to activate
HTTPS for. The listed domain names are automatically obtained from your Apache virtual
host configuration, that’s why it’s important to make sure you have the correct ServerName
and ServerAlias settings configured in your virtual host. If you’d like to enable HTTPS for
all listed domain names (recommended), you can leave the prompt blank and hit ENTER to
proceed. Otherwise, select the domains you want to enable HTTPS for by listing each
appropriate number, separated by commas and/ or spaces, then hit ENTER .
Which names would you like to activate HTTPS for?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
1: your_domain
2: www. your_domain
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Select the appropriate numbers separated by commas and/or spaces, or leave input
blank to select all options shown (Enter 'c' to cancel):
You’ll see output like this:

Obtaining a new certificate
Performing the following challenges:
http-01 challenge for your_domain
http-01 challenge for www. your_domain
privacy policy,
Enabled Apache rewrite module

Waiting for verification...
Cleaning up challenges
Created an SSL vhost at /etc/apache2/sites-available/ your_domain -le-ssl.conf
Enabled Apache socache_shmcb module

Enabled Apache ssl module
Deploying Certificate to VirtualHost /etc/apache2/sites-available/ your_domain -le
Enabling available site: /etc/apache2/sites-available/ your_domain -le-ssl.conf
Deploying Certificate to VirtualHost /etc/apache2/sites-available/ your_domain -le
Next, you’ll be prompted to select whether or not you want HTTP traffic redirected to
HTTPS. In practice, that means when someone visits your website through unencrypted
channels (HTTP), they will be automatically redirected to the HTTPS address of your
website. Choose 2 to enable the redirection, or 1 if you want to keep both HTTP and
HTTPS as separate methods of accessing your website.
Please choose whether or not to redirect HTTP traffic to HTTPS, removing HTTP acc
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
1: No redirect - Make no further changes to the webserver configuration.
2: Redirect - Make all requests redirect to secure HTTPS access. Choose this for
new sites, or if you're confident your site works on HTTPS. You can undo this
change by editing your web server's configuration.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Select the appropriate number [1-2] then [enter] (press 'c' to cancel): 2
After this step, Certbot’s configuration is finished, and you will be presented with the final
remarks about your new certificate, where to locate the generated files, and how to test
your configuration using an external tool that analyzes your certificate’s authenticity:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Congratulations! You have successfully enabled https:// your_domain and
https://www. your_domain
You should test your configuration at:

https://www.ssllabs.com/ssltest/analyze.html?d= your_domain
https://www.ssllabs.com/ssltest/analyze.html?d=www. your_domain
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
IMPORTANT NOTES:
- Congratulations! Your certificate and chain have been saved at:
/etc/letsencrypt/live/ your_domain /fullchain.pem
Your key file has been saved at:
/etc/letsencrypt/live/ your_domain /privkey.pem
privacy policy,
Your cert will expire on 2020-07-27. To obtain a new or tweaked
version of this certificate in the future, simply run certbot again
with the "certonly" option. To non-interactively renew *all* of
your certificates, run "certbot renew"
- Your account credentials have been saved in your Certbot

configuration directory at /etc/letsencrypt. You should make a
secure backup of this folder now. This configuration directory will
also contain certificates and private keys obtained by Certbot so
making regular backups of this folder is ideal.
- If you like Certbot, please consider supporting our work by:
Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate

Donating to EFF: https://eff.org/donate-le
Your certificate is now installed and loaded into Apache’s configuration. Try reloading your
website using https:// and notice your browser’s security indicator. It should point out
that your site is properly secured, typically by including a lock icon in the address bar.
You can use the SSL Labs Server Test to verify your certificate’s grade and obtain detailed
information about it, from the perspective of an external service.
In the next and final step, we’ll test the auto-renewal feature of Certbot, which guarantees
that your certificate will be renewed automatically before the expiration date.
Step 5 — Verifying Certbot Auto-Renewal
Let’s Encrypt’s certificates are only valid for ninety days. This is to encourage users to
automate their certificate renewal process, as well as to ensure that misused certificates or
stolen keys will expire sooner rather than later.
The certbot package we installed takes care of renewals by including a renew script to
/etc/cron.d , which is managed by a systemctl service called certbot.timer . This script
runs twice a day and will automatically renew any certificate that’s within thirty days of
expiration.
To check the status of this service and make sure it’s active and running, you can use:
$ sudo systemctl status certbot.timer Copy
You’ll get output similar to this:
ThisOutput
site uses cookies and related technologies, as described in our
privacy policy, for purposes
policy, thatcertbot
may include site daily
operation, analytics,
enhanced user experience,
● certbot.timer
or
- Run
advertising. You
twice
may choose to consent
to our useLoaded:
of these technologies, or manage your own preferences.
loaded (/lib/systemd/system/certbot.timer; enabled;
Active: active (waiting) since Tue 2020-04-28 17:57:48 UTC;
vendor preset: e
17h ago
Trigger: Wed 2020-04-29 23:50:31 UTC; 12h left

Triggers: ● certbot.service
Apr 28 17:57:48 fine-turtle systemd[1]: Started Run certbot twice daily.
To test the renewal process, you can do a dry run with certbot :
$ sudo certbot renew --dry-run Copy
If you see no errors, you’re all set. When necessary, Certbot will renew your certificates and
reload Apache to pick up the changes. If the automated renewal process ever fails, Let’s
Encrypt will send a message to the email you specified, warning you when your certificate
is about to expire.
Conclusion
In this tutorial, you’ve installed the Let’s Encrypt client certbot , configured and installed an
SSL certificate for your domain, and confirmed that Certbot’s automatic renewal service is
active within systemctl . If you have further questions about using Certbot, their
documentation is a good place to start.
Get Ubuntu on a hosted virtual machine in seconds with DigitalOcean Droplets!

Simple enough for any user, powerful enough for fast-growing applications or
businesses.
Learn more here ->
Want to learn more? Join the DigitalOcean

Community!
privacy policy,
enhanced userDigitalOcean
experience, or community
advertising. You may choose to developers
consent for free! Get help and
to ourJoin
use our
of these technologies, or manage ofyour
over a million
own preferences.
share knowledge in our Questions & Answers section, find tutorials and tools that will
help you grow as a developer and scale your project or business, and subscribe to
topics of interest.
Sign up now ->
About the authors
Erika Heidi Author

Developer Advocate
Dev/Ops passionate about open source, PHP, and Linux.
Still looking for an answer?
Ask a question Search for more help
Was this helpful? Yes No
Comments
10 Comments
privacy policy,
Leave a comment...
This textbox defaults to using Markdown to format your answer.

You can type !ref in this text area to quickly search our full set of tutorials, documentation
& marketplace offerings and insert the link!
Sign In or Sign Up to Comment
YurkshireLad • May 28, 2020
You can re-run “certbot --apache” so that the script can automatically redirect
http to https. In case you originally chose to not auto-configure this.
I can confirm that this works like a charm on Ubuntu 20.04. Simple! Thanks.
Show replies Reply
rtirtadji • April 30, 2020

The original Ubuntu 20.04 package have this bugs it did not install the right
python3-certbot-nginx
So the only solution for ubuntu (AMD64) are via snap
1. sudo snap install certbot --beta --classic
privacyorpolicy,
to our use2.of these technologies, or manage your own preferences.
sudo add-apt-repository ppa:ahasenack/certbot-tlssni01-1875471

sudo apt-get update
Thanks to Andreas for making his PPA available temporarily to fixed the problem
I hope this will help people who want to upgrade to 20.04
Show replies Reply
A C • November 12, 2022

I am not able to get this to work on 20.04 with Apache. My domain always
redirects to the droplet IP, and the HTTPS fails with error:
NET::ERR_CERT_COMMON_NAME_INVALID
I hit enter when the certbot asked for domain. My CAA is wild. I configured the
webserver as per the tutorial before doing certbot. I am not sure how to resolve
this. Any help is appreciated.
Reply
Jon Austen • April 28, 2022

This article, is missing instructions around /etc/hosts file that was causing the
sudo apache2ctl configtest command to fail, saying it cant resolve 127.0.1.1 (or
something like that).
Reply
Path Dabhi • April 21, 2022

privacyError:
policyCould
policy, not reverse
, for purposes mapinclude
that may the HTTPS VirtualHost
site operation, to the original
analytics,
Solution: remove whitespace or extra lines are there in .conf file after
</VirtualHost> at End of File
Reply
rahulradadiya65 • March 4, 2022

work for me
Reply
githubbjar • February 11, 2022

When running sudo cerbot --apache I was getting this error:
An unexpected error occurred: The server will not issue certificates for the
identifier :: Error creating new order :: Cannot issue for “www.mywebsite”: Domain
name does not end with a valid public suffix (TLD)
To fix this error, I had to add .com to my config file:
… ServerName your_domain.com ServerAlias www.your_domain.com …
Reply
Scientia • January 26, 2022

Thanks, it’s work for me that could select Full(strict) of SSL encryption mode from
cloudflare. I’m not clear on a couple of things that obtaining Lets Encrypt
certificate to my website; Why certificate of my site still sign by cloudflare instead
of lets encrypt?
privacyReply
policy,
onomnet2000 • September 17, 2021

So so helpful …wow am satisfied .thanks Issue resolved !!!
Reply
gabrielgomez19 • September 17, 2021

Works, Thanks very much.
Reply
Load More Comments
This work is licensed under a Creative Commons Attribution-NonCommercial- ShareAlike 4.0

International License.
Try DigitalOcean for free
Click below to sign up and get $200 of credit to try our products over 60 days!
Sign up ->

privacy policy,
Popular Topics
toUbuntu
our use of these technologies, or manage your own preferences.
Linux Basics
JavaScript
React
Python
Security
MySQL
Docker
Kubernetes
Browse all topic tags
Free Managed Hosting ->
All tutorials ->
Questions
Q&A Forum
Ask a question
DigitalOcean Support
GET OUR BIWEEKLY NEWSLETTER

Sign up for Infrastructure as a
Newsletter.
privacy policy,
HOLLIE'S HUB FOR GOOD

Working on improving health and
education, reducing inequality,
and spurring economic growth?
We'd like to help.
BECOME A CONTRIBUTOR
You get paid; we donate to tech
nonprofits.
Featured on Community Kubernetes Course Learn Python 3 Machine Learning in Python

Getting started with Go Intro to Kubernetes
DigitalOcean Products Virtual Machines Managed Databases Managed Kubernetes Block Storage
Object Storage Marketplace VPC Load Balancers
This site uses cookies and related technologies,

Welcome as described in ourcloud
to the developer
privacy policy,
DigitalOcean makes it simple to launch in the

cloud and scale up as you grow – whether you’re
running one virtual machine or ten thousand.
Learn More
Company Products Community Solutions Contact

About Products Tutorials Website Hosting Support
Leadership Overview Q&A VPS Hosting Sales
Blog Droplets CSS-Tricks Web & Mobile Report Abuse
Careers Kubernetes Write for Apps System Status
Customers App Platform DOnations Game Share your ideas
Functions Currents Research Development
Partners Streaming
Channel Cloudways Hatch Startup
Partners Managed Program VPN
Referral Program Databases deploy by
DigitalOcean
SaaS Platforms
Affiliate Program Spaces Shop Swag
Cloud Hosting
for Blockchain
Press Marketplace
Legal Load Balancers Research Program Startup Resources
Block Storage Open Source
Security Code of Conduct
Investor Tools &
Relations Integrations Newsletter Signup
DO Impact API Meetups
Pricing
privacy policy,
Documentation
Release Notes
Uptime
© 2022 DigitalOcean, LLC. All rights

reserved.

privacy policy,

How To Secure Apache With Let's Encrypt On Ubuntu 20.04 - DigitalOcean

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

How To Secure Apache With Let's Encrypt On Ubuntu 20.04 - DigitalOcean

Uploaded by

Copyright:

Available Formats

5/12/22, 22:13 How To Secure Apache with Let's Encrypt on Ubuntu 20.

How To Install Linux, Apache, MySQL, PHP (LAMP) stack on Ubuntu

By Erika Heidi English

Not using Ubuntu 20.04? Ubuntu 20.04

To follow this tutorial, you will need:

Step 1 — Installing Certbot

Step 2 — Checking your Apache Virtual Host

$ sudo systemctl reload apache2 Copy

Your status will now look like this:

You’ll see output like this:

enhanced user experience, or advertising. You may choose to consent

Enabled Apache socache_shmcb module

You should test your configuration at:

- Your account credentials have been saved in your Certbot

Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate

Trigger: Wed 2020-04-29 23:50:31 UTC; 12h left

Apr 28 17:57:48 fine-turtle systemd[1]: Started Run certbot twice daily.

Get Ubuntu on a hosted virtual machine in seconds with DigitalOcean Droplets!

Want to learn more? Join the DigitalOcean

This site uses cookies and related technologies, as described in our

About the authors

Erika Heidi Author

Still looking for an answer?

Ask a question Search for more help

Was this helpful? Yes No

This textbox defaults to using Markdown to format your answer.

rtirtadji • April 30, 2020

sudo add-apt-repository ppa:ahasenack/certbot-tlssni01-1875471

A C • November 12, 2022

Jon Austen • April 28, 2022

Path Dabhi • April 21, 2022

rahulradadiya65 • March 4, 2022

githubbjar • February 11, 2022

Scientia • January 26, 2022

onomnet2000 • September 17, 2021

gabrielgomez19 • September 17, 2021

Load More Comments

This work is licensed under a Creative Commons Attribution-NonCommercial- ShareAlike 4.0

Try DigitalOcean for free

This site uses cookies and related technologies, as described in our

All tutorials ->

GET OUR BIWEEKLY NEWSLETTER

HOLLIE'S HUB FOR GOOD

Featured on Community Kubernetes Course Learn Python 3 Machine Learning in Python

This site uses cookies and related technologies,

DigitalOcean makes it simple to launch in the

Company Products Community Solutions Contact

© 2022 DigitalOcean, LLC. All rights

This site uses cookies and related technologies, as described in our

You might also like