Tutorial

How to Set Up Let’s Encrypt Certificates for Multiple Apache Virtual Hosts on Ubuntu 14.04

Published on January 19, 2016
Default avatar

By Erika Heidi

Developer Advocate

How to Set Up Let’s Encrypt Certificates for Multiple Apache Virtual Hosts on Ubuntu 14.04

Introduction

SSL certificates are used within web servers to encrypt the traffic between server and client, providing extra security for users accessing your application. Let’s Encrypt provides an easy way to obtain and install trusted certificates for free.

This tutorial will show you how to set up TLS/SSL certificates from Let’s Encrypt for securing multiple virtual hosts on Apache, within an Ubuntu 14.04 server.

We will also cover how to automate the certificate renewal process using a cron job.

##Prerequisites

In order to complete this guide, you will need:

It is important that each virtual host is set up in its own separate configuration file, and can be accessed externally via browser. For a detailed guide on how to properly set up Apache virtual hosts on Ubuntu, follow this link.

For the purpose of this guide, we will install Let’s Encrypt certificates for the domains example.com and test.com. These will be referenced throughout the guide, but you should substitute them with your own domains while following along.

When you are ready to move on, log into your server using your sudo account.

##Step 1 — Download the Let’s Encrypt Client

The first step to using Let’s Encrypt to obtain an SSL certificate is to install the certbot software on your server. The Certbot developers maintain their own Ubuntu software repository with up-to-date versions of the software. Because Certbot is in such active development it’s worth using this repository to install a newer Certbot than provided by Ubuntu.

First, add the repository:

  1. sudo add-apt-repository ppa:certbot/certbot

You’ll need to press ENTER to accept. Afterwards, update the package list to pick up the new repository’s package information:

  1. sudo apt-get update

And finally, install Certbot from the new repository with apt-get:

  1. sudo apt-get install python-certbot-apache

The certbot Let’s Encrypt client is now ready to use.

##Step 2 — Set Up the Certificates

Generating an SSL Certificate for Apache using the certbot Let’s Encrypt client is quite straightforward. The client will automatically obtain and install a new SSL certificate that is valid for the domains provided as parameters.

Although it is possible to bundle multiple Let’s Encrypt certificates together, even when the domain names are different, it is recommended that you create separate certificates for unique domain names. As a general rule of thumb, only subdomains of a particular domain should be bundled together.

###Generating the first SSL certificate

We will start by setting up the SSL certificate for the first virtual host, example.com.

We will execute the interactive installation and obtain a bundled certificate that is valid for a domain and a subdomain, namely example.com as base domain and www.example.com as subdomain. You can include any additional subdomains that are currently configured in your Apache setup as either virtual hosts or aliases.

Run the certbot command with:

  1. sudo certbot --apache -d example.com -d www.example.com

Notice that the first domain name in the list of parameters will be the base domain used by Let’s Encrypt to create the certificate, and for that reason we recommend that you pass the bare top-level domain name as first in the list, followed by any additional subdomains or aliases.

For this example, the base domain will be example.com.

After the dependencies are installed, you will be presented with a step-by-step guide to customize your certificate options. You will be asked to provide an email address for lost key recovery and notices, and you will be able to choose between enabling both http and https access or forcing all requests to redirect to https.

When the installation is finished, you should be able to find the generated certificate files at /etc/letsencrypt/live. You can verify the status of your SSL certificate with the following link (don’t forget to replace example.com with your base domain):

https://www.ssllabs.com/ssltest/analyze.html?d=example.com&latest

You should now be able to access your website using a https prefix.

Generating the second SSL certificate

Generating certificates for your additional virtual hosts should follow the same process described in the previous step.

Repeat the certificate install command, now with the second virtual host you want to secure with Let’s Encrypt:

  1. sudo certbot --apache -d test.com -d www.test.com

For this example, the base domain will be test.com.

Again, you can verify the status of your SSL certificate with the following link (don’t forget to replace test.com with your base domain):

https://www.ssllabs.com/ssltest/analyze.html?d=test.com&latest

If you want to generate certificates for additional virtual hosts, simply repeat the process, and don’t forget to use the bare top-level domain as your base domain.

##Step 3 — Set Up Auto-Renewal

Let’s Encrypt’s certificates are only valid for ninety days. This is to encourage users to automate their certificate renewal process. We’ll need to set up a regularly run command to check for expiring certificates and renew them automatically.

To run the renewal check daily, we will use cron, a standard system service for running periodic jobs. We tell cron what to do by opening and editing a file called a crontab.

  1. sudo crontab -e

Your text editor will open the default crontab which is a text file with some help text in it. Paste in the following line at the end of the file, then save and close it:

crontab
. . .
15 3 * * * /usr/bin/certbot renew --quiet

The 15 3 * * * part of this line means “run the following command at 3:15 am, every day”. You may choose any time.

The renew command for Certbot will check all certificates installed on the system and update any that are set to expire in less than thirty days. --quiet tells Certbot not to output information nor wait for user input.

cron will now run this command daily. Because we installed our certificates using the --apache plugin, Apache will also be reloaded to ensure the new certificates are used.

For more information on how to create and schedule cron jobs, you can check our How to Use Cron to Automate Tasks in a VPS guide.

##Conclusion

In this guide, we saw how to install free SSL certificates from Let’s Encrypt in order to secure multiple virtual hosts on Apache. We recommend that you check the official Let’s Encrypt blog for important updates from time to time.

Thanks for learning with the DigitalOcean Community. Check out our offerings for compute, storage, networking, and managed databases.

Learn more about us


About the authors
Default avatar

Developer Advocate

Dev/Ops passionate about open source, PHP, and Linux.

Still looking for an answer?

Ask a questionSearch for more help

Was this helpful?
 
10 Comments


This textbox defaults to using Markdown to format your answer.

You can type !ref in this text area to quickly search our full set of tutorials, documentation & marketplace offerings and insert the link!

The latest version of Letsencrypt seems to have an issue creating a virtual host file for you. If you are affected by this, create an SSL vhost manually first and then run the letsencrypt-auto command again.

Cool! One Question… I have 3 websites under a single domain name, i.e. websiteA.mywebsite.com, websiteB.mywebsite.com and websiteC.mywebsite.com. I have a SSL cert on one of the (websitesWebsiteA.mywebsite.com) already. Will I need to dump that to do the other two?

I followed the instructions and everything works perfect for 3 domains. But how do I change the settings I passed for certbot later, if I need? For example, for one of the domains I set to use both http and https. How do I change that in the future, for this domain redirect all to https, if I need to?

sudo certbot --apache -d test.com -d www.test.com After this I get this error: Unable to find a virtual host listening on port 80 which is currently needed for Certbot to prove to the CA that you control your domain. Please add a virtual host for port 80.

What if you also have a subdomain?

Can i just replace “test.com” with “sub.test.com”?

"We were unable to find a vhost with a ServerName or Address of " Why will it not let me install a second certificate?

thank you.

sudo certbot --apache -d example.com -d www.example.com I finished the SSL installation with this command.

Subsequently, what should I do if I add ‘subdomain.example.com’, which is a subdomain of example.com?

sudo certbot --apache -d example.com ? or sudo certbot --apache -d example.com -d www.example.com -d subdomain.example.com ?

For reference, My Site is WordPress Multi Site.

Hello, I have a system that use simple passwords but i’m using complex passwords on it. After install the certificate "with the second choose to redirect all traffic to HTTPS "the system don’t let me login with any account Anyway to allow http:// access again to be able to log in and change admin password then redirect the traffic again?

Great tutorial! I’m trying to get SSL certs for my subdomain on a WordPress multi-site. When I go through the steps I get to this part and run into trouble with the subdomain:

We were unable to find a vhost with a ServerName or Address of beta.example.com. Which virtual host would you like to choose? (note: conf files with multiple vhosts are not yet supported)

1: example.com.conf | Multiple Names | | Enabled 2: 000-default.conf | | | Enabled 3: default-ssl.conf | | HTTPS |

Select the appropriate number [1-3] then [enter] (press ‘c’ to cancel): 1 Waiting for verification… Cleaning up challenges Created an SSL vhost at /etc/apache2/sites-available/example.com-le-ssl.conf Deploying Certificate for example.com to VirtualHost /etc/apache2/sites-available/example.com-le-ssl.conf Enabling available site: /etc/apache2/sites-available/example.com-le-ssl.conf Deploying Certificate for www.example.com to VirtualHost /etc/apache2/sites-available/example.com-le-ssl.conf

We were unable to find a vhost with a ServerName or Address of beta.example.com. Which virtual host would you like to choose? (note: conf files with multiple vhosts are not yet supported)

1: example.com.conf | Multiple Names | | Enabled 2: 000-default.conf | | | Enabled 3: default-ssl.conf | | HTTPS | 4: example.com-le-ssl.conf | Multiple Names | HTTPS | Enabled

Select the appropriate number [1-4] then [enter] (press ‘c’ to cancel): 1 The selected vhost would conflict with other HTTPS VirtualHosts within Apache. Please select another vhost or add ServerNames to your configuration. VirtualHost not able to be selected.

Did I configure my DNS wrong or do I need to create a new vhost just for the multisite subdomain?

I am getting the following error after executing :

$ certbot-auto --apache -d example.com -d www.example.com

Failed to find apache2ctl in PATH: /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin The apache plugin is not working; there may be problems with your existing configuration. The error was: NoInstallationError(‘Cannot find Apache control command apache2ctl’,)

Does anyone else gets this or did I do something wrong?

Try DigitalOcean for free

Click below to sign up and get $200 of credit to try our products over 60 days!

Sign up

Join the Tech Talk
Success! Thank you! Please check your email for further details.

Please complete your information!

Get our biweekly newsletter

Sign up for Infrastructure as a Newsletter.

Hollie's Hub for Good

Working on improving health and education, reducing inequality, and spurring economic growth? We'd like to help.

Become a contributor

Get paid to write technical tutorials and select a tech-focused charity to receive a matching donation.

Welcome to the developer cloud

DigitalOcean makes it simple to launch in the cloud and scale up as you grow — whether you're running one virtual machine or ten thousand.

Learn more
DigitalOcean Cloud Control Panel