Security (HTTPS)

HTTPS

SSL certificate obtained through Let's Encrypt. Let's Encrypt is a cert authority who provides free HTTPS certificates. Certbot is Let's Encrypt's Client that makes managing certs easier.

Generate & Install HTTPS certificates:

Assumes NGINX + Ubuntu 14.04
Based on medium.freecodecamp.org

1. Open up ports 80 (HTTP) and 443 (HTTPS) in your AWS instance Security Group

2. Point domain at EC2 public DNS of Instance

3. Run the following:

wget https://dl.eff.org/certbot-auto
chmod a+x certbot-auto
cd /home/ubtuntu

4. Run the following replacing www.hoonahstewards.net if needed and as many times as needed for additional certs:

./certbot-auto certonly --standalone -d www.hoonahstewards.net

5. Change your NGINX configuration by adding

server {
    listen 443 ssl;
    server_name www.hoonahstewards.net;
    ssl_certificate /etc/letsencrypt/live/www.hoonahstewards.net/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/www.hoonahstewards.net/privkey.pem;
    add_header Strict-Transport-Security “max-age=31536000”;
}

6. Restart NGINX

sudo service nginx reload

7. Set up CRON job to renew cert, because certs obtained through let's encrypt expire every 3 months

Renew HTTPS certificates manually:

If cert won't renew see https://github.com/certbot/certbot/issues/5405#issuecomment-356498627

Assumes NGINX + Ubuntu 14.04 on AWS

The cert uses the 'standalone' installation plugin. Because of this the ports :80 and :443 must be available for the renew to work. When the AWS instance for Hoonah is running nginx is listening on ports :80 and :443. One option to stop nginx from listening during the renew process is:

1. ssh into Hoonah AWS
2. vim /etc/nginx/sites-enabled/hoonah
3. comment out the lines for listening on ports :80 and :443
4. write and quit
5. cd ~/
6. ./certbot-auto renew --dry-run if the dry run is without error then ./certbot-auto renew
7. vim /etc/nginx/sites-enabled/hoonah
8. uncomment the listening lines for ports :80 and :443
9. restart nginx server

HTTPS cert should be updated to auto-renew and use 'webroot' plugin instead of 'standalone'