Skip to content

Commit d305e1b

Browse files
ThatGuyJacobeefgalz
ThatGuyJacobee
and
fgalz
authored
New Proxy Guides, Tweaks & Refactored Welcome Page (#1349)
* refactor: factorio mods guide * fix: heading tag types * feat: fivem proxy guides * feat: sync welcome page games & fix low quality imgs * feat: collapsible cards (for welcome games section) * refactor: improve code * tweak: welcome cards * tweak: prioritise important games & tweaks * tweak: added factorio space age dlc video * feat: linux proxy & certbot guides * refactor: improvements to fivem proxy guide * tweak: change to direct urls & sync DE page * Small corrections and improvements to the text Minor corrections regarding spelling and grammatical errors and additions to the text. * Adjusted collapse button text color to the uniform standard * refactor: certbot guide w/standalone options * We still don't like "Leitfaden" --------- Co-authored-by: fgalz <[email protected]>
1 parent 214c55c commit d305e1b

18 files changed

+2296
-61
lines changed

‎docs/dedicated-linux-certbot.md‎

Lines changed: 206 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,206 @@
1+
---
2+
id: dedicated-linux-certbot
3+
title: "Dedicated Server: Installation of Certbot"
4+
description: Information on how to setup Certbot on your Linux Dedicated Server from ZAP-Hosting - ZAP-Hosting.com documentation
5+
sidebar_label: Install Certbot
6+
services:
7+
- dedicated
8+
---
9+
10+
import Tabs from '@theme/Tabs';
11+
import TabItem from '@theme/TabItem';
12+
import InlineVoucher from '@site/src/components/InlineVoucher';
13+
14+
## Introduction
15+
16+
SSL Certificates are essential parts of the internet, ensuring that data can be safely transmitted between client and host. In this guide, we will explore the process of setting up the open-source [**Certbot**](https://certbot.eff.org/) tool to request free SSL certificates from the **Let's Encrypt** non-profit certificate authority.
17+
18+
<InlineVoucher />
19+
20+
## Preparation
21+
22+
In order to make use of Certbot, you will require a Linux VPS and a **Domain** that you own. You need to have access to the DNS Settings of the Domain and you **must** create an `A` DNS record poitning at the IP Address of your __Linux VPS__ for each root domain or sub domain you plan to use.
23+
24+
Certbot also had additional plugins which allows you to easily "one-click" setup a certificate for a domain which works with a variety of web servers such as Nginx or Apache. We recommend using Nginx as it is a highly performant and popular open-source web server. See our [Linux Proxy](dedicated-linux-proxy.md) guide for help setting this up.
25+
26+
## Installation
27+
28+
Begin by installing the open-source [**Certbot**](https://certbot.eff.org/) package, which you will be using to request free SSL certificates from **Let's Encrypt**.
29+
30+
```
31+
sudo apt install certbot python3-certbot-nginx
32+
```
33+
34+
With Certbot now installed, you can proceed to request certificates for your domain(s). Let's Encrypt and Certbot provide a variety of ACME Challenges to verify ownership of the domain.
35+
36+
We highly recommend using the default **HTTP-01** method because it allows for automatic renewal. However, if you are facing issues with this, you can attempt to use the **DNS-01** method as an alternative which is manual and does not support automatic renewals as it relies on verifying using a **TXT** DNS record.
37+
38+
:::tip Utilise Web Server Plugins
39+
For readers using a web server such as Nginx, Apache or their own web server, we recommend moving to the **Web Server Plugins** section below which shows how to utilise additional Certbot plugins for these web servers to utilise a "one-click" install setup as well as request certificates without the need to turn off the web server.
40+
:::
41+
42+
### HTTP-01 Challenge
43+
44+
With Certbot now installed, you can now request certificates for your domain(s). In this example, we will be using standalone mode which means that Certbot will start a temporary web server for you to perform the necessary actions. This means that you must open port 80 in your firewall rules and not have any existing web servers or services running on port 80 to allow the temporary web server to start and allow the challenge to be fetched (hence the `HTTP` in the name of the challenge).
45+
46+
In the following command, you will utilise the `--standalone` parameter to inform Certbot that you wish to use the temporary web server option.
47+
48+
```
49+
# For Root Domains
50+
certbot certonly --standalone -d [your_root_domain] -d www.[your_root_domain]
51+
52+
# For Sub-Domains
53+
certbot certonly --standalone -d [your_domain]
54+
55+
# Interactive Setup
56+
certbot certonly --standalone
57+
```
58+
59+
Once the command is ran, you may be required to follow a first-time interactive setup which will ask you to input an email address to be used for certificate communication followed by an optional mailing list and the terms & conditions which you must accept.
60+
61+
Certbot will now generate an ACME Challenge and host it using the temporary webserver. The Let's Encrypt servers will then attempt to fetch this from your server and upon success the certificates will be created and saved at the `/etc/letsencrypt/live/[your_domain]` path.
62+
63+
![](https://screensaver01.zap-hosting.com/index.php/s/7oGcQotKaowaDzM/preview)
64+
65+
You can now utilise the SSL Certificates where ever you need simply by providing the local path to the certificates.
66+
67+
### TXT DNS Record
68+
69+
If you are facing difficulties or troubles with verifying your domain through the **HTTP-01** method, as an alternative you can attempt to use the **DNS-01** method which involves creating a **TXT** DNS record with a value provided by Let's Encrypt.
70+
71+
As previously mentioned, this method does **not** support automatic renewal unless you setup your own infrastructure to manage this. Thus, it is highly recommended to use the **HTTP-01** method where possible.
72+
73+
In the following command, you will utilise the `--preferred-challenges` parameter to inform Certbot that you wish to use the `DNS-01` method.
74+
75+
```
76+
# For Root Domains
77+
certbot certonly --preferred-challenges dns-01 -d [your_root_domain] -d www.[your_root_domain] --manual -m [your_root_domain] -m www.[your_root_domain]
78+
79+
# For Sub-Domains
80+
certbot certonly --preferred-challenges dns-01 -d [your_domain] --manual -m [your_domain]
81+
82+
# Interactive Setup
83+
certbot certonly --preferred-challenges dns-01
84+
```
85+
86+
Once the command is ran, you may be required to follow a first-time interactive setup which will ask you to input an email address to be used for certificate communication followed by an optional mailing list and the terms & conditions which you must accept.
87+
88+
Certbot will now provide you with instructions on creating a **TXT** DNS record with a specific value that you must use. The target will typically be `_acme-challenge.` prefixed to your domain (in this example, it would be `_acme-challenge.zapdocs.example.com`) and the value it should be set to will be provided in the console.
89+
90+
Once you have created the record, press enter to continue. If everything is correct and propegated, the certificates will be created and saved at the `/etc/letsencrypt/live/[your_domain]` path.
91+
92+
:::note
93+
Please be patient as DNS Record changes may take some time to propegate. This should typically occur within minutes, but on rare occurances it could take longer.
94+
:::
95+
96+
You can now utilise the SSL Certificates where ever you need simply by providing the local path to the certificates.
97+
98+
## Web Server Plugins
99+
100+
Certbot contains a range of different additional web server plugins which makes it even simpler to manage certificates as the plugins automatically edit the relevant server blocks for you. To use a plugin, you simply have the add the relevant parameter to your `certbot` command.
101+
102+
Both of these methods utilise the **HTTP-01** challenge and work in essentially the same manner. When one of the plugins is used, Certbot will first search for the relevant server block that includes the requested domain as the `server_name` parameter. Once found, Certbot will generate an ACME Challenge and add a temporary `location /.well-known/acme-challenge/...` location block to the relevant server block config.
103+
104+
The Let's Encrypt servers will then attempt to fetch this from your server and upon success your certificate will be generated and your Nginx server block configuration will be automatically edited to adjust to using HTTPS (port 443) and to add paths to the newly generated certificate.
105+
106+
<Tabs>
107+
<TabItem value="nginx" label="Nginx" default>
108+
109+
### Nginx Plugin
110+
111+
To make use of the Nginx plugin, you should use the `--nginx` parameter within your command as following.
112+
113+
```
114+
# For Root Domains
115+
certbot --nginx -d [your_root_domain] -d www.[your_root_domain]
116+
117+
# For Sub-Domains
118+
certbot --nginx -d [your_domain]
119+
120+
# Interactive Setup
121+
certbot --nginx
122+
```
123+
124+
:::tip
125+
If you wish to disable automatic "one-click" server block adjustments from Certbot, you can include `certonly` parameter within the command such as `certbot certonly`.
126+
:::
127+
128+
</TabItem>
129+
130+
<TabItem value="apache" label="Apache">
131+
132+
### Apache Plugin
133+
134+
To make use of the Nginx plugin, you should use the `--apache` parameter within your command as following.
135+
136+
```
137+
# For Root Domains
138+
certbot --apache -d [your_root_domain] -d www.[your_root_domain]
139+
140+
# For Sub-Domains
141+
certbot --apache -d [your_domain]
142+
143+
# Interactive Setup
144+
certbot --apache
145+
```
146+
147+
:::tip
148+
If you wish to disable automatic "one-click" server block adjustments from Certbot, you can include `certonly` parameter within the command such as `certbot certonly`.
149+
:::
150+
151+
</TabItem>
152+
153+
<TabItem value="webroot" label="Webroot">
154+
155+
### Webroot Plugin
156+
157+
If you are running your own local web server that doesn't use traditional software, you may wish to use the webroot method to use your own web server without being forced to stop it.
158+
159+
To make use of the Webroot plugin, you should use the `--weboot` parameter within your command as following. You will also need to include a `-w [your_webserver_path]` (short for `--webroot-path`) which is the path to the top-level directory of your web server.
160+
161+
```
162+
# For Root Domains
163+
certbot --webroot -w [your_webserver_path] -d [your_root_domain] -d www.[your_root_domain]
164+
165+
# For Sub-Domains
166+
certbot --webroot -w [your_webserver_path] -d [your_domain]
167+
168+
# Interactive Setup
169+
certbot --webroot -w [your_webserver_path]
170+
```
171+
172+
:::tip
173+
One of thse most common web root location is `/var/www/html`. You could also do this for web servers such as Nginx or Apache in cases where you wish to utilise the web server, without having automatic server block adjustments like the native plugins provide.
174+
:::
175+
176+
</TabItem>
177+
</Tabs>
178+
179+
## Automatic Renewal
180+
181+
In most cases, Certbot should automatically setup certificate renewal for you through the use of cronjob and/or systemd timer. You can confirm this by running the following command which utilises the `--dry-run` parameter to test the process.
182+
```
183+
certbot renew --dry-run
184+
```
185+
186+
:::tip
187+
As previously mentioned, the **DNS-01** method does not support automatic renewal via Certbot, unless you setup your own infrastructure to manage this. Thus, it is highly recommended to use the **HTTP-01** method.
188+
:::
189+
190+
This should be successful if everything is as expected. If you wish to view or make changes to the automatic renewal, the command will be found in one of the following locations: `/etc/crontab/`, `/etc/cron.*/*` or via `systemctl list-timers`.
191+
192+
### Manual Cronjob Setup
193+
194+
If for some reason automatic renewal is not setup for you, you can add this yourself via cronjob. Open the crontab menu using `crontab -e`. If this is your first time doing this, you may be prompted to select an editor. Select the first option which should be `/bin/nano`.
195+
196+
With the file now open in nano, simply add the following line to run the renewal every day at 6am local time.
197+
198+
```
199+
0 6 * * * certbot renew
200+
```
201+
202+
Save the file and quit nano by using `CTRL + X`, followed by `Y` to confirm and lastly `ENTER`.
203+
204+
## Conclusion
205+
206+
You have successfully setup Certbot for your domain(s) through a variety of methods including standalone, web root or via one of the plugins, providing your website with secure data transmission via HTTPS. For further questions or assistance, please don’t hesitate to contact our support team, which is available daily to assist you! 🙂

0 commit comments

Comments
 (0)