How to Install an SSL Certificate on Rocky Linux (from Let’s Encrypt)

in this video i’m going to show you how to install a free ssl certificate for a website on rocky linux that is running on top of an nginx web server and the way we’re going to do this is with certbot which automatically issues free ssl certificates from let’s encrypt so that might sound like a lot but it’s actually pretty straightforward to do and that’s what i’m going to show you how to do so let’s go ahead and do it i’m logged into the server that’s associated with tony’s store tony’s dot store and that’s right here it’s only on http right now if i try to go to https colon slash tony store it’s not going.

What We’re Going to Do Is Use The

to work right there’s no ssl certificate on this server and just to prove that it is running engine next we will go to tools site health info and server and you’ll see that the web server is nginx so let’s go ahead and install an ssl certificate i’m logged in here and what we’re going to do is use the dnf package manager to install something called epel dash release and that stands for extra packages for enterprise linux so it’s not big at all we will type why hit enter to install that and after that’s done we’re going to do a proper dnf upgrade which depending on how recently you’ve done that this shouldn’t take too long.

upgrade it’ll just go ahead and look at the epel repo and do what it needs to do for that so let’s just fast forward through this okay and now that that is installed we will install a package manager called snap and we’re going to use snap to install sirpod so the reason we’re kind of doing this setting it up in this way is because when you use snap to install certbot and issue your ssl certificate it will automatically renew it for you every three months and that’s very important this is kind of like a set it and forget it kind of thing so let me show you how that works so let’s go ahead and.

do dnf install snap d and that’ll be 21 megabytes so type y hit enter and that is indeed looking at the extra packages for enterprise linux so we will say y hit enter and now that snap is installed let’s enable it with system ctl enable dash dash now snap d dot socket okay so there’s a couple other configuration steps we have to go through before um getting certbot and the first is creating a symbolic link from var lib snap d slash snap to slash snap and the next is snap install core okay and finally snap refresh core okay no updates available that’s good we can go ahead and continue so let’s get certbot finally snap.

Link from Snap Bin Cert Pot to User

install dash dash classic cert bot hit enter and finally once that’s installed let’s create a symbolic link from snap bin cert pot to user bin certbot and let’s go ahead and issue ourselves an ssl certificate so my my ssl configure mic you can my nginx configuration file exists at the let’s just take a look at the etc nginx conf d directory and in here there’s a file called wordpress.com and um oops there’s no vim text editor on this system we’ll just use vi um in here i have my server name as tony store in www tony store so certbot is going to look at your configuration files for any domain names and i just want.

to make sure that you have that set up properly for your configuration for your domain name anyway let’s go ahead and do cert bot dash dash nginx and it’s going to go ahead and read those configuration files in the compd directory or maybe you have a site’s available directory and it would help if i uh spelled nginx right so nginx like that so certbot dash dash nginx and it’s asking for an email for renewal notifications so tony teaches tech gmail.com do you agree to the terms and service type y hit enter do you want to receive additional emails i’m going to say no hit enter and it did read our nginx configuration file and it.

found tony’s store and www.tonystore i want an ssl for both of those so i’m going to as it says here leave input blank to select all options shown so i’m just going to say enter and now it’s requesting a certificate for tony’s store in www.tonys.store all right so the certificate was successfully issued the actual based on this configuration file the actual certificate is at this location on our system and the key is at this location and i just want to show you if we go back to the configuration file that it modified it it added this section down here listen 443 that’s the ssl port so all of this is added which points to our.

And Our Certificate and Then It Took Care

key our key and our certificate and then it took care of redirecting from not from www to non-www and from unsecured to secure so you can see that all happening here automatically for us at this point um let’s go to our web server and or our website i should say in a web browser and refresh the page to see if we are loading the ssl certificate and we see the lock icon here which is great that means we have a secure connection if we want to look at the certificate we can do that right here so if you look under trust or the details we’ll see that this is indeed a let’s encrypt certificate and.

it will expire in three months from now i’m going to show you how to verify that your certificate will automatically renew after that expiration date or actually before that expiration date but first if you are on wordpress make sure you go into your wordpress admin dashboard let me log in here and in here i just want to make sure that you update your urls so if you go to settings general make sure you have http s for your wordpress address and your site address so we’ll save those changes and then you should be good to go so anytime somebody goes to your website if they go to www.tonys.store they’ll be redirected to tonys.store and if.

Here Is Snap Cert Bot Renew Timer And

they go to http tonys.store they’ll be redirected to the secure version of that now like i promised i want to show you how you can verify that your certificate is going to automatically renew and we can look at the system ctl list timers and you’ll see here let me make this actually a lot bigger and re-execute that command so system ctl list timers you’ll see that one of our timers here is snap cert bot renew timer and that’s kind of why we went through that whole process of installing snap package manager because this will in two hours in fact check to see if we need a certificate renewal and if we do it will execute.

the this file right here so if you look at etc systemd system snap certbot renew service which is directly corresponding to this and the timer with that is here let’s see what it does so that is going to execute everything at exe start and it’s going to run user bin snap and the cert bot renew argument so snap run with this timer serb bot renew and we can also look at the renew timer as well and that is going to happen every day at server time around 117 and at 1942 so you don’t have to understand all that just know that if that if those files are in place and when you check the um.

Worry About Ssl Certificates Anymore Okay

list timers and you have the snapserbot renew timer then you’re good to go you shouldn’t have to worry about ssl certificates anymore okay i want to thank you guys for watching i have a lot more videos for you to check out and thank you for watching subscribe i’ll see you in the next one [Music] you.