4. Change to SSL

4.1. Intro

At some point in time, you will want to upgrade your web server to SSL. This is how I did it.

4.2. Let's encrypt

The certificate-part is taken from https://www.pestmeester.nl/index.html#10.0 and adapted to my situation.

Certbot or Let's Encrypt is not natively compiled in Raspbian. So we will have to install it manually. First, install GIT:

sudo apt-get install git

Next get a clone of Let's Encrypt.

sudo git clone https://github.com/certbot/certbot /etc/letsencrypt

Now we're going to get those certificates. I run a single domain on my server, ljm.name The first time you apply for a certificate, you'll get an account. The next time you apply for new certificates, they will just be added to the same account.

For my domain I got 1 certificate: ljm.name

sudo /etc/letsencrypt/certbot-auto certonly --agree-tos --webroot -w /links/www -d ljm.name

Follow the instructions, especially the first time to create the account (by filling out email, password, agree with TOS, etc.).

After successful validation and installation you should see the message:

Congratulations! Your certificate and chain have been
saved at /etc/letsencrypt/live/mysite.com/fullchain.pem.
Your cert will expire on 2017-05-09.
To obtain a new or tweaked version of this certificate in
the future, simply run certbot-auto again. To
non-interactively renew *all* of your certificates,
run "certbot-auto renew"

Create a cronjob to automate certificate renewal

sudo crontab -e

0 6 * * * /etc/letsencrypt/certbot-auto renew --text >> /etc/letsencrypt/certbot/certbot-cron.log

This cron job runs daily, but the certificate is only renewed if it is less than 30 days until expiry.

4.3. Apache

Apache has always been a PITA to configure, and enabling SSL is no exception to that. First, under /etc/apache2/sites-available create a copy of default-ssl and name it ssl.

In ssl I set the following:

        ServerAdmin webmaster@localhost

        DocumentRoot /room/sda1/www/html
        
                Options FollowSymLinks
                AllowOverride None
        
        
                Options Indexes FollowSymLinks MultiViews
                AllowOverride None
                Order allow,deny
                allow from all
        
        ErrorLog ${APACHE_LOG_DIR}/error.log

        LogLevel warn

        CustomLog ${APACHE_LOG_DIR}/ssl_access.log combined
        SSLEngine on

        SSLCertificateFile    /etc/letsencrypt/live/ljm.name/cert.pem
        SSLCertificateKeyFile /etc/letsencrypt/live/ljm.name/privkey.pem
        SSLCertificateChainFile /etc/letsencrypt/live/ljm.name/fullchain.pem
        BrowserMatch "MSIE [17-9]" ssl-unclean-shutdown

Make a link in /etc/apache2/sites-enabled reload apache and ...

Nothing.

netstat -an does not give port 443 as LISTEN. No log records to help, starting in debug mode doesn't give additional information, just nothing. So,...

First thing is to enable the apache SSL module. The fact that this module is a standard part of the distribution, and that Apache recommends using SSL doesn't mean that the SSL module is enabled by default. Sigh..

a2enmod ssl

reload apache and ...

Nothing.

Remove 000-default Reload apache and suddenly it starts working. However, now my http site is gone. ls -s ../sites-available/default http solves that problem. Apparently, 000-default prevents other sites from being enabled.

4.4. note

Raspberry Pi is a trademark of the Raspberry Pi Foundation.