Install Let’s Encrypt SSL on Ubuntu with OpenLiteSpeed and Automatic Renewal

Introduction to Let’s Encrypt SSL

Let’s Encrypt is an open, automated certificate authority that provides free TLS/SSL certificates for the public’s benefit. The service is provided by the Internet Security Research Group (ISRG). This guide will show you how to install a Let’s Encrypt SSL certificate on an Ubuntu 20.04 server with OpenLiteSpeed (~Apache) using the Certbot installer. After completing this guide, your server will have a valid certificate and redirect all HTTP requests to HTTPS.

Prerequisites for Installing Let’s Encrypt SSL

Let’s Encrypt SSL: This guide assumes that you have deployed an Ubuntu server from Vultr with OpenLiteSpeed or Apache, a domain pointing to the server’s IP address, and that you are logged in as root.

Install Certbot: Let’s Encrypt SSL

Installing Let’s Encrypt SSL: The recommended method for installing Certbot is using Snap.

Verify that snapd is up to date.

$ sudo snap install core; sudo snap refresh core

Remove certbot-auto and any other Certbot packages already present on your operating system.

$ sudo apt-get remove certbot

Install Certbot with Snap.

$ sudo snap install --classic certbot

Symlink Certbot to /usr/bin.

$ sudo ln -s /snap/bin/certbot /usr/bin/certbot

Choose how you want to run Certbot:

Do you agree to temporarily take your website offline?

Yes, my web server is not currently running on this machine.
Stop your web server, then run this command to obtain a certificate. Certbot will temporarily start a web server on your machine.

$ sudo certbot certonly --standalone

No, I need to keep my web server running.
If you have a web server using port 80 and do not want to stop it while Certbot runs, execute this command and follow the instructions in the terminal.

$ sudo certbot certonly --webroot

To use the webroot plugin, your server must be configured to serve files from hidden directories. If /.well-known is handled specially in your web server configuration, you may need to modify the configuration to ensure that the files inside /.well-known/acme-challenge are served by the web server.
Important note

Installing your certificate

You need to install the new certificate in your web server’s configuration file.

Check Let’s Encrypt SSL automatic renewal

The Certbot packages on your system include either a cron job or a timer system systemd that will automatically renew your certificates before they expire. You will not need to run Certbot again unless you change the configuration. You can test automatic renewal for your certificates by running this command:

$ sudo certbot renew --dry-run

The certbot renewal command is installed in one of the following locations:

/etc/crontab/ ;/etc/cron.*/* ;systemctl list-timers

If automatic renewal fails, check the automatic renewal request at /etc/letsencrypt/renewal/domain.com.conf to see whether it has been configured correctly (example below).

renew_before_expiry = 30 days
version = 2.9.0
archive_dir = /etc/letsencrypt/archive/saibabc.com
cert = /etc/letsencrypt/live/saibabc.com/cert.pem
privkey = /etc/letsencrypt/live/saibabc.com/privkey.pem
chain = /etc/letsencrypt/live/saibabc.com/chain.pem
fullchain = /etc/letsencrypt/live/saibabc.com/fullchain.pem
Options used in the renewal process
[renewalparams]
account = 56bb8680ab21b3db38f6d756e69139be
authenticator = webroot
webroot_path = /var/www/html/saibabc.com
server = https://acme-v02.api.letsencrypt.org/directory
key_type = ecdsa
[[webroot_map]]
saibabc.com = /var/www/html/saibabc.com
www.saibabc.com = /var/www/html/saibabc.com

Confirm that Certbot is working

To confirm that your website has been set up correctly, visit https://yourwebsite.com/ in a browser and look for the padlock icon in the URL bar.

Congratulations, you have completed the installation of Let’s Encrypt SSL with automatic renewal before expiration.