Let's Encrypt
Let's Encrypt is a free, automated, and open certificate authority - if you want to learn more, you can visit letsencrypt.org, but in this blog post I'm going to break down how to actually issue the certificate.
A Few Assumptions
- You have a server to host your website - I'm using Linode for this simply because I found a discount code online (hey man, it still works oK)
- You have a domain you can use - in my case, this was the subdomain cryptic-one.nandanv.com
- You can SSH into your server
How To
Here's the steps to issue an SSL certificate on your server using Let's Encrypt
Point Your Subdomain to the Server's IP
- Go to DNS Management Portal (Route53 DNS Management if you're using AWS)
- Create an
A record
- Record Name:
YOUR_SUBDOMAIN
- Record Type:
A
- Value:
YOUR_SERVER_IP_ADDRESS
This ensures that when a user visits YOUR_SUBDOMAIN.YOUR_DOMAIN.COM, the IP address resolves to YOUR_SERVER_IP_ADDRESS. This helps you prove to Let's Encrypt that you own the domain and the server that you're requesting the certificate on.
Install Certbot
According to their website,
Certbot is a free, open source software tool for automatically using Let’s Encrypt certificates on manually-administrated websites to enable HTTPS.
The following command installs Certbot:
apt install certbot
We can now use this utility to install a Let's Encrypt certificate on our machine.
Issue the Certificate
certbot certonly --standalone -d YOUR_DOMAIN
certbot certonly --webroot -d YOUR_DOMAIN
The former command starts up a temporary webserver on port 80 in order to verify ownership of the domain / subdomain, so if you already have a webserver running, use the latter command.
Use the Certificates
Once you run the commands, Certbot will generate an SSL certificate and an SSL certificate private key, providing links for the same which you can use to configure HTTPS on your website.
const privKey = fs.readFileSync('/etc/letsencrypt/live/cryptic-one.nandanv.com/privkey.pem', 'utf-8')
const certificate = fs.readFileSync('/etc/letsencrypt/live/cryptic-one.nandanv.com/fullchain.pem', 'utf-8')
const credentials = { key: privKey, cert: certificate }
const httpsServer = https.createServer(credentials, app)
httpsServer.listen(port, () => console.log(`server active on port ${port}`))
It may be necessary to restart your server once the certificates have been generated. If you're running Ubuntu, you can use the following command
reboot now
If everything worked out just fine, you should see a 🔒 when you visit your domain.
Congrats 🍻 🎆
Redirect HTTP to HTTPS
Conventionally, we run HTTP on port 80 and HTTPS on port 443. The app I set up is quite simple and listens on port 80 and port 443, forwarding all port 80 requests (http) to port 443 (https). Here's the code that makes that happen
const httpApp = express()
.all('*', (req, res) => res.redirect(300, `https://cryptic-one.nandanv.com}`))
const httpServer = http.createServer(httpApp)
httpServer.listen(80, () => console.log('listening for http'))
If you want to learn more about SSL/TLS and why it's used, check out my previous post!
