Thorn Tech Marketing Ad
Skip to main content
Version: 1.1.1

LetsEncrypt SSL Certificate

Overview​

StorageLink comes with a Web interface for connecting to Cloud Storage and for managing Users & settings. This website is hosted on a local web server (Nginx).

The website uses a self-signed SSL certificate. This protects your web traffic out of the box. However, you will encounter SSL warnings each time you visit the site.

If you don't want invalid SSL certificate warnings, you will need to obtain a valid SSL certificate.

Using LetsEncrypt​

The best free approach is to use LetsEncrypt, which provides free SSL certificates. These are Domain Validation (DV) level certs.

This article covers how to set up LetsEncrypt on StorageLink & provides step-by-step instructions for the initial configuration.

Preparation​

(1) In the AWS console, verify that you have an Elastic (static) IP. Our CloudFormation templates provision one automatically.

(2) Create a DNS entry (Host A record), which points your domain name to the public IP address of your server. Allow some time for DNS to propagate.

Note: For HA, you don't need static IPs. Instead, create a CNAME that points to the load balancer's DNS endpoint.

(3) Create an ingress rule in the EC2 Security Group to allow TCP port 80 traffic from 0.0.0.0/0. This is required for the validation step.

(4) SSH into your VM, and elevate your privileges to root:

sudo su

(5) Set the domain name on your Nginx conf file.

Edit /etc/nginx/conf.d/website.conf line 80, and replace the wildcard _ with your domain name. For example:

server_name robtest.thorn.tech;

(6) Restart Nginx to apply this change.

nginx -t && service nginx restart

Certbot installation​

On StorageLink, LetsEncrypt is already installed on the server. To verify, run the following command:

certbot --version

Run the certbot wizard​

After you have run the above commands to install LetsEncrypt, you can generate the SSL certificate.

(1) Run this command:

certbot

You will be taken through an interactive wizard.

(2) Enter a valid email address:

Saving debug log to /var/log/letsencrypt/letsencrypt.log
Enter email address (used for urgent renewal and security notices)
 (Enter 'c' to cancel): robert.chen@thorntech.com

(3) Agree to the Terms of Service:

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Please read the Terms of Service at
https://letsencrypt.org/documents/LE-SA-v1.3-September-21-2022.pdf. You must
agree in order to register with the ACME server. Do you agree?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: Y

(4) You don't need to share your email.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Would you be willing, once your first certificate is successfully issued, to
share your email address with the Electronic Frontier Foundation, a founding
partner of the Let's Encrypt project and the non-profit organization that
develops Certbot? We'd like to send you email about our work encrypting the web,
EFF news, campaigns, and ways to support digital freedom.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: N

(5) Select your domain. If it doesn't show up on the list, check your /etc/nginx/conf.d/website.conf file for the server_name directive.

Which names would you like to activate HTTPS for?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
1: robtest.thorn.tech
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Select the appropriate numbers separated by commas and/or spaces, or leave input
blank to select all options shown (Enter 'c' to cancel): 1

(6) LetsEncrypt will try to validate your server.

Requesting a certificate for robtest.thorn.tech
Performing the following challenges:
http-01 challenge for robtest.thorn.tech
Using default addresses 80 and [::]:80 ipv6only=on for authentication.
Waiting for verification...
Cleaning up challenges
Deploying Certificate to VirtualHost /etc/nginx/conf.d/website.conf
No matching insecure server blocks listening on port 80 found.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Congratulations! You have successfully enabled https://robtest.thorn.tech
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Validation and Cleanup

Verify that it works by navigating to your domain via your web browser using HTTPS.

If all is well, you should see a valid SSL certificate.

On your EC2 Security Group, don't forget to remove the ingress rule for TCP 80 that allows traffic from 0.0.0.0/0.

Automatic renewal​

The LetsEncrypt SSL certificate only lasts 90 days, so it requires periodic renewal.

To renew the SSL cert, you can run the command:

certbot renew

This will ask you a series of questions in order to renew your existing SSL certificates.

info

You will not be eligible for renewing the SSL cert until you are within 30 days of expiration. This is to prevent LetsEncrypt from being inundated with daily renewal scripts.

To automate the LetsEncrypt renewal, you can create a cron job:

crontab -e
info

AL2023 no longer ships with crontab by default. So, if you're on AWS, to install crontab you would use this command:

yum install cronie

And add this line of text:

0 4 2 * * /usr/bin/certbot renew --quiet >/dev/null 2>&1

This runs the certbot renew command non-interactively once a month at 4am on the second day of every month.

Remember that in order to renew the cert, letsEncrypt needs to access the server over port 80 or via HTTP. So, if port 80 is locked down by default, you'd need to open it up temporarily when the cron job runs, or the cert won't be renewed since it can't be validated from the letsEncrypt servers.

Troubleshooting​

In some cases, certbot will overwrite the website.conf file with their own configuration. Since StorageLink relies on this config file to access the Web Interface on HTTPS, this can lock you out of the Web Interface.

Below, is an example of what a normal website.conf looks like for StorageLink after adding an SSL Cert. Feel free to use this file to replace the conf file added by certbot. The only values that need to be changed are on lines 42, 43 and 80 where the website name (bryce.sftpgw.cloud in this example) is located.

So, when using this conf file, make sure to replace bryce.sftpgw.cloud with your own website name.

server {
  listen 80;
  listen [::]:80;

  server_name _;

  # landing page resources
  # match on any assets used by the static landing page
  location ~* /(index.html|config/|css/|js/|images/) {
    try_files $uri $uri/ /index.html?$args;
  }

  # redirect "Click here" to the web admin portal
  if ($request_uri = /admin) {
    return 301 https://$host;
  }

  index index.html index.htm;
  root /usr/share/nginx/ui-landing/;
  rewrite  ^/$  /index.html  permanent;
}

log_format  with_user_combined  '$remote_addr - $http_x_username [$time_local] "$request" '
  '$status $body_bytes_sent "$http_referer" '
  '"$http_user_agent" "$http_x_forwarded_for"';

server {
  listen *:443 ssl http2;
  listen [::]:443 ssl http2;

  access_log  /var/log/nginx/access.log  with_user_combined;

  # Enable HSTS. This forces SSL on clients that respect it, most modern browsers. The includeSubDomains flag is optional.
  add_header Strict-Transport-Security "max-age=31536000; includeSubDomains";

  # ssl
  ssl_session_cache shared:SSL:20m;
  ssl_session_timeout 10m;
  ssl_protocols TLSv1.2;
  ssl_prefer_server_ciphers on;
  ssl_ciphers 'ECDH+AESGCM:ECDH+AES256:ECDH+AES128:DH+3DES:!ADH:!AECDH:!MD5';
    ssl_certificate /etc/letsencrypt/live/bryce.sftpgw.cloud/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/bryce.sftpgw.cloud/privkey.pem; # managed by Certbot


  location /backend/ {
    proxy_pass http://localhost:8080/;
    # Disable caching for api layer
    add_header 'Cache-Control' 'no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0';
    expires off;
    proxy_set_header    X-Client-IP        $proxy_add_x_forwarded_for;
    proxy_set_header    X-Real-IP          $remote_addr;
    proxy_set_header    X-Forwarded-For    $proxy_add_x_forwarded_for;
    proxy_set_header    X-Forwarded-Host   $host;
    proxy_set_header    X-Forwarded-Server $host;
    proxy_set_header    X-Forwarded-Port   $server_port;
    proxy_set_header    X-Forwarded-Proto  $scheme;
    proxy_read_timeout 3600;
    proxy_http_version 1.1;
    proxy_set_header Connection "";
  }

  location / {
    try_files $uri $uri/ /index.html?$args;
  }

  index index.html index.htm;
  server_name bryce.sftpgw.cloud;
  root /usr/share/nginx/admin-ui/;
  rewrite  ^/$  /index.html  permanent;

}

After fixing your website.conf file, make sure to run this command to restart nginx:

nginx -t && service nginx restart