Let's Encrypt is a Certification Authority (CA) which issues certificates that are required to enable
HTTPS for a website/
web server. Let's Encrypt will issue such a certificate to everyone who demonstrates to have control over the server where the webserver runs.
Let’s Encrypt is a joint project of EFF, Mozilla and many other sponsors.
Certbot
Certbot is the ACME client (see
RFC 8555) recommended by Let's Encrypt (a list of other client implementations is
here).
Certbot fetches a certificate from Let's Encrypt. Generated keys and fetched certficates are stored under /etc/letsencrypt/live/$domain ($domain = certificate name).
Certbot is meant to be run on the machine where the webserver is hosted.
If Certbot is run with root privileges, it is able to automatically configure TLS/SSL for Apache and nginx.
Most modern Linux distributions (basically any that use systemd) can install Certbot packaged as a snap.
Some commands:
-
certbot (or certbot run): Obtain and install a certificate.
-
certbot certonly: Obtain a certificate without installing it.
-
certbot --nginx: Use nginx plugin?
-
certbot certificates: Show a list of all certificates that cerbot knows about.
-
certbot --version (useful when asking questions in the community forum)
APT package certbot
Some interesting files in the APT package certbot are:
$ apt-file show certbot
certbot: /etc/cron.d/certbot
certbot: /etc/letsencrypt/cli.ini
certbot: /etc/logrotate.d/certbot
certbot: /lib/systemd/system/certbot.service
certbot: /lib/systemd/system/certbot.timer
certbot: /usr/bin/certbot
certbot: /usr/bin/letsencrypt
…
apache/nginx
When certbot is run with apache or nginx plugin, certbot spins up a dummy webserver with an acme-challenge file, so that when letsencypt wants to validate the domain and reach out to the server, this challenge file is served by certbot. Once verified, the dummy server is destroyed with the challenge files and generating the certificate and storing on the server
Staging Environment
Let's encrypt recommends to use its
staging environment for tests before using their production environment.
The ACME URL for the staging environment is https://acme-staging-v02.api.letsencrypt.org/directory.
When using certbot, the --test-cert option instructs it to use the staging environment.