How to Secure Apache with Let’s Encrypt on Ubuntu 20.04

Securing your Apache web server with an SSL/TLS certificate is important for providing encrypted HTTPS connections to your website visitors. Let’s Encrypt provides free, automated SSL/TLS certificates to help website owners enable HTTPS.

In this comprehensive 3047-word guide, we will walk through the full process of securing an Apache web server with a free Let’s Encrypt SSL certificate on Ubuntu 20.04 from an expert full-stack developer‘s perspective.

Why HTTPS Matters

With HTTP websites, all data transferred between a browser and web server is sent in plain untreated text. This means that any third-party on the network can easily intercept and read any data being transferred, including sensitive information like login credentials or financial data.

However, when configured with HTTPS, the HTTP traffic gets encrypted through SSL/TLS certificates to prevent network spying or tampering.

According to Google Transparency Report data, over 90% of web traffic is now encrypted thanks to the proliferation of free certificates and auto-issuance tools like Let‘s Encrypt. There has been over a 75% increase in HTTPS adoption just in the last five years.

Apart from encrypting website connections, enabling HTTPS comes with other benefits:

• SEO ranking boost in search engines like Google
• Prevent users from seeing scary security warnings
• Enable browser features that require secure origins
• Provide assurance that traffic isn‘t manipulated
• Meet compliance requirements for data protection laws

Now let‘s dive into securing your own Apache server‘s website traffic through HTTPS encryption using free Let‘s Encrypt certificates.

Overview of Let‘s Encrypt

Let‘s Encrypt is a non-profit certificate authority (CA) run by the Internet Security Research Group (ISRG) to provide free TLS/SSL certificates for enabling HTTPS on websites. The certificates integrate with all modern web servers like Apache, Nginx, IIS etc.

Some key technical capabilities provided by Let‘s Encrypt include:

Automated validation and deployment – The validation process for proving control of a domain can be fully automated by using the Certbot ACME client. This allows certificates to be issued and installed without any manual intervention.

Once obtained, Certbot can also automatically configure HTTPS settings on the target web server through plugin integrations. This enables purely automated TLS deployment pipelines.

90 day certificate lifespans – In contrast to traditional 1+ year certificate terms, Let‘s Encrypt provides short-lived 90 certificates. This increases security by ensuring compromised certificates have a limited impact window and encourages automation of regular renewals.

Transparent PKI – All certificates and revocation details are publicly audited via Certificate Transparency logging. This prevents internal data operations from being hidden.

Multi-perspective consistency – ACME certificate issuance leverages perspectives from independent Certificate Authority monitors to detect any discrepancies between a CA‘s internal and public states.

Now let‘s look at how to leverage Certbot with Apache to benefit from these capabilities.

Prerequisites

Before securing Apache with Let‘s Encrypt, your Ubuntu 20.04 server should have:

• Apache web server installed
• A registered domain name that resolves to your server‘s public IP address
• Ports 80 and 443 open in the firewall for HTTP/HTTPS traffic

You can check that Apache is installed with:

sudo apache2 -v

And verify your firewall status with:

sudo ufw status

Step 1 – Install Certbot ACME Client

The first step is to install Certbot, the official Let‘s Encrypt ACMEv2 protocol client for Ubuntu.

Certbot handles all communication with the Let‘s Encrypt Certificate Authority servers to prove ownership of your domain name and securely obtain SSL/TSL certificates signed by the CA‘s private key.

First, update your server‘s package index:

sudo apt update

Next, install the Certbot package:

sudo apt install certbot python3-certbot-apache

This provides two key things:

• The certbot command line tool for obtaining certificates via ACME protocol flows
• Plugins for automating Apache‘s HTTPS configuration using obtained certs

Certbot is now ready to use for fetching and deploying certificates on your Apache server.

Step 2 – Configure Apache for TLS Hosting

Before requesting an SSL certificate for your domain, Apache needs some minor configuration changes to designate where the certificate will reside once obtained.

Open Apache‘s site configuration file:

sudo vim /etc/apache2/sites-available/000-default.conf

Inside the <VirtualHost> block, add the following lines before the closing </VirtualHost> tag:

SSLCertificateFile /etc/letsencrypt/live/example.com/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/example.com/privkey.pem  

Be sure to replace example.com with your own registered domain name.

These directives specify the future permanent locations of the signed certificate file and private key once provisioned.

Next, enable the required OpenSSL and HTTP header modules:

sudo a2enmod ssl 
sudo a2enmod headers

Your Apache server is now ready for securing with Let‘s Encrypt certificates!

Step 3 – Obtain Let‘s Encrypt SSL Certificate

With the groundwork laid, we can now use the certbot client to automatically obtain an SSL certificate signed by the Let‘s Encrypt CA servers.

Temporarily Open Port 80

Start by enabling inbound HTTP connections if you have another web server running on port 80:

sudo ufw allow http

As Let‘s Encrypt‘s domain validation process requires port 80 availability for HTTP requests during authorization flows.

Also stop any other software using port 80 like Nginx to free it up for Certbot.

Authenticate and Issue Certificate

With port 80 open, invoke Certbot to begin an interactive certificate issuance process:

sudo certbot --apache -d example.com -d www.example.com

Breaking this down:

• --apache – Plugin flag to automatically configure this Apache instance
• -d example.com – Main registered domain name
• -d www.example.com – Optional www subdomain

Certbot will first connect to the Let‘s Encrypt CA and verify you control the requested domain(s) via automated DNS and/or HTTP checks. Results get compared against independent Certificate Authority monitors to confirm proof.

After successfully passing domain validation, the CA will then sign a new SSL certificate containing your domains and the public Let‘s Encrypt root certificate.

Certbot receives, saves, and automatically configures the Apache directives we added earlier to serve the new certificate files.

For transparency, the certificate issuance transaction is also publically logged.

You‘ll need to agree to Let‘s Encrypt‘s Subscriber Agreement and share contact details that may be used for communication about the certificate if required.

And that‘s it! Certbot has fully automated obtaining and installing your signed SSL certificate with no other effort needed.

Step 4 – Post-Issuance Configuration

With the signed TLS certificate deployed, complete the configuration by:

1. Reloading the Apache daemon to activate the new HTTPS settings:

    sudo systemctl reload apache2

2. Permanently opening encrypted TCP port 443 in the firewall:

    sudo ufw allow https
    sudo ufw delete allow http 

3. Testing HTTPS connectivity by visiting https://yourdomain.com in any browser. The padlock icon signifies active encryption thanks to your newly provisioned certificate.

You can also inspect the transaction details by querying the certificate from the command line:

openssl s_client -connect yourdomain.com:443 -showcerts

The full certificate chain will be displayed containing your new cert, Let‘s Encrypt‘s intermediate signing certificate, and their root CA certificate.

The /etc/letsencrypt/live folder also now contains the PEM-encoded keys and certificate files as configured earlier.

Step 5 – Configure Renewal Automation

Let‘s Encrypt certificates have a maximum 90 day lifespan to encourage automation and improve revocation responsiveness if private keys are compromised.

Once expired, site visitors will encounter untrusted connection browsers warnings until updated certificates are obtained.

Fortunately, Certbot provides built-in facilities for automatically renewing certificates before expiry to maintain continual service availability.

This is achieved by setting up a systemd timer unit to trigger the renewal command twice a day. We can inspect it with:

sudo systemctl list-timers certbot.timer

If the timer is not active or certificate renewal ever needs to be manually triggered, simply invoke:

sudo certbot renew

Certbot will check for certificates nearing expiration and rerun the automated issuance process if required. Easy automated renewals helps simplify TLS management across your server fleet.

For larger deployments, certificates can also be renewed programmatically via the Certbot CLI API without any interactive prompts. This allows complete automation in CI/CD pipelines.

Avoiding Renewal Failures

Sometimes certificate renewals may fail due to a variety of causes like network outages, changes in domain validation configs, or client bugs.

Certbot will retry failures and attempt to notify the administrator if problems persist. However left unchecked, expiry without renewal will cause TLS termination issues.

To safeguard against that, consider configuring active monitoring for your certificate‘s expiration date to receive advance warning if renewals are failing. Most SNMP systems provide built-in tracking of certificate lifespan.

Upon notification, you can investigate the cause of failures by checking logs:

sudo certbot renew --dry-run

Debug runs like this will expose any issues for troubleshooting without making changes to production certificates before expiry.

Alternative Web Servers and Tools

While this guide focuses on Apache due to its ubiquity, Let‘s Encrypt can secure any web server, including:

• Nginx – Install Certbot‘s Nginx plugin via apt install python3-certbot-nginx and obtain certificates using certbot --nginx ...
• Caddy – Inbuilt support for automating issuance and renewal
• HAProxy, Varnish – Generate standalone certificates then reference in configs

There are also many other ACME clients that offer similar capabilities for provisioning and renewing free Let‘s Encrypt certificates:

Acme.sh – Shell-based client for any Unix-like OS with cross-platform support
GetSSL – Perl client with additional features like eternity requests
Greenlock – Node.js/JavaScript ACME library and issuer
Win-ACME – PowerShell client designed for Windows servers

However for Ubuntu environments, the official Certbot client still remains the simplest and most full-featured option.

Conclusion

Migrating your website to encrypted HTTPS helps provide a private, integral, and authenticated user experience. However, the procurement and ongoing management of SSL/TLS certificates can traditionally be complex and expensive.

Let‘s Encrypt solves this through wholly free certificates and innovative automation of validation, issuance, installation, and renewal processes via clients like Certbot.

Using Certbot on Ubuntu 20.04 empowers you to easily secure Apache or Nginx with trusted certificates that automatically renew in the background before expiry. This frees you to focus on developing great web apps instead of toiling over TLS deployment logistics.

So give your users the gold standard of HTTPS protection by leveraging Let‘s Encrypt today!