Changes between Version 5 and Version 6 of Securing_a_website

Timestamp:

10/10/2023 12:26:19 AM (7 months ago)

Author:

Bruce Dubbs

Comment:

--

Securing_a_website

@@ -25 +25 @@
 
 1. certbot\\
-   This is a feature-rich implementation of a client. It is the one recommended by LE. Due to the features built into the client, this package became quite big and has a large number of options.
-1. uacme\\
+   This is a feature-rich implementation of a client. It is the one recommended by LE. Due to the features 
+   built into the client, this package became quite big and has a large number of options.
+2. uacme\\
    Uacme is a nice and handy C-implementation which is quite easy to build and to use.
 
@@ -34 +35 @@
 
 === Certbot
-Download: https://github.com/certbot/certbot/archive/refs/tags/v2.6.0/certbot-2.6.0.tar.gz\\
-MD5 checksum: d999b46e7aa1d26d2d636a92d1462864\\
-Dependencies: downloaded by pip\\
-
-==== Installation
-Install the bot by running the following command as ''root'' user:
-{{{
-pip3 install certbot
-}}}
-Some additional packages might be downloaded while installation so a working internet connection is required.
-
-==== Usage
-... t.b.c. ...
+To get https to work, first install certbot.  The instructions are at
+https://certbot.eff.org/lets-encrypt/otherpip-apache
+
+Note that augeas will also need to be installed.  See below,
+
+The certbot looks for a certain configuration, even if 'Other Linux' is selected:
+{{{
+ln -s apachectl /usr/sbin/apache2ctl
+ln -s httpd /etc/apache2
+
+mkdir -p /etc/httpd/sites-enabled
+cd       /etc/httpd/sites-enabled
+ln -s ../vhosts.d/<site.domain.topleveldomain>.conf 
+}}}
+
+In  /etc/httpd/httpd.conf ensure 'LoadModule rewrite_module...' is not commented.
+
+Now install augeas (http://download.augeas.net/http://download.augeas.net/)
+
+Run as root:
+{{{
+certbot --apache --must-staple --redirect --hsts --uir --staple-ocsp \
+        -d <site.domain.topleveldomain>
+}}}
+
+This will update vhosts.d/<site.domain.topleveldomain>.conf and add
+         <site.domain.topleveldomain>-le-ssl.conf
+
+Restart apache
+
 
 === Uacme