WARNING on 2020-02-24: webfaction has been bought by godaddy and will soon close down. I have recently moved out and am now keeping all of my Let’s Encrypt certificates up to date with the official certbot tool.
WARNING: High levels of NERD ahead.
I started using CloudFlare’s free tier on this blog, before Let’s Encrypt burst onto the scene, mostly for their universal SSL. However, as joepie91 recently pointed out, this means that by design, CloudFlare has to decrypt all SSL traffic, and then re-encrypt it to send it to your original site with its self-signed or generic certificate (in my case). Apart from this, CloudFlare is a bit of overkill for this low-traffic site.
Because I don’t need much of an excuse to try out something new, I used this as my excuse to try out Let’s Encrypt, a fantastic new(ish) service which issues free 90 day certificates to anyone who can verify their domains.
I was shocked with how easy this was on the webfaction shared (non root) hosting I’ve been using for years, and so I had to share.
WITNESS THE GREAT EASINESS:
Step 1: Install acme.sh
These two steps are to be performed whilst SSH’d in to your web host.
First we install the wonderful acme.sh by following the one-liner on its website:
‘‘‘shell curl https://get.acme.sh | sh ’’’
At this junction, as they say, it’s best to log out and in again, so that the acme.sh alias and environment variable can be setup.
Step 2: Issue shiny new SSL certificate
We then get acme.sh to verify the website using the webroot method, and to request a certificate for the two domains cpbotha.net and www.cbbotha.net:
acme.sh --issue -d cpbotha.net -d www.cpbotha.net -w ~/webapps/wp
The argument following -w is the directory exposed by the website http://cpbotha.net/. Note that this is still http; Let’s Encrypt queries a special file left there by acme.sh to confirm that you actually manage the specified domain.
After a few seconds of progress output, I was left with a shiny certificate (as well as the CSR, key, and so forth) in ~/.acme.sh/cpbotha.net/
Step 3: Install shiny new SSL certificate
On Webfaction, one has to file a support ticket for this. My request was formulated thusly, and was correctly acted upon in about 5 minutes:
Could you please install the following SSL certificate for the website cpbotha_SSL – reachable at https://cpbotha.net/:
- cert is in
/home/cpbotha/.acme.sh/cpbotha.net/cpbotha.net.cer- key is in
/home/cpbotha/.acme.sh/cpbotha.net/cpbotha.net.key- intermediate CA cert is in
/home/cpbotha/.acme.sh/cpbotha.net/ca.cer- full chain certs is there:
/home/cpbotha/.acme.sh/cpbotha.net/fullchain.cerThanks!
Update on 2016-10-25
It is now possible to install the new certs all by yourself using the webfaction panel or the API! Read the announcement blog post for more information.
Bonus level: In 90 – k days, simply re-run acme.sh
At any point, you can request certificates for any other domains that you may be hosting on your webfaction.
At regular intervals, or in slightly fewer than 90 days, simply run:
acme.sh --renewAll
To have acme.sh renew any of your certificates that are up for renewal. Just remember to create a new support ticket to have the renewed certificates installed for the relevant domains.
acme.sh cronjob
Unbeknownst to be (I should have read the docs) acme.sh had cleverly installed a user cronjob to check for renewals. When I attempted to renew two of my certs, I saw that it had already done so automatically, so I only had to install the updated versions.
Boss level: htaccess-based redirect from HTTP to HTTPS
Now that I have my SSL setup, I would prefer for users who go to the HTTP site to be 301 forwarded to the HTTPS version. On Webfaction, I can do that with the following addition to the site .htaccess file:
<IfModule mod_rewrite.c> RewriteEngine On # we're behind nginx ssl proxy, hence the non-standard check for no-SSL: RewriteCond %{HTTP:X-Forwarded-SSL} !on RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301] </IfModule>