WEBVTT 00:06.040 --> 00:11.930 In this supplementary Listen we'll take a look at getting started with letting crept on in Genex. 00:11.940 --> 00:19.050 So first of all what is little encrypt the let's encrypt service is a relatively new provider of free 00:19.140 --> 00:24.530 automated SSL certificates something virtually unheard of only a couple of years ago. 00:24.900 --> 00:29.930 The service itself then aims to encourage the use of SSL over HTP. 00:30.060 --> 00:39.140 So hgt s as this has become the new standard and plain insecure htb is just no longer acceptable. 00:39.210 --> 00:45.270 Now having the let's encrypt service is one thing but in order to generate certificates and automate 00:45.270 --> 00:52.620 their renewal we'll use a tool called CERT bot which will form the basis of this lesson to demonstrate 00:52.680 --> 00:55.810 I've again created a server on digital ocean. 00:55.940 --> 00:59.280 This being a bold of a boon to 16 zeal. 00:59.490 --> 01:03.410 But the lesson will apply to whichever operating system you decide to use. 01:03.450 --> 01:08.430 The main factor being the use of Search bot and Litz encrypt with in generics. 01:08.430 --> 01:12.320 Important to note I also have a domain configured for the server. 01:12.510 --> 01:15.970 Let's encrypt dot steck academy dot TV. 01:16.080 --> 01:22.650 This being as let's encrypt won't issue certificates for IP addresses so a valid reachable domain is 01:22.650 --> 01:29.190 required of course at the moment if I try and access this domain it's unreachable as there's no web 01:29.190 --> 01:30.480 server running. 01:30.480 --> 01:38.730 So let's begin by installing engine X over my terminal SS H to the server with SSA charge a or Wooding 01:38.730 --> 01:39.130 my. 01:39.150 --> 01:42.020 Is this a key root act. 01:42.120 --> 01:45.570 Let's encrypt the steck Academy TV. 01:47.390 --> 01:48.480 And I'm connected. 01:49.320 --> 01:57.000 Update at get just good practice to make sure we have all the latest versions of the package repo's 01:57.780 --> 02:04.710 clear this install engine X worth about yet install engine X.. 02:05.250 --> 02:06.340 Confirm. 02:08.050 --> 02:12.610 And once that's done we can check if engine Xist already running worth process. 02:12.690 --> 02:17.120 A You X checking for engine X with grep. 02:17.290 --> 02:21.900 There we have it the master process and a single worker process. 02:22.060 --> 02:30.450 We can test this by performing a request to the server Col hgt let's encrypt adot steck academy not 02:30.590 --> 02:31.400 TV. 02:32.660 --> 02:39.080 And sure enough we get the HD Mel from the engine X holding page meaning engine X is up and listening 02:39.080 --> 02:43.490 on the server which looks like this in the browser in my editor. 02:43.490 --> 02:49.580 Then I'll open the engine configuration file from that server's new engine exe install this being the 02:49.580 --> 02:54.470 file at each c slash engine X slash engine X dot conf. 02:55.130 --> 03:01.910 Remove the bulk of this as we're only looking to test SSL certificate Sonia leave the event block as 03:01.910 --> 03:03.290 that's required. 03:04.380 --> 03:06.240 Get rid of all this. 03:07.400 --> 03:17.210 Create a new server block inside the HTP context listening on port 80 for now so plain HTP with a router 03:17.210 --> 03:21.630 location block that simply returns a two hundred status. 03:21.800 --> 03:24.880 And hello from Engine x. 03:24.890 --> 03:31.590 Save that reload engine X engine X with it s flag reload. 03:32.490 --> 03:37.170 Form the same code command to the server and we get that new response. 03:37.260 --> 03:39.880 So everything working as expected. 03:39.880 --> 03:44.960 If however I changed this protocol to hgt P S we get an error. 03:45.120 --> 03:51.360 So let's generate some SSL certificates and get this working with the help of search bot and lit encrypt 03:52.170 --> 03:56.540 will install search bot first navigate to CERT bot. 03:56.580 --> 03:58.530 E F F dot org. 03:59.270 --> 04:05.880 Select the relevant server software in genetics and the corresponding server OS. 04:05.900 --> 04:12.860 In my case a boon to 16 zele which gives us this detailed set of instructions for installing cert bot 04:13.160 --> 04:19.400 and even automating the renewal of those certificates all of which will cover start with the search 04:19.400 --> 04:21.080 bot install commands. 04:21.080 --> 04:26.650 I've already run this app get updates prior to installing engine X so copy this. 04:27.850 --> 04:35.440 Installing the software propertys common package already installed for this version of a burn to add 04:35.530 --> 04:37.950 the cert bot back each repo. 04:44.520 --> 04:48.700 Run update again to pull the packages from that newly added rebo. 04:51.930 --> 04:59.310 And finally install the said Bob backage install by phon cert bot in Genex. 05:01.090 --> 05:02.140 Yes. 05:04.920 --> 05:05.790 All done. 05:05.790 --> 05:12.530 Meaning we should now have the word bot tools available all clear this run server bot help. 05:13.850 --> 05:14.980 And there we have it. 05:15.350 --> 05:17.700 OK now that we have the command line tools available. 05:17.720 --> 05:22.450 Let's go ahead and generate this acel Certificates via the lit and crypt service. 05:22.460 --> 05:28.190 First off though it's important to assess the specific needs of your web server before continuing with 05:28.190 --> 05:31.270 generating certificates as you can see said. 05:31.280 --> 05:38.600 Bot allows us to generate certificates with out installing them or by default installs them meaning 05:38.630 --> 05:44.140 your engine X configuration file will be edited with all the necessary directives to listen for hgt 05:44.250 --> 05:45.920 s connections. 05:46.010 --> 05:52.100 This is often very useful search bot will also configure the correct cipher shoot and a host of other 05:52.100 --> 05:59.970 SSL parameters but might not be ideal on an existing server configuration where edits could cause trouble. 05:59.990 --> 06:02.760 Just something to consider and decide on. 06:03.080 --> 06:09.410 For this demonstration however I'll have said bot install the certificates as well to generate and install 06:09.410 --> 06:15.610 certificates for our engine server then we can run cert bot with an engine X flag. 06:15.620 --> 06:21.710 If however you were to run this with the cert only command skipping the installation then you'd also 06:21.710 --> 06:26.830 have to provided deflate gate with the relevant domain name for this certificate. 06:26.930 --> 06:30.680 The reason we don't need to specify the domain when also installing the certificate is. 06:30.680 --> 06:37.730 That said bot will inspect the existing configuration forrard domain or server name and use that also 06:37.730 --> 06:41.370 allowing a to know where the SSL configuration needs to be at it. 06:41.480 --> 06:49.070 Right now we don't actually have a server name specified so I'll add that server name let's encrypt 06:49.210 --> 06:53.480 not steck academy Don TV save for that. 06:54.180 --> 06:55.860 Reload engine x. 06:57.800 --> 07:01.220 And run the default search by command for engine X.. 07:02.360 --> 07:04.820 We are prompted for an email address. 07:06.550 --> 07:09.130 Agree to the terms of use. 07:09.180 --> 07:11.450 You want to share your email address. 07:11.500 --> 07:13.830 I'll opt for no in this case. 07:14.020 --> 07:19.660 And then we're presented with a selection of domains found in the engine X configuration file to choose 07:19.660 --> 07:20.300 from. 07:20.530 --> 07:24.890 This being the reason added the server name directive to that configuration. 07:24.940 --> 07:32.890 I only have the one so enter one enter this certificate gets generated and the domain verified. 07:33.040 --> 07:39.220 And finally we can choose to add a redirect to our engine XT configuration in order to redirect all 07:39.220 --> 07:42.330 HDB traffic to HTP s. 07:42.400 --> 07:44.330 I'll just say no for now. 07:44.410 --> 07:48.430 Or option 1 enter and that's all done. 07:48.430 --> 07:50.830 Congratulations you have successfully enabled. 07:50.860 --> 07:52.320 H t d b s. 07:52.360 --> 07:59.560 Let's encrypt steck academy or TV with some notes and path's to the generated certificates listed here. 07:59.980 --> 08:07.390 We can check the contents of that directory t see slash letting crypt containing all of the list encrypt 08:07.390 --> 08:10.970 files certificates configurations etc.. 08:11.360 --> 08:20.220 Slash life slash my domain and there we see the generator to defecates said bot has also reloaded our 08:20.230 --> 08:23.080 engine configuration after adding the certificates. 08:23.260 --> 08:26.170 So test this over hgt s again. 08:26.560 --> 08:27.980 Hello from Engine x. 08:28.030 --> 08:29.290 So working this time. 08:29.320 --> 08:32.920 Easiest that I'll check this in the browser. 08:34.570 --> 08:36.030 H T T P S. 08:38.970 --> 08:45.500 And there we have it lock and all we can see what modifications said bot may to our engineers second 08:45.610 --> 08:46.850 file. 08:46.950 --> 08:54.690 It's added a listen director on port for 4 3 being the default h.t. to be export links to their newly 08:54.690 --> 09:01.540 generated certificates for this domain and an include called Options SSL engine ixtoc. 09:02.740 --> 09:04.360 I'll clean this up a bit. 09:07.640 --> 09:12.060 Copy that path to the configuration include so we can see what this contains. 09:15.730 --> 09:16.650 There. 09:16.810 --> 09:21.020 This is the convenience of having said bot install your certificates for you. 09:21.040 --> 09:28.150 We have this acel session configurations and a selection of preferred ciphers or added security so very 09:28.150 --> 09:29.530 convenient. 09:29.530 --> 09:32.490 The next point then is cert renewal. 09:32.830 --> 09:38.220 Unlike traditional SSL certificates that was valid for one or two years at a time. 09:38.320 --> 09:44.590 Let's encrypt certificates are valid for 90 days only now without getting into the nitty gritty details 09:44.590 --> 09:45.720 of why this is. 09:45.730 --> 09:51.040 It's a good thing I fling to some content in the list and resources should you want to read more about 09:51.040 --> 09:56.770 the reasons for the shorter difficult life renewing your certificates will have to happen fairly frequently 09:56.770 --> 10:01.670 then and as part of this renewal will also see how to automate this. 10:01.750 --> 10:07.900 Meaning you should never have to worry about certificate renewal again first then to renew certificates 10:07.900 --> 10:08.840 manually. 10:09.010 --> 10:14.200 We can run cert bot renew into giving us cert. 10:14.200 --> 10:17.080 Not yet you for renewal skipped. 10:17.080 --> 10:20.320 So no nasty errors just the silane skip. 10:20.320 --> 10:26.660 We can however force a test renewal to make sure this will work once the certificates become due. 10:26.680 --> 10:31.560 Same command again this time with a flag dry run. 10:34.480 --> 10:36.940 We get that verification again. 10:37.640 --> 10:41.850 And done on Graduation's all renewals succeeded. 10:41.930 --> 10:43.810 Now for certificates to be renewed. 10:43.820 --> 10:46.150 They don't actually have to be expired. 10:46.430 --> 10:53.000 Only close to expiring which is good as we don't want a second of having expired certificates. 10:53.000 --> 10:57.690 This also means that we can safely run the renewals daily if they're not due. 10:57.710 --> 10:59.690 Nothing will happen if they're close. 10:59.690 --> 11:07.970 They'll get renewed to do this then to attempt to figure renewal daily will use a simple cron job clear 11:07.970 --> 11:10.850 this run krung tab with it. 11:10.880 --> 11:11.760 E flag. 11:11.840 --> 11:13.380 So editing the crunch job. 11:13.410 --> 11:15.870 Entry's I'll edit with no. 11:15.880 --> 11:23.430 No I don't have any cron jobs at the moment so add a new one right at the bottom of this file at daily. 11:23.630 --> 11:31.040 Been a convenience expression for running a cron job at midnight each day and the command cert bot renew 11:31.820 --> 11:35.680 right this outwith control o exit. 11:35.960 --> 11:42.620 And if I left out my crohn entries we see that daily renewal which is all there is to renewing your 11:42.620 --> 11:46.700 certificates automatically that we will leave this listen. 11:46.850 --> 11:52.580 You should now be comfortable installing search bot generating and installing new lights encrypt certificates 11:52.970 --> 11:55.520 and automating the renewal process. 11:55.610 --> 12:00.290 If you're interested in digging deeper to search but I've linked to some good articles in the list and 12:00.290 --> 12:05.960 resources and as always there's the official said by documentation to help you explore some of the other 12:05.960 --> 12:06.830 commands.