Fixing the Expired TLS/SSL Certificate Problem

Security, DevOps

Something broke the default TLS/SSL certificate for my primary site (scarbrough.co.uk) the other week, and browsers started flagging it as unsafe, which really didn’t look good. I figure it had something to do with my inadvertently deleting the /wwwroot/.well-known directory and whatever it contained.

Whatever the case, it was something I needed to fix myself, with a quick workaround until I had enough spare time to get a handle on how to generate a valid Let’s Encrypt certificate using Certbot.

Solution 1: SSL For Free

That (relatively) quick fix was an online service called ‘SSL For Free’, which is basically a Web application that guides one through the process of generating and installing a certificate. It might actually be a front-end for an instance of Certbot.

It turned out that the /.well-known directory was pretty important, as it contained a couple of token files that are required for Certbot to verify the requestor’s ownership of the Web server at the specified domain, and Certbot needs to do this when the certificate is renewed every 90 days.

SSL For Free generated a couple of token files, which needed to be uploaded to /wwwroot/.well-known/pkcs-verification. After they were read from my server,  the certificate files themselves were generated:

  • CA Bundle
  • Certificate
  • Private Key

I was able to install them, and the Web browser seemed happy with the ZeroSSL certificate after the load balancers were updated.

Solution 2: Certbot

Eventually I got round to installing Certbot and using that to generate a Let’s Encrypt certificate. This proved much easier than I expected. For this, I am using Certbot on a local Debian system, and HTTP verification to prove ownership of the server at scarbrough.co.uk.

Certbot is available in the Debian repository, and can be installed using APT:

#apt-get install certbot

To start the certificate generation process, the command will look something like:

#certbot -d scarbrough.co.uk --manual --preferred-challenges http certonly

Repeat the -d [domain name] for every subdomain the certificate should apply to. Again, ‘www’ also counts as a subdomain.

Certbot will then generate the token string, to be uploaded in a file at /.well-known/acme-challenge. After verifying the file exists on the Web server, Certbot will generate the .pem files in /etc/letsencrypt directory on the local machine.

The important files are:

  • cert.pem
  • chain.pem
  • privkey.pem

These are the certificate, intermediate certificate and the private key. An SSL certificate decoder can be used to check the validity of the certificate.

I used the cp command to get these files into a directory from which they can be uploaded and installed on the Web server.

Again it might take 30 minutes to an hour for the load balancers to update.