In our earlier guide, we provided a step-by-step walkthrough on installing the LAMP stack on Rocky Linux and later moved on to configuring Apache virtual hosts for hosting multiple websites from a single server.

However, securing your website is just as important as setting it up. With cyber threats on the rise, ensuring that your site is protected has become a top priority for both businesses and users. One of the most effective ways to secure your site is by encrypting it using an SSL/TLS certificate.

An SSL/TLS certificate is a digital certificate that authenticates your website’s identity and secures the data transmitted between a user’s browser and the web server through encryption.

Essentially, this changes your site's protocol from HTTP, which sends data in plain text, to HTTPS (HTTP Secure) which ensures all data is encrypted. Without such encryption, malicious actors can intercept sensitive information like login credentials simply by monitoring the traffic between the browser and the server.

Some time ago, Google started marking unencrypted sites with a “Not secure” warning in the browser address bar, alerting users to potential risks involved when visiting such websites.

As a site owner, you wouldn’t want your visitors exposed to unnecessary risks. This is why installing an SSL certificate on your web server is an essential part of website security.

In this tutorial, we’ll walk you through the process of securing an Apache web server on Rocky Linux 8 using a free Let's Encrypt SSL Certificate.

Requirements

Before proceeding, ensure that your domain is correctly pointed to your server’s public IP address. You'll need to log into your domain registrar or hosting provider and configure the DNS settings so that your domain resolves to the IP address of your Rocky Linux server.

For demonstration purposes, we are using the domain tecmint.info which is currently mapped to the public IP of our test server.

Step 1: Install EPEL Repository on Rocky Linux

Begin by installing some prerequisite packages that will be needed later. We will install the EPEL repository along with the mod_ssl package, which is Apache’s module for providing SSL/TLS support using OpenSSL.

<code>$ sudo dnf install epel-release mod_ssl</code>

Step 2: Install Certbot on Rocky Linux

Now, let’s proceed to install Certbot, a utility used to automatically obtain and configure Let's Encrypt SSL certificates. It greatly simplifies what would otherwise be a manual and complex setup process.

<code>$ sudo dnf install certbot python3-certbot-apache</code>

Once installed, Certbot is ready for use.

Step 3: Configure SSL Certificate for Apache on Rocky Linux

The next step involves fetching and installing the actual Let's Encrypt SSL certificate. To do this, run:

<code>$ sudo certbot --apache</code>

This command initiates a series of prompts. First, enter your email address. Then, review the Terms of Service via the provided link and press 'Y' to accept them, followed by ENTER.

You’ll then be asked whether you'd like to share your email address with the Electronic Frontier Foundation (EFF), which is a founding partner of Let's Encrypt.

Sharing your email will subscribe you to EFF newsletters and updates. If you're okay with that, press 'Y', otherwise select 'N' and hit ENTER.

Next, you’ll see a list of domains detected based on your Apache configuration. Choose the domain(s) you wish to secure. For simplicity, just press ENTER to apply HTTPS to all listed domains.

Certbot will complete the installation and store the certificate files under the /etc/letsencrypt/live/yourdomain/ directory.

If everything was successful, you should see output similar to the one shown below.

Step 4: Automatically Renew SSL Certificate in Rocky Linux

Let’s Encrypt certificates are valid for 90 days, but Certbot includes a built-in renewal script. You can test the renewal mechanism manually using:

<code>$ sudo certbot renew --dry-run</code>

To automate the renewal process, edit the crontab file:

<code>$ crontab -e</code>

Add the following line to schedule automatic renewals:

<code>0 * * * * /usr/sbin/certbot-auto renew</code>

Save and exit the file once done.

Step 5: Confirm Apache SSL Certificate Installation on Rocky Linux

To verify that your site is now secured, open a browser and reload your website. You should notice a padlock icon displayed before the URL.

Click the padlock and choose the ‘Certificate’ option to view detailed certificate information.

The certificate details will appear, confirming that your site is properly secured.

Additionally, you can assess your certificate strength by using the SSL Labs Test. Enter your domain name and click ENTER.

A result of A indicates a strong configuration.

Summary

By following this guide, you've successfully configured HTTPS for your Apache web server running on Rocky Linux using a free Let’s Encrypt SSL certificate with the help of the Certbot client.

The above is the detailed content of Secure Apache with Let's Encrypt Certificate on Rocky Linux. For more information, please follow other related articles on the PHP Chinese website!