Let's Encrypt is a certificate authority that provides free certificates in a fully automated process.
In this guide, you will learn how to set up a TLS/SSL certificate from Let’s Encrypt on a Centos 7 / AlmaLinux 8 / AlmaLinux 9 server running Apache as a web server.

Preparation

Before enabling the Let's Encrypt certificate, make sure you have Apache Web Server installed on your server. If not, you can check out our Apache web server installation guide.

You also need to create a virtual host configuration file by typing this command (if you didn't do it during Apache installation):

vi /etc/httpd/conf.d/yourdomain.ltd.conf

Add these lines to the configuration file:

Please note. Make sure to change the "yourdomain.ltd" to your actual domain.

After editing, you can save changes and exit.

1. Creating an index.html file for testing

To create an index.html file for testing, run this command:

vi /var/www/html/index.html

Enter the text for testing in the file:

After that, you can save the file and exit.

Now you need to change the owner of the ‘/var/www/html/index.html’ file to Apache by entering this command:

chown -R apache:apache /var/www/html/index.html

This means that Apache can now read this file.

2. Install Certbot

On Centos 7 follow these steps to install Cerbot:

1.We need to add the EPEL repository before installing Certbot. Run this command:

`yum install epel-release`

2.Install the Certbot:

`yum install certbot python2-certbot-apache mod_ssl`

On AlmaLinux 8 and 9 follow these steps to install Cerbot:

1.Run this command to add the EPEL repository before installing Certbot:

`dnf install epel-release`

2.Install the Certbot:

`dnf install certbot python3-certbot-apache`

3.Set Up the SSL Certificate

To set up the SSL for domain, run this command:

certbot --apache -d yourdomain.ltd

You can install certificate for multiple domains and subdomains by following this command:

certbot --apache -d yourdomain.ltd -d www.yourdomain.ltd -d
yourdomain2.ltd -d subdomain.yourdomain2.ltd

When issuing a certificate, you will need to provide an email, that you specified previously in virtual host configuration file (admin@yourdomain.ltd).
You will also need to agree to the Terms of Service (mandatory) and agree or disagree to share your email address with Electronic Frontier Foundation (optional)

Please note.

When issuing a certificate, you may receive the following error message:

Cancel the certificate issue process (enter 'c') and restart Apache service with the following command:

systemctl restart httpd

After that, try to issue the certificate again.

4.Check SSL Certificate

Enter this command to check if SSL issued successfully:

ls /etc/letsencrypt/live/yourdomain.ltd/

You should see the following output:

cert.pem chain.pem fullchain.pem privkey.pem

You can also check SSL in your browser. Open your website and click on the padlock icon in the address bar to see information about certificate.

5.Manual and automatic renewal

Let’s Encrypt certificates are valid for 90 days.

You can manually renew certificate with this command:

certbot renew --dry-run

If the certificate is less than 30 days away from expiration, this command will renew it.

If you want to specify auto-renewal, you can edit the crontab and create cronjob to run the above command twice a day automatically:

crontab -e

Add this line to the crontab:

You're all set. When necessary, certbot will renew your certificates and reload Apache to pick up the changes.

Please note.

If, after activating the certificate, your site is still not available and you receive "Secure Connection Failed" error, make sure to allow traffic via HTTPS (port 443), which could be blocked in firewalld by default.

You can check if HTTPS enabled, using this command:

firewall-cmd --list-all

The output will provide you information about enabled services. In this screenshot, you can see that port 443 is enabled:

If 443 port disabled, you can enable it with firewalld or iptables.

To enable https service in firewalld, use this command:

firewall-cmd --permanent --add-service=https

Then reload the firewall:

firewall-cmd --reload

To enable https in iptables, use this command:

iptables -I INPUT -p tcp -m tcp --dport 443 -j ACCEPT

Then save the changes:

iptables-save