Install/Update LetsEncrypt certificates (no-root, apache2, debian)

It seems that the certbot, the recommended script to install and update the LetsEncrypt certificates requires root permissions. Well, I found several tutorials and forums where people claimed that they ran it without root permissions but they all said they needed root permissions to do something else for certbot to work and then I ran this simple command:

and decided to give up and search for an alternative method. 🙂

So, here’s what I finally did (Disclaimer: I am not really into security or system administration so, I don’t know if this method is the best or the most secure out there but I’ve found it quite simple and I liked that it doesn’t require weird package installations, root permissions, systemd or any other “easy”, “automated” params that create paths and files everywhere. At the end you will end up with only one directory where you can find your certificates and copy them where you like.):

Step 1: downloaded the acme.sh

I cloned the acme.sh script from github:

Step 2: issued the certificates

I issued my certificates using the acme.sh script:

• domain is the domain name for the site (for example for this site it could be eleni.mutantstargoat.com if I wanted to use the certificates on my vhost or mutantstargoat.com if I wanted to use it everywhere)
• path is the path to the site content (it could be ~/public_html for example)

Then the acme.sh script created a directory ~/.acme.sh/ with the following contents:

Step 3: certificates installation

I’ve created a certificates/ directory in my home folder and ran the following command to install the certificates in ~/certificates/:

I ended up having these 3 files:

Step 4: apache configuration

The Apache webserver has a sites-enabled/website file in /etc/apache2 where I had a VirtualHost configuration similar to this one:

I enabled ssl and the mod_headers (the command must have been something like: a2enmod mod_ssl mod_headers) and I added a second virtualhost for 443:

I symlinked the ~/certificates/*.pem to /etc/apache2/certificates (that’s why the path is not ~/certificates above, you should use the path to your certificates directory)

Restarted Apache!

Step 5: how I renew the certificates

I have my apache2 certificates in a directory ~/certificates and I have a symlink to each one in /etc2/apache2/certificates/.

I’ve written a script:

(well I could had used the command directly)

and put it in a cronjob (as a user) that runs every month, the first day at 6:00 am:

Then I added another cronjob in /etc/crontab to reload the apache configuration files 1 hr later:

And problem solved. 🙂