In a previous article I described how to install and configure WordPress on a Raspberry Pi. Everything was done very simply, using only HTTP.
Today I will describe how to add HTTPS using a free SSL certificate.
To create and obtain this certificate (provided by Let’s Encrypt), I will install and use a Python tool called python-certbot.
Before configuring SSL on the Raspberry Pi, make sure you have a domain name already set up and pointing to your public IP address, as an IP address alone will not allow you to obtain an SSL certificate.
With that said, install the Let’s Encrypt software on the Raspberry Pi with the following terminal command:
sudo apt-get install python-certbot-apache
Once Certbot is installed, we can obtain an SSL certificate for the Raspberry Pi from Let’s Encrypt.
Before continuing, make sure that ports 80 and 443 on your router are forwarded to your Raspberry Pi’s internal IP address.
sudo certbot --apache
After running this command, you will be asked to enter some details, such as your email address. Let’s Encrypt needs this information to keep track of the certificates issued and to contact you if there are any problems with your certificate.
Once you have filled in the requested information, the script will generate the certificate and download it from Let’s Encrypt.
If you run into problems, make sure you have a valid domain name pointing to your IP, and that ports 80 and 443 are open on your router.
The certificates obtained by the certbot client are stored in the following folder (replacing example-site.com with your domain name):
/etc/letsencrypt/live/example-site.com/
In these folders you will find both the full chain file (fullchain.pem) and the certificate’s private key file (privkey.pem). These are the files that keep your SSL connection secure and identify it as a legitimate connection.
These certificates have a limited validity period, so a renewal command must be run before they expire. The following command renews the certificates without having to provide all the information requested by the initial script again:
sudo certbot renew
Of course, you can schedule this in crontab to automate the process.
Enjoy!
