B4J Tutorial [Server] Using Let's Encrypt on Ubuntu VPS

aeric · Oct 31, 2020

Using self signed certificates (generated by keytool or openssl) in localhost causing my client B4X apps unable to connect using OKHttp so I gave up and just use normal http connection.

javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

javax.net.ssl.SSLHandshakeException: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.

To avoid the above errors, I only use SSL during production with Let's Encrypt.

B4X:

#If RELEASE
    Dim ssl As SslConfiguration
    ssl.Initialize  
    ssl.SetKeyStorePath("/etc/letsencrypt/live/api.puterise.com", "keystore.jks") 'path to keystore file
    ssl.KeyStorePassword = "keystorepassword"
    'ssl.KeyManagerPassword = "passwordkeystore"
    srvr.SetSslConfiguration(ssl, SslPort)
    'add filter to redirect all traffic from http to https (optional)
    srvr.AddFilter("/*", "HttpsFilter", False)
#End If

tchart · Nov 1, 2020

@aeric have you looked at certbot? https://certbot.eff.org/

I use this as it sends reminders when the cetificate is about to expire.

Steps are pretty simple too;

Bash:

sudo apt-get install software-properties-common
sudo add-apt-repository universe
sudo apt-get update

sudo apt-get install certbot

certbot certonly --standalone

Follow the prompts, use a real email as it will remind you when the cert is about to expire.

Then to renew just run this;

Bash:

cerbot renew

The renew command is great as you can run it as often as you want and it will only renew when its time - so for example you can run this on startup of your server.

To convert to a Java keystore I use this script (run from my app directory - note this replaces the entire keystore);

Bash:

rm jetty.keystore

# convert certificate chain + private key to the PKCS#12 file format
openssl pkcs12 -export -out keystore.pkcs12 -in /etc/letsencrypt/live/yourdomain.com/fullchain.pem -inkey /etc/letsencrypt/live/yourdomain.com/privkey.pem -name jetty -passout pass:keystorepassword

# convert PKCS#12 file into Java keystore format
/opt/jdk/jdk-11.0.2/bin/keytool -importkeystore -srckeystore keystore.pkcs12 -srcstoretype PKCS12 -destkeystore jetty.keystore -storepass keystorepassword -srcstorepass keystorepassword

# don't need the PKCS#12 file anymore
rm keystore.pkcs12

TILogistic · Nov 2, 2020

Other for Cpanel VPS :

cPanel's Official Let's Encrypt™ Plugin | cPanel

In cPanel & WHM version 58, we introduced a new feature called AutoSSL. I posted about AutoSSL before, but in case you haven’t heard of it yet, here’s more information. AutoSSL allows you to enable a feature in your cPanel & WHM account package which triggers the automatic request and...

blog.cpanel.com

If you don't have cpanel install webadmin:

Webmin

Powerful and flexible web-based server management control panel

www.webmin.com

aeric · Jan 28, 2021

I forgotten to renew the certificate. It has expired today. So now I am trying to renew.

Installing certbot in Ubuntu 18.04 (using snap).

Bash:

root@computerise:~# sudo snap install certbot --classic
error: system does not fully support snapd: cannot mount squashfs image using
       "squashfs": mount: /tmp/sanity-mountpoint-561435955: mount failed:
       Operation not permitted.

~~It says that Ubuntu 18.04 should already have snap but it turned out that the version I installed in the VPS doesn't have snap.~~ (Snap is actually installed but not working)

Bash:

$ sudo apt update
$ sudo apt install snapd

Try again but still the same error.

Trying to update linux kernel. (this step is unnecessary)
https://dausruddin.com/ubuntu-syste...d-cannot-mount-squashfs-image-using-squashfs/

Bash:

$ sudo apt install linux-image-generic-hwe-18.04 linux-headers-generic-hwe-18.04

Bash:

$ sudo reboot

Not success in updating the kernel 5.0.4. Tried install other kernels. (this step is unnecessary)

Update linux kernel using "traditional way" (this step is unnecessary)
https://hostadvice.com/how-to/how-to-update-and-upgrade-your-linux-kernel/

Bash:

$ uname -sr
$ sudo apt-get update
$ sudo apt-get dist-upgrade

Try again but still not get it to work with snap. Then I found:
https://community.letsencrypt.org/t...-mount-squashfs-image-using-squashfs/132689/6

Bash:

$ sudo systemd-detect-virt
openvz

Meaning my VM is not supported.

Install certbot (without snap)

Bash:

$ sudo apt install certbot

Installation done.

Bash:

$ ./letsencrypt-auto certonly --standalone -d api.puterise.com

Upgrading certbot-auto 1.9.0 to 1.11.0...
Replacing certbot-auto...
Your system is not supported by certbot-auto anymore.
Certbot will no longer receive updates.
Please visit https://certbot.eff.org/ to check for other alternatives.
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator standalone, Installer None
Cert is due for renewal, auto-renewing...
Renewing an existing certificate
Performing the following challenges:
http-01 challenge for api.puterise.com
Cleaning up challenges
Problem binding to port 80: Could not bind to IPv4 or IPv6.

So, now there is a problem with apache.

Bash:

Problem binding to port 80: Could not bind to IPv4 or IPv6.

Solution: https://community.letsencrypt.org/t...lugin-does-not-appear-to-be-installed/95682/2

Bash:

$ sudo apt-get update
$ sudo apt-get install python-certbot-apache
$ sudo service apache2 start

Try renew again:

Bash:

$ certbot renew

Saving debug log to /var/log/letsencrypt/letsencrypt.log

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Processing /etc/letsencrypt/renewal/api.puterise.com.conf
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Attempting to parse the version 1.9.0 renewal configuration file found at /etc/letsencrypt/renewal/api.puterise.com.conf with version 0.27.0 of Certbot. This might not work.
Cert is due for renewal, auto-renewing...
/etc/letsencrypt/options-ssl-apache.conf has been manually modified; updated file saved to /usr/lib/python3/dist-packages/certbot_apache/options-ssl-apache.conf. We recommend updating /etc/letsencrypt/options-ssl-apache.conf for security purposes.
Plugins selected: Authenticator apache, Installer apache
Renewing an existing certificate
Performing the following challenges:
http-01 challenge for api.puterise.com
Waiting for verification...
Cleaning up challenges

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
new certificate deployed with reload of apache server; fullchain is
/etc/letsencrypt/live/api.puterise.com/fullchain.pem
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Congratulations, all renewals succeeded. The following certs have been renewed:
/etc/letsencrypt/live/api.puterise.com/fullchain.pem (success)
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

taada...
Now restart my B4J server apps.

OliverA · Jan 29, 2021

aeric said:
Now restart my B4J server apps

You’ll have to recreate your keystore file. Otherwise the jServer will not use the new certificate

aeric · Jan 29, 2021

OliverA said:
You’ll have to recreate your keystore file. Otherwise the jServer will not use the new certificate

Right, I need to rerun the steps above.

aeric said:
Now, to make it work on B4J JRDC2 app:

OliverA · Jan 29, 2021

aeric said:
Your system is not supported by certbot-auto anymore

certbot-auto has been deprecated. See: https://certbot.eff.org/lets-encrypt/ubuntubionic-other. Looks like the new certbot has some pre and post hooks that could be used to
pre-hook: stop jServer
post-hook: create/update keystore and start jServer

aeric · Jan 29, 2021

OliverA said:
certbot-auto has been deprecated. See: https://certbot.eff.org/lets-encrypt/ubuntubionic-other. Looks like the new certbot has some pre and post hooks that could be used to
pre-hook: stop jServer
post-hook: create/update keystore and start jServer

Unfortunately the VPS image I am using does not support update to latest version. Until it stops working one day, I just leave it first. The purpose of the VPS is just for my experiment and demo. It is the cheapest VPS hosting package with very minimum specs. If one day I need a real production server, I will take note on this. Thanks.

aeric · Jan 29, 2021

tchart said:
I use this as it sends reminders when the cetificate is about to expire.

Actually I did receive email from Let's Encrypt Expiry Bot. I just ignored it. My bad. ?

OliverA · Jan 29, 2021

aeric said:
Unfortunately the VPS image I am using does not support update to latest version

What version are you looking for? For 18.0.5 LTS it seems to be 0.27 (that's what I have running). I use it to renew (manually) my certs. I just tried

Bash:

sudo certbot renew --dry-run

and it works fine

aeric · Jan 29, 2021

OliverA said:
What version are you looking for? For 18.0.5 LTS it seems to be 0.27 (that's what I have running). I use it to renew (manually) my certs. I just tried

Bash:

sudo certbot renew --dry-run

and it works fine

My certbot is still working. It just prompt me that it might not working...

aeric said:
Attempting to parse the version 1.9.0 renewal configuration file found at /etc/letsencrypt/renewal/api.puterise.com.conf with version 0.27.0 of Certbot. This might not work.
Cert is due for renewal, auto-renewing...

OliverA · Jan 29, 2021

That (the updated config file) may have happened when you tried to upgrade it via snap (instead of just letting apt-get do it).

aeric · Jan 29, 2021

OliverA said:
That (the updated config file) may have happened when you tried to upgrade it via snap (instead of just letting apt-get do it).

I didn't use snap. I think the conf file is automatic updated when updating the apache plugin.

ilan · Apr 28, 2021

very nice tutorial thanx aeric.
i have a server running on a google cloud VM instance running Debian 10. i managed to create an SSL certificate from let's encrypt using certbot. everything works fine. if i enter the site from my mobile phone I see the lock left to my domain and also at home but at my work i get a security warning "NOT SECURE". what could be the reason? it may be the firewall security at my work but why can i access other websites over HTTPS like b4x and much more? could it be that the lets encrypt certificate is not good enough?

aeric · Apr 28, 2021

ilan said:
very nice tutorial thanx aeric.
i have a server running on a google cloud VM instance running Debian 10. i managed to create an SSL certificate from let's encrypt using certbot. everything works fine. if i enter the site from my mobile phone I see the lock left to my domain and also at home but at my work i get a security warning "NOT SECURE". what could be the reason? it may be the firewall security at my work but why can i access other websites over HTTPS like b4x and much more? could it be that the lets encrypt certificate is not good enough?

I don’t think this is because let’s encrypt is not good enough. Have you try restart the browser because I suspect the browser is loading old cache. Refresh and click the “i” near the lock and see is the certificate is valid.

aeric · Apr 29, 2021

My certificate should be expired in June but reported that it expired yesterday. So I force certbot to renew using the following command:

B4X:

certbot renew --force-renewal

yfleury · Apr 10, 2023

./letsencrypt-auto certonly --standalone -d reseau-municipal
Skipping bootstrap because certbot-auto is deprecated on this system.
Your system is not supported by certbot-auto anymore.
Certbot cannot be installed.
Please visit https://certbot.eff.org/ to check for other alternatives.

aeric · Apr 10, 2023

Are you running the following command:

Bash:

$ sudo apt install certbot

yfleury · Apr 11, 2023

Just for the followers, remove $ sign

B4X:

sudo apt install certbot

B4J Tutorial [Server] Using Let's Encrypt on Ubuntu VPS

Expert

Well-Known Member

Expert

Expert

Expert

Expert

Expert

Expert

Expert

Expert

Expert

Expert

Expert

Expert

Expert

Expert

Active Member

Expert

Active Member