# Migrating Self-Signed SSL Certificate to LetsEncrypt Certificate

### Download Let's Encrypt Client

1. `<span class="pln">sudo </span><span class="pun">-</span><span class="pln">s</span>`
2. `<span class="pln">git clone https</span><span class="pun">:</span><span class="com">//github.com/letsencrypt/letsencrypt /opt/letsencrypt</span>`

### Update Apache Configuration

Let's Encrypt does not detect multiple virtual host in a single file, so if you have multiple virtual hosts in a single file, you need to separate it and update the configuration for SSL only. Then redirect all plain-text traffic to SSL using a single virtual host.

Create a new virtual host in `/etc/httpd/conf.d/redirect_ssl.conf` to redirect plain-text traffic to SSL, replace all `<domain>`to your TLD, such as `example.com`:

1. `<span class="tag"><VirtualHost</span><span class="pln"> *:80</span><span class="tag">></span>`
2. `<span class="pln"> ServerName </span><span class="tag"><domain></span>`
3. `<span class="pln"> ServerAlias *.</span><span class="tag"><domain></span>`
4. `<span class="pln"> RewriteEngine on</span>`
5. `<span class="pln"> RewriteRule ^/(.*) https://%{HTTP_HOST}/$1 [NC,R=301,L]</span>`
6. `<span class="tag"></VirtualHost></span>`

### Setup SSL Certificates

1. `<span class="pln">cd </span><span class="pun">/</span><span class="pln">opt</span><span class="pun">/</span><span class="pln">letsencrypt</span>`
2. `<span class="pun">./</span><span class="pln">letsencrypt</span><span class="pun">-</span><span class="kwd">auto</span> <span class="pun">--</span><span class="pln">apache </span><span class="pun">-</span><span class="pln">d </span><span class="str"><domain></span> <span class="pun">-</span><span class="pln">d www</span><span class="pun">.<</span><span class="pln">domain</span><span class="pun">></span> <span class="pun">-</span><span class="pln">d </span><span class="str"><subdomain></span><span class="pun">.<</span><span class="pln">domain</span><span class="pun">></span>`

Replacing `<domain>` with your domain, subsequent subdomains can be specified with `-d` option.

### Restart Apache and Test

1. `<span class="pln">systemctl restart httpd</span>`

### (Optional) Renewing SSL Certificates

Let's Encrypt issue **90 days** validity certificates, but you can however, renew it earlier in case errors occurred.

To renew the certificates, simply use the following command:

1. `<span class="str">/opt/</span><span class="pln">letsencrypt</span><span class="pun">/</span><span class="pln">letsencrypt</span><span class="pun">-</span><span class="kwd">auto</span><span class="pln"> renew</span>`

If you have just created a new certificate, Let's Encrypt will never issue you a new one, it will only issue a new certificate for your domains if the validity period is **less than 30 days**, so, you can create a cronjob to try and renew the certificate every day, week or month, in case anything goes wrong with your certificate.

To setup cronjob to automatically renew certificate, enter command `crontab -e` to create a new cronjob and add the following line:

1. `<span class="lit">0</span> <span class="lit">3</span> <span class="pun">*</span> <span class="pun">*</span> <span class="lit">1</span> <span class="pun">/</span><span class="pln">opt</span><span class="pun">/</span><span class="pln">letsencrypt</span><span class="pun">/</span><span class="pln">letsencrypt</span><span class="pun">-</span><span class="kwd">auto</span><span class="pln"> renew </span><span class="pun">>></span> <span class="str">/var/</span><span class="pln">log</span><span class="pun">/</span><span class="pln">le</span><span class="pun">-</span><span class="pln">renew</span><span class="pun">.</span><span class="pln">log</span>`

The cronjob above will run on **every monday** at **3 A.M.**, it will append any output from `/opt/letsencrypt/letsencrypt-auto`to `/var/log/le-renew.log`. Please refer to the reference for more info on Linux cronjobs.

### References

1. [Digital Ocean Article](https://www.digitalocean.com/community/tutorials/how-to-secure-apache-with-let-s-encrypt-on-centos-7)
2. [Let's Encrypt Article](https://letsencrypt.org/getting-started/)
3. [Cronjob Format](http://www.nncron.ru/help/EN/working/cron-format.htm)