This is a very quick guide for setting up Let’s Encrypt on Arch Linux, so you can get free, browser-trusted SSL certificates for all your (sub)domains. Start by installing simp_le-git from AUR:
$ wget https://aur.archlinux.org/cgit/aur.git/snapshot/simp_le-git.tar.gz $ tar -xzvf simp_le-git.tar.gz $ cd simp_le-git && makepkg -si
We used simp_le here because the official Let’s Encrypt client tries to automatically alter your webserver configuration and as any self-respecting sysadmin would tell you, that’s a big no-no.
Now, let’s create a certificate for our domain, in this case le.example.com. First, you need to choose a directory where you can store your certificate like this:
# mkdir -p /srv/certs/le.example.com
You can obviously choose a different directory. Now that everything is set, let’s create the certificates!
# cd /srv/certs/le.example.com # /usr/bin/simp_le -d le.example.com:/path/to/my/webroot -f key.pem -f cert.pem -f fullchain.pem
Your directory should now contain three pem files. Now, let’s add these certificates to nginx. Open your virtualhost configuration and edit the “server” definition like this:
server {
listen 443;
ssl on;
ssl_certificate /srv/certs/le.example.com/fullchain.pem;
ssl_certificate_key /srv/certs/le.example.com/key.pem;
server_name le.examle.com;
// rest of your config
}
If you’d also like to redirect all HTTP traffic to SSL, add the following server definition:
server {
listen 80;
server_name le.example.com;
return 301 https://$server_name$request_uri;
}
Make sure you didn’t make any syntax errors:
# nginx -t
If all went well, just restart nginx:
# systemctl restart nginx
And that’s it! You should now be able to open https://le.example.com and http://example.com should redirect to the former.
Finally, let’s set a cronjob to automatically update our certificate when needed. Open up root’s crontab with:
# crontab -e
and add the following lines:
# Update lets encrypt certs for le.example.com 00 1 * * * cd /srv/certs/le.example.com && /usr/bin/simp_le -d le.example.com:/path/to/my/webroot -f key.pem -f cert.pem -f fullchain.pem && systemctl reload nginx
This will check your certificates once every day and, if necessary, update them and reload nginx (It won’t be reloaded if no update is required).
I hope this guide is useful to someone willing to try out Let’s Encrypt. If you have any question, do let me know in the comments.
