Skip to main content

Set up SSL

  1. SSH into the new server
  2. Ensure that the server has been fully installed, and an instance has been installed as well
    1. To install run: ts install
  3. Solution 1, SSL offload using nginx
    1. Install nginx, run: ts install-proxy
    2. Setup a proxy, run: ts setup-proxy
  4. Solution 2, SSL connector in Tomcat
    1. Run: ts install-routing
  5. Install certbot, run: ts install-ssl
  6. When the install finishes, select Y, or run: ts setup-ssl
  7. Follow the prompts

 

Old implementation

The following is the old, manual, way of installing SSL certs.

Tomcat 7 automatic installation

Using the TS commandline tools, you specify the domain and your email

  tsinstallssl.sh server.acme.com [email protected]

After a couple of minutes you will be rquired to enter the domain an email again, and accept the terms of service

Tomcat 7 manual installation

Install and configure letsencrypt

Download an build certbot (letsencrypt client)

sudo yum -y install python27-devel git (deprecated)
sudo yum -y install python36 python36-pip
sudo yum -y install git-all
sudo git clone https://github.com/letsencrypt/letsencrypt /opt/letsencrypt
/opt/letsencrypt/letsencrypt-auto --debug --agree-tos

Create a config file

sudo touch /etc/letsencrypt/config.ini
sudo chmod 777 /etc/letsencrypt/config.ini
sudo echo "rsa-key-size = 4096" >> /etc/letsencrypt/config.ini
sudo echo "email = [email protected]" >> /etc/letsencrypt/config.ini

Generate PKCS12 certificate

Generate a certificate

sudo mkdir /usr/share/tomcat7/webapps/ROOT
/opt/letsencrypt/letsencrypt-auto certonly --debug --webroot -w /usr/share/tomcat7/webapps/ROOT -d letsencrypt.tempusserva.dk --config /etc/letsencrypt/config.ini --agree-tos

Convert to pkcs12 format

  sudo -s

cd /etc/letsencrypt/live/letsencrypt.tempusserva.dk
openssl pkcs12 -export -out bundle.pfx -inkey privkey.pem -in cert.pem -certfile chain.pem -password pass:TempusServaSecret
chmod 755 bundle.pfx
chmod 755 /etc/letsencrypt/live
  Press: ctrl + d

Install certificate in Tomcat

Edit Tomcat configuration

sudo nano  /usr/share/tomcat7/conf/server.xml
          <Connector
          protocol="org.apache.coyote.http11.Http11NioProtocol"
          port="8443" maxThreads="200"
          scheme="https" secure="true" SSLEnabled="true"
          keystoreFile="/etc/letsencrypt/live/letsencrypt.tempusserva.dk/bundle.pfx" keystorePass="TempusServaSecret"
          ciphers="TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA256,TLS_RSA_WITH_AES_128_CBC_SHA"
          clientAuth="false" sslProtocol="TLS" keystoreType="PKCS12"/>

Reboot the server

service tomcat7 restart

Automated renewals

Before starting test that the renewal process works

/opt/letsencrypt/letsencrypt-auto renew --dry-run

Make sure the path is accessible from cron

 sudo chmod go+x /etc/letsencrypt/archive
 sudo chmod go+x /etc/letsencrypt/live

Make a script file

sudo nano /usr/bin/tsrefreshcerts.sh

.... containing the following commands

/opt/letsencrypt/letsencrypt-auto renew
cd /etc/letsencrypt/live/letsencrypt.tempusserva.dk
openssl pkcs12 -export -out bundle.pfx -inkey privkey.pem -in cert.pem -certfile chain.pem -password pass:TempusServaSecret
/usr/bin/tstomcatrestart.sh

Now add a job to the crontab

 sudo crontab -l > tempcron
 echo "0 0 1 * * /usr/bin/tsrefreshcerts.sh" >> tempcron
 sudo crontab tempcron
 rm tempcron

Problems with Amazon Linux?

In case the autorenewal process fails try updating the dependencies and pip

 sudo /opt/eff.org/certbot/venv/bin/pip2 install cryptography zope interface 
 sudo /opt/eff.org/certbot/venv/bin/pip2 install --upgrade pip
 sudo rsync -avz /opt/eff.org/certbot/venv/lib64/python2.7/dist-packages/ /opt/eff.org/certbot/venv/lib/python2.7/dist-packages/


Still got problems with Amazon Linux?

In case certbot cant find the root folder try and run it manually

 sudo /opt/letsencrypt/letsencrypt-auto certonly

Choose the following values when prompted

 2: Place files in webroot directory (webroot)
 <domain>  
 2: Renew & replace the cert (may be subject to CA rate limits)
 /usr/share/tomcat7/webapps/ROOT/


Need manual crontab install?

Steps

  • sudo crontab -e
  • press INSERT
  • move to bottom of file
  • paste this
  0 0 1 * * /usr/bin/tsrefreshcerts.sh
  • press ESC
  • press :wq
Back to top