Get a free Let's Encrypt certificate

HTTPS is what puts the padlock in the browser and keeps passwords and sessions private on the way to your server. SrvYard gets the certificate for you from Let's Encrypt, a free certificate authority, installs it in Nginx, and renews it before it expires. You never run certbot yourself.

This article covers the whole life of a certificate: what to check first, how to issue one with HTTP validation (the usual way) and with DNS validation (for wildcards and sites that are not online yet), what the certificate card tells you, how automatic renewal and expiry alerts work, how to switch the whole site to HTTPS, and what to do when issuing fails.

Before you begin#

• A site in the Ready state on a connected server. See Create a site on your server.
• Every name must point at the server (HTTP validation). The domain's A record (and AAAA, if you use IPv6) has to lead to the server's IP address. SrvYard checks the DNS records before it asks Let's Encrypt and lists any name that does not point at the server, so a wrong record is reported in seconds instead of after a failed attempt. A free srvy.sh name is pointed at your server for you.
• Port 80 must be open to the internet. Let's Encrypt proves you control the name by fetching a small file from your site over plain HTTP. Do not close port 80 afterwards either: renewals use it too. If you use a firewall rule set, keep 80 and 443 open.
• For DNS validation, a connected Cloudflare account whose zone contains the domain. Connect it under Integrations in the sidebar.
• The right permission. Members who can only view a site cannot request or delete certificates.

1. Open the SSL tab#

Open the site and choose SSL. What you see depends on the site's state.

1. Get a free certificate. Issues a Let's Encrypt certificate. This is what you want in almost every case.
2. Install your own. For a certificate you bought. See step 5.

The card says No certificate yet and repeats the two requirements: every name of the site must point at the server's IP address, and port 80 must be open.

2. Request the certificate#

Press Get a free certificate. A panel opens from the right.

1. HTTP validation. Let's Encrypt fetches a file from your site on port 80. The names must point at this server. This is the default and the right choice for ordinary sites.
2. DNS validation. SrvYard adds a TXT record in Cloudflare instead. It works for wildcard names and for sites that are not reachable yet. See step 3.
3. Hostnames. Every domain of the site is listed with a tick box, normally both the bare name and its www. version. Untick a name you do not want on the certificate. Wildcard names such as *.example.com need DNS validation and are not offered here.
4. Key type. ECDSA (secp384r1) is smaller and faster and is the default. RSA 2048 exists for very old clients that cannot read ECDSA certificates. Keep the default unless you know you need RSA.
5. Get certificate. Starts the request.

Under the fields, Before you continue repeats what SrvYard will do: check that every name points at the server's IP, require port 80, show the output live, and replace the certificate in use only when the new one was issued and Nginx accepted it. If anything goes wrong, the site keeps serving what it served before.

After you press Get certificate the output appears line by line. A normal request takes under a minute. When it succeeds the certificate is activated, Nginx is reloaded, and the card on the SSL tab shows it as In use.

3. Use DNS validation for wildcards#

Choose DNS validation when:

• you want one certificate that covers every subdomain (*.example.com);
• the site is not reachable from the internet yet, for example while the DNS record still points at an old host;
• port 80 cannot be opened.

1. DNS validation is selected.
2. DNS integration appears, with the Cloudflare connection to use, and Hostnames now offers the wildcard name (for example *.acme-shop.example) with an empty tick box.

Tick the names you want, choose the integration and press Get certificate. The domain must be a zone in the connected Cloudflare account: SrvYard looks the zone up for every name and refuses the request when it is missing. Validation takes about a minute, and the TXT record is removed again afterwards. The panel says so too.

If you later remove the Cloudflare connection, certificates issued through it stay valid, but they cannot be renewed. SrvYard tells you to connect Cloudflare again and request a new certificate.

4. Read the certificate card and force HTTPS#

1. Get a free certificate is also how you add a second certificate, for example one with different names. Only one certificate is in use at a time; the others are kept, so you can switch back.
2. Certificate in use. The badge and the line under it say what kind it is (here a free Let's Encrypt certificate). Next to it are Renew now, Deactivate and Delete.
3. The details. Covers lists every name on it. Issuer is the intermediate that signed it. Issued and Expires show the dates, with the days left. Validation says HTTP (port 80) or DNS. Files on the server is where the certificate lives, under /etc/srvyard/ssl. Renewal says Automatic and when it last renewed.
4. Force HTTPS. Redirects every HTTP request to HTTPS and sends the HSTS header, which tells browsers to use HTTPS for this site from now on. Turn it on once the site works over HTTPS, so you never lock yourself out of a site that is still broken. The switch needs an active certificate.

Port 80 stays open even with Force HTTPS: it is used to renew Let's Encrypt certificates. Certificates are stored encrypted in SrvYard, and the keys on the server are readable by root only.

5. Install a certificate you bought#

Press Install your own when your organisation requires a certificate from a specific authority.

1. Certificate. Paste your certificate first, optionally followed by the intermediate certificates.
2. Private key. Paste it without a passphrase. It is stored encrypted and never shown again.
3. Intermediate certificates (optional). If your authority gave you the chain separately, paste it here.

SrvYard checks that the key matches the certificate with OpenSSL before anything reaches the server. A custom certificate is not renewed automatically. SrvYard emails the organisation's owners and admins before it expires, and you install the new one the same way.

6. Renewal, alerts and what to do when it fails#

Renewal is automatic. Every Let's Encrypt certificate is queued for renewal when it has 30 days or less left. You do not have to do anything, and Renew now exists for the day you want to renew immediately. Let's Encrypt certificates last 90 days, so a healthy site renews itself about every two months.

Alerts. SrvYard emails owners and admins when an active certificate has 14 days or less left, has expired, or has failed to renew. Treat the email as a to-do item: it is sent because the automatic renewal did not work.

Retries. A failed request for a new certificate is tried again: three attempts in total, 30 minutes apart, and the status shows where it stands ("Attempt 2 of 3 failed, retrying at 14:30"). When the last attempt fails the certificate is marked Failed. If the renewal of a certificate that is in use fails, the certificate card turns red with The last renewal or change failed, the message says the certificate in use was not touched, and the renewal is retried daily until it works or the certificate expires.

1. No certificate in use. This site is set to redirect to HTTPS, but there is nothing to serve over HTTPS. Visitors see an error. Fix this first (see below), or turn Force HTTPS off in the site's Settings to get the site back over HTTP while you investigate.
2. Failed after 3 attempts. Hover the status in the list to see the error that was recorded for the last attempt.
3. Retry now. Runs the request again with the same settings. Use it after you have fixed the cause.

The usual causes:

• A name does not point at the server. The check names the host and shows the records it found, for example does not point at 203.0.113.10 (AAAA: none). Fix the DNS record and press Retry now. A stray AAAA record that points somewhere else is a very common culprit: Let's Encrypt prefers IPv6.
• Port 80 is closed. Open it in the server's firewall rules and at your cloud provider. A site that redirects all HTTP to another host before the certificate is issued can also fail the challenge.
• Rate limits. Let's Encrypt allows only a limited number of certificates per week for one registered domain, and a shared zone such as srvy.sh hits that limit faster. Wait, or use your own domain.
• The zone is missing in Cloudflare (DNS validation). The domain must belong to the connected account.

Troubleshooting#

• The browser says the connection is not private after I turned on Force HTTPS. The certificate does not cover the name you are visiting, for example www. was unticked. Request a new certificate with all names ticked.
• The padlock shows a warning for mixed content. The page loads an image or script over http://. Change the links in your application to https:// or to relative URLs.
• "Get a free certificate" runs but the site still shows the old certificate. The old one is replaced only when the new one was issued and Nginx accepted it. Read the output of the request, then check the Renewal line.
• I added a domain to a site that already has a certificate. The new name is not on the certificate yet. Press Get a free certificate again with the new name ticked.
• A wildcard request is rejected. HTTP validation cannot issue wildcards. Choose DNS validation.
• I need the certificate on another server. Request a separate one there; certificates belong to one site on one server.

Related#

• Create a site on your server: choose the domain and the www redirect that the certificate will cover.
• Write and test a deploy script: HTTPS first, then connect CI to the deploy hook.
• SSL: custom certificates and renewals.