I promised a blog post detailing changes I needed to make to my apache config in order to move BRBcoffee to Https, but in hindsight there isn’t much to write about it, it’s basically just a refactor.
Certbot, the tool from EFF (written in Python, yay!) that gets ssl certs from Let’s Encrypt, doesn’t work with monolithic conf files with multiple hosts. I run all my projects on the same server, routing traffic based on the site address using apache’s VirtualHost directive. It used to look like this:
<VirtualHost *:80> DocumentRoot "/var/www/blog" ServerName blog.brbcoffee.com # Some more directives </VirtualHost> <VirtualHost *:80> DocumentRoot "/var/www/archive" ServerName archive.brbcoffee.com # Some more directives </VirtualHost> <VirtualHost *:80> ProxyPreserveHost On ProxyRequests Off ServerName cv.brbcoffee.com ProxyPass / http://localhost:5000/ ProxyPassReverse / http://localhost:5000 </VirtualHost>
So what you need to do is rip all of that out, you don’t want it in there. In their place you want this:
IncludeOptional conf.d/*.conf
Depending on your packager, it may be that this directive is already somewhere in your httpd.conf file. If it is, great, just leave it be. After that you want to take each VirtualHost that you ripped out of the main httpd.conf, and place them in individual files, like so:
<VirtualHost *:80> DocumentRoot "/var/www/blog" ServerName blog.brbcoffee.com # Some more directives </VirtualHost>
blog.conf
The configuration doesn’t change, it just needs to be in separate file for certbot to be able to do its thing. You see, after certbot goes out and gets your certificates it needs to add some rules to each vhost for redirecting traffic to ssl, which I guess they didn’t want to write a lot of ugly parsing code to be able to do in a program that really isn’t about that (although it should be trivial with BeautifulSoup.
Anyway, before, running certbot –apache probably didn’t work, it got the certs for you, but couldn’t edit your conf to do what we want. Now, when you run it, it’ll complete just fine. If you chose to set all traffic to go to https, it will add three redirect lines to your conf files, and it will create a new file as well, in my case, blog-le-ssl.conf. It’s identical to the old conf file, except that it is on port 443, and that it checks that mod_ssl is loaded. All of this is stuff we could have done ourselves, of course, but it’s a convenience thing.
So that’s all there is to it. Refactor your httpd.conf by separating each virtualhost into a different file, and run certbot –apache again.