{"id":184,"date":"2017-12-17T11:44:41","date_gmt":"2017-12-17T11:44:41","guid":{"rendered":"https:\/\/learningcurve.xyz\/?p=184"},"modified":"2017-12-19T04:49:47","modified_gmt":"2017-12-19T04:49:47","slug":"alibaba-cloud-3-lets-encrypt-ssl","status":"publish","type":"post","link":"https:\/\/learningcurve.xyz\/?p=184","title":{"rendered":"Alibaba Cloud 3 – Let’s Encrypt SSL"},"content":{"rendered":"

Welcome to the third tutorial in this series about installing WordPress and a performant server stack on an Alibaba ECS Cloud Instance.<\/p>\n

In the previous two tutorials, we provisioned and secured our Ubuntu 16.04 server <\/a> installation, then completed the LEMP stack with NGINX, MariaDB and PHP7<\/a>. Today we are going to configure a Domain to work with our server, and secure everthing with an SSL certificate so our final WordPress site can only be accessed via HTTPS. In the next tutorial we will complete the series by installing WordPress<\/a>, and configuring transactional emails.<\/p>\n

As with all of these tutorials, the instructions should generally stand for any of the main cloud providers. This tutorial has some steps specific to Alibaba Cloud, mainly regarding configuring the security group for inbound access to port 443, but they are minor and can be skipped over for other providers.<\/p>\n

\n

A few words about Domain Registration<\/h4>\n

Many people will register a domain through their hosting company, I recommend against that. I much prefer to keep my domain registration and hosting separate, this provides a more robust framework in case of unseen problems with your hosting providers infrastructure. That is to say, if your hosting goes down but your domain is registered elswhere, then it is very easy to just change your nameservers and get your site back online quickly.<\/p>\n<\/div>\n

I recommend Namecheap<\/a> or iwantmyname<\/a>\u00a0for domain registry, they are primarily domain registrars and resolve DNS and Nameserver changes quickly.<\/p>\n

It goes without saying that you’ll need to have a registered domain to use for this tutorial, in my case I have a domain registered with Namecheap specifically for testing purposes and tutorials, the aptly chosen an-example-domain.com<\/a><\/p>\n

Part One – Configuring your Domain<\/h2>\n

Step 1. Add a Domain to Alibaba Cloud DNS<\/h2>\n

Visit your Alibaba ECS console and make your way to the Alibaba Cloud DNS section. Then click the blue button in the top left to add a Domain Name:<\/p>\n

\"\"
Add a domain in Alibaba Cloud DNS<\/figcaption><\/figure>\n

A pop up box will appear with a text entry field, enter your domain name here and confirm:<\/p>\n

\"\"
Enter your domain and confirm<\/figcaption><\/figure>\n

Your domain will now appear in the list of Domain Names in the Alibaba Cloud DNS settings page.<\/p>\n

Now we need to configure some DNS records to get everything working properly. Click the configure link that is highlighted in the screenshot below:<\/p>\n

\"\"
Click the link to configure DNS records<\/figcaption><\/figure>\n

The link will take you to a configurations page where you can add your DNS records:<\/p>\n

\"\"
Alibaba DNS gives you Nameserver redirection instructions<\/figcaption><\/figure>\n

In my case, as mentioned earlier, my domain is registered with a third party domain registrar, that means my domain is using my registrar’s domain name server. As you can see in the screenshot above, Alibaba cloud DNS immediately checks the records and throws a warning telling me that I need to change my domain’s nameservers.<\/p>\n

Step 2. Change Nameservers at your domain registrar<\/h2>\n

To do that, go to your domain registrar and locate the setting for DNS. Somewhere in the settings there will be a button for ‘Change Nameservers’ or ‘Use Custom Nameservers’, or something similar. With my domain at Namecheap it’s found in a dropdown called ‘Custom DNS’ under the ‘Nameservers’ setting, illustrated below:<\/p>\n

\"\"
Change your domain nameservers with your domain registrar<\/figcaption><\/figure>\n

Enter the nameservers provided by Alibaba and click save.<\/p>\n

Step 3. Enter DNS records<\/h2>\n

Now return to the Alibaba Cloud DNS settings page, and add DNS records for your domain. For this tutorial we are only adding two A<\/span> records. A<\/span> records are for your server’s ipv4 address, if this were a production site you would also need to add matching AAAA<\/span> records for ipv6 address, and several other records, such as an MX<\/span> record for your email server etc.<\/p>\n

Add one type A<\/span> record for the Host @<\/span>, and another for the Host www<\/span>. The shortest TTL (Time Till Live) setting allowed by Alibaba’s DNS system is 10 minutes, which means that these changes will take at least that long to take effect on their end, although for changes to propagate across the internet can take up to 24 hours or more.<\/p>\n

Your settings should look something like this:<\/p>\n

\"\"
Configure the domains A records<\/figcaption><\/figure>\n

Did I mention that I find that changes in DNS settings made with dedicated domain registrars tend to propagate faster than with hosting providers? I did, my apologies for belaboring a point.<\/p>\n

In any case, you can check to see if your DNS changes have propagated with a service like whatsmydns.com<\/a> or by using the Domain Information Groper<\/a> dig<\/span> terminal command.<\/p>\n

Step 4. Test your domain<\/h2>\n

Once these changes have propagated you should be able to visit your site by using the domain, with or without the www subdomain:<\/p>\n

\"\"
http:\/\/an-example-domain.com<\/figcaption><\/figure>\n
\"\"
http:\/\/www.an-example-domain.com<\/figcaption><\/figure>\n

Now we have our domains configured properly so we can visit our server with a url, we can begin to install our SSL certificates.<\/p>\n

Part Two – Securing NGINX with Let’s Encrypt SSL certificates<\/h2>\n

The web is moving towards a more secure future. SSL certificates protect visitors of your site by enabling HTTPS encryption on web servers. In the past SSL certificates were a moderately expensive addition to your hosting deemed only necessary for eCommerce sites or other sites that transmitted sensitive information.<\/p>\n

Things have changed since those days, now it is considered best practice in web development to secure all sites with an SSL certificate. This has additional benefits to just increasing security, the latest generation of the HTTP protocol, HTTP\/2, requires an SSL certificate to be installed before it can be used. HTTP\/2 can dramatically increase the speed of a well configured site due to a range of improvements such as Single Connection Loads, Multiplexing, Header Compression, and more. You can find out more about HTTP\/2 here<\/a>.<\/p>\n

There is also the not inconsequential matter that sites without SSL certificates are now being penalised by Google, with Chrome even throwing warnings for unsecured sites.<\/p>\n

Let’s Encrypt<\/a>\u00a0is a free, automated, and open certificate authority (CA) provided by the Internet Security Research Group<\/a>, they have almost single-handedly accelerated the widespread adoption of SSL certificates in recent years, we should all be very grateful.<\/p>\n

We will be using the Let’s Encrypt Certbot to obtain a free SSL certificate, Certbot is an awesome package that will automatically make most of the necessary NGINX configuration changes.<\/p>\n

Step 5. Configuring Ubuntu to enable access to external repositories<\/h2>\n

We will be installing the certbot<\/span> software from Let’s Encrypt’s separate external repository. That means we will need to add a new repository to our apt<\/span> package manager.<\/p>\n

Unfortunately our Instance’s Ubuntu installation doesn’t have the required package installed to allow us to add external repositories.<\/p>\n

Not to worry, that’s a quick fix, just enter the following command to install said package:<\/p>\n

$ sudo apt-get install -y software-properties-common\r\n<\/pre>\n
Step 6. Installing Certbot<\/h2>\n
With that additional package we can now install  certbot<\/span> with the following commands.<\/p>\n
To add the repository:<\/p>\n
$ sudo add-apt-repository ppa:certbot\/certbot\r\n<\/pre>\n
Then update the package list to pick up the new repository’s package information:<\/p>\n
$ sudo apt-get update\r\n<\/pre>\n
And finally, install  certbot<\/span> with  apt-get<\/span>:<\/p>\n
$ sudo apt-get install python-certbot-nginx\r\n<\/pre>\n
Now Certbot is ready to use, but before we can use it, we need to configure NGINX some more.<\/p>\n
Step 7. Setting up NGINX to serve domains<\/h2>\n
Yes I know, I did say Certbot can automatically configure the SSL for NGINX and add the necessary settings in the NGINX configuration file server block. But before it can do that NGINX needs to be configured for your domain name, at present it is only configured for an IP address.<\/p>\n
Let’s update the config file:<\/p>\n
$ sudo nano \/etc\/nginx\/sites-available\/default\r\n<\/pre>\n
Now replace the servers ipv4 address on the  server_name<\/span> line with your domain name, remember to add both the domain with and without  www<\/span> :<\/p>\n
server_name an-example-domain.com<\/span> www.an-example-domain.com<\/span>;\r\n<\/pre>\n
Your NGINX default config file server block should look something like the following:<\/p>\n
\"\"
Configure NGINX for your domain<\/figcaption><\/figure>\n
Since the NGINX config file has been changed, it should be checked for syntax errors again:<\/p>\n
$ sudo nginx -t\r\n<\/pre>\n
All being well, reload it to load in the new configuration:<\/p>\n
$ sudo systemctl reload nginx\r\n<\/pre>\n
With these changes made, Certbot will now be able to locate the correct server block and update it automatically.<\/p>\n
Next we’ll update the UFW firewall to allow HTTPS traffic.<\/p>\n
Step 8. Updating the UFW Firewall<\/h2>\n
The UFW firewall we configured previously in the series has only been configured for HTTP connections, this now needs adjusting to allow HTTPS traffic.<\/p>\n
To do this we will allow ‘Nginx Full’ first:<\/p>\n
$ sudo ufw allow 'Nginx Full'\r\n<\/pre>\n
And then delete the redundant ‘Nginx HTTP’ profile that we previously allowed:<\/p>\n
$ sudo ufw delete allow 'Nginx HTTP'\r\n<\/pre>\n
Finally, check the firewall status with:<\/p>\n
$ sudo ufw status\r\n<\/pre>\n
Your terminal should output the following:<\/p>\n
\"\"
Ubuntu UFW configured for Nginx HTTPS connections<\/figcaption><\/figure>\n
With our firewall configured properly, we would normally be ready to obtain our SSL certificate, but Alibaba Cloud Hosting is a little bit different however.<\/p>\n
Step 9. Configure Alibaba Cloud Security Group for HTTPS connections<\/h2>\n
Remember all that time ago, when we first provisioned the ECS instance, we added it to a Security Group? That\u00a0is Alibaba Cloud nonmenclature for their firewall, so that’s where we need to go now.<\/p>\n
In the Alibaba Cloud Security Groups, you will see the default security group you attached, click the link to configure it’s rules:<\/p>\n
\"\"
Click the link to configure security group rules<\/figcaption><\/figure>\n
For HTTPS connections with an SSL, we need our server to be listening on Port 443. Currently the security group has no rule configured to allow inbound connections to the server on this port.<\/p>\n
Add a rule for Port 443 as follows:<\/p>\n
\"\"
Add an inbound security rule to open Port 443<\/figcaption><\/figure>\n
\"\"
Security group with connections via Port 443 enabled<\/figcaption><\/figure>\n
Now<\/em> we’re ready to run Certbot to obtain and configure our SSL certificates, and configure server settings.<\/p>\n
Step 10. Obtaining a Let’s Encrypt SSL Certificate<\/h2>\n
We will use Certbot’s NGINX plugin to obtain an SSL certificate for our domain, it will automagically take care of configuring NGINX and reloading the config when necessary. Enter the following command, using your own domain name:<\/p>\n
$ sudo certbot --nginx -d domain.com<\/span> -d www.domain.com<\/span>\r\n<\/pre>\n
This command runs  certbot<\/span> with the aforementioned  –nginx<\/span> plugin, and uses  -d<\/span> to specify the domain names for which the certificate will be valid.<\/p>\n
If everything was succesful  certbot<\/span> will check to verify you control your domain, and upon verification will issue your certificate and ask you how you would like to configure your HTTPS settings:<\/p>\n
\"\"
Configure HTTPS redirects<\/figcaption><\/figure>\n
I recommend to configure the redirects so that all traffic is served via HTTPS.<\/p>\n
At this point you will be able to access your site using  https:\/\/<\/span>, and you will get the reassuring green lock and security indicator.<\/p>\n
Step. 11 Increase SSL security – Update Diffie-Hellman Parameters<\/h2>\n
Even though your site is secured with an SSL, it is using weak Diffie-Hellman parameters which means that the initial key exchange is still more vulnerable than we may wish.<\/p>\n
To fix this create a new  dhparam.pem<\/span> file and add it to the  server<\/span> block.<\/p>\n
Create the file using  openssl<\/span>:<\/p>\n
$ sudo openssl dhparam -out \/etc\/ssl\/certs\/dhparam.pem 2048\r\n<\/pre>\n
This may take some time, and will look like this:<\/p>\n
\"\"
Update Diffie-Hellman parameters<\/figcaption><\/figure>\n
When this process is complete, open up the default sites NGINX config file again:<\/p>\n
$ sudo nano \/etc\/nginx\/sites-available\/default\r\n<\/pre>\n
And paste in the following code, this can be anywhere inside the  server<\/span> block:<\/p>\n
ssl_dhparam \/etc\/ssl\/certs\/dhparam.pem;\r\n<\/pre>\n
The entire server block should look like the following, notice the SSL configuration settings that have also been added by  certbot:<\/span><\/p>\n
\"\"
Fully configured server block<\/figcaption><\/figure>\n
Save the file and close the editor. And since we have altered the NGINX configuration again, we will need to check the syntax again:<\/p>\n
$ sudo nginx -t\r\n<\/pre>\n
If there are no errors, reload NGINX:<\/p>\n
$ sudo systemctl reload nginx\r\n<\/pre>\n
The site is now a lot more secure. You can test it using the\u00a0SSL Labs Server Test,<\/a>\u00a0and it should get an A<\/strong>\u00a0rating.<\/p>\n
Step 12. Setting up Certificate Auot Renewal with a Cron job<\/h2>\n
Let’s encrypt certificates are currently only valid for 90 days to encourage users to automate their certificate renewal process, which is exactly what we are going to do.<\/p>\n
To do this we will use a  cron<\/span> job. This is the system Linux uses for running periodic system jobs. To add a  cron<\/span> job we must edit a file called a  crontab<\/span>:<\/p>\n
$ sudo crontab -e\r\n<\/pre>\n
The text editor will open the default  crontab<\/span>, paste the following code at the end of the file, then save it and close it:<\/p>\n
0 0 * * * \/usr\/bin\/certbot renew --quiet\r\n<\/pre>\n
This means run this  \/usr\/bin\/certbot renew –quiet<\/span> command at this  0 0 * * * <\/span> time.<\/p>\n
 0 0 * * *<\/span> translates to every day at midnight. To find out more about cron timings you can visit CronTab.Guru<\/a>.<\/p>\n
The  renew<\/span> command for Certbot will check all certificates installed on the system and update any that are set to expire in less than thirty days.<\/p>\n
The  –quiet<\/span> command tells Certbot not to wait for user input, or output any information.<\/p>\n
Your SSL certificate is now installed, has an A<\/strong> rating, and is configured to renew automatically. Time to test things out.<\/p>\n
Step 13. Test your server for HTTPS connection<\/h2>\n
You should now be able to visit your website by visiting your domain using https:<\/p>\n
https:\/\/an-example-domain.com<\/span>\r\n<\/pre>\n
or<\/p>\n
https:\/\/www.an-example-domain.com<\/span>\r\n<\/pre>\n
\"\"
Visit your site using https:\/\/<\/figcaption><\/figure>\n
And we’re done.<\/p>\n
Your ECS instance should now have a fully installed LEMP stack, with a domain configured, and a secure SSL certificate installed.<\/p>\n
Next up… The final tutorial in this series, let’s get us some WordPress going on.<\/p>\n
See you then<\/p>\n
Jeff<\/p>\n","protected":false},"excerpt":{"rendered":"
Welcome to the third tutorial in this series about installing WordPress and a performant server stack on an Alibaba ECS Cloud Instance. In the previous two tutorials, we provisioned and secured our Ubuntu 16.04 server installation, then completed the LEMP stack with NGINX, MariaDB and PHP7. Today we are going to configure a Domain to […]<\/p>\n","protected":false},"author":1,"featured_media":175,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[5],"tags":[],"_links":{"self":[{"href":"https:\/\/learningcurve.xyz\/index.php?rest_route=\/wp\/v2\/posts\/184"}],"collection":[{"href":"https:\/\/learningcurve.xyz\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/learningcurve.xyz\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/learningcurve.xyz\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/learningcurve.xyz\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=184"}],"version-history":[{"count":5,"href":"https:\/\/learningcurve.xyz\/index.php?rest_route=\/wp\/v2\/posts\/184\/revisions"}],"predecessor-version":[{"id":216,"href":"https:\/\/learningcurve.xyz\/index.php?rest_route=\/wp\/v2\/posts\/184\/revisions\/216"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/learningcurve.xyz\/index.php?rest_route=\/wp\/v2\/media\/175"}],"wp:attachment":[{"href":"https:\/\/learningcurve.xyz\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=184"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/learningcurve.xyz\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=184"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/learningcurve.xyz\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=184"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}