B4J Tutorial [Server] Using Let's Encrypt on Ubuntu VPS

aeric · Oct 31, 2020

Using self signed certificates (generated by keytool or openssl) in localhost causing my client B4X apps unable to connect using OKHttp so I gave up and just use normal http connection.

javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

javax.net.ssl.SSLHandshakeException: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.

To avoid the above errors, I only use SSL during production with Let's Encrypt.

B4X:

#If RELEASE
    Dim ssl As SslConfiguration
    ssl.Initialize  
    ssl.SetKeyStorePath("/etc/letsencrypt/live/api.puterise.com", "keystore.jks") 'path to keystore file
    ssl.KeyStorePassword = "keystorepassword"
    'ssl.KeyManagerPassword = "passwordkeystore"
    srvr.SetSslConfiguration(ssl, SslPort)
    'add filter to redirect all traffic from http to https (optional)
    srvr.AddFilter("/*", "HttpsFilter", False)
#End If

tchart · Nov 1, 2020

@aeric have you looked at certbot? https://certbot.eff.org/

I use this as it sends reminders when the cetificate is about to expire.

Steps are pretty simple too;

Bash:

sudo apt-get install software-properties-common
sudo add-apt-repository universe
sudo apt-get update

sudo apt-get install certbot

certbot certonly --standalone

Follow the prompts, use a real email as it will remind you when the cert is about to expire.

Then to renew just run this;

Bash:

cerbot renew

The renew command is great as you can run it as often as you want and it will only renew when its time - so for example you can run this on startup of your server.

To convert to a Java keystore I use this script (run from my app directory - note this replaces the entire keystore);

Bash:

rm jetty.keystore

# convert certificate chain + private key to the PKCS#12 file format
openssl pkcs12 -export -out keystore.pkcs12 -in /etc/letsencrypt/live/yourdomain.com/fullchain.pem -inkey /etc/letsencrypt/live/yourdomain.com/privkey.pem -name jetty -passout pass:keystorepassword

# convert PKCS#12 file into Java keystore format
/opt/jdk/jdk-11.0.2/bin/keytool -importkeystore -srckeystore keystore.pkcs12 -srcstoretype PKCS12 -destkeystore jetty.keystore -storepass keystorepassword -srcstorepass keystorepassword

# don't need the PKCS#12 file anymore
rm keystore.pkcs12

TILogistic · Nov 2, 2020

Other for Cpanel VPS :

cPanel Blog: Product News, Tips & Hosting Insights | cPanel

Stay up to date with the latest cPanel news, product updates, expert tips, and hosting industry insights. Explore articles to help you grow and manage smarter.

blog.cpanel.com

If you don't have cpanel install webadmin:

Webmin

Powerful and flexible web-based server management control panel

www.webmin.com

aeric · Jan 28, 2021

I forgotten to renew the certificate. It has expired today. So now I am trying to renew.

Installing certbot in Ubuntu 18.04 (using snap).

Bash:

root@computerise:~# sudo snap install certbot --classic
error: system does not fully support snapd: cannot mount squashfs image using
       "squashfs": mount: /tmp/sanity-mountpoint-561435955: mount failed:
       Operation not permitted.

~~It says that Ubuntu 18.04 should already have snap but it turned out that the version I installed in the VPS doesn't have snap.~~ (Snap is actually installed but not working)

Bash:

$ sudo apt update
$ sudo apt install snapd

Try again but still the same error.

Trying to update linux kernel. (this step is unnecessary)
https://dausruddin.com/ubuntu-syste...d-cannot-mount-squashfs-image-using-squashfs/

Bash:

$ sudo apt install linux-image-generic-hwe-18.04 linux-headers-generic-hwe-18.04

Bash:

$ sudo reboot

Not success in updating the kernel 5.0.4. Tried install other kernels. (this step is unnecessary)

Update linux kernel using "traditional way" (this step is unnecessary)
https://hostadvice.com/how-to/how-to-update-and-upgrade-your-linux-kernel/

Bash:

$ uname -sr
$ sudo apt-get update
$ sudo apt-get dist-upgrade

Try again but still not get it to work with snap. Then I found:
https://community.letsencrypt.org/t...-mount-squashfs-image-using-squashfs/132689/6

Bash:

$ sudo systemd-detect-virt
openvz

Meaning my VM is not supported.

Install certbot (without snap)

Bash:

$ sudo apt install certbot

Installation done.

Bash:

$ ./letsencrypt-auto certonly --standalone -d api.puterise.com

Upgrading certbot-auto 1.9.0 to 1.11.0...
Replacing certbot-auto...
Your system is not supported by certbot-auto anymore.
Certbot will no longer receive updates.
Please visit https://certbot.eff.org/ to check for other alternatives.
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator standalone, Installer None
Cert is due for renewal, auto-renewing...
Renewing an existing certificate
Performing the following challenges:
http-01 challenge for api.puterise.com
Cleaning up challenges
Problem binding to port 80: Could not bind to IPv4 or IPv6.

So, now there is a problem with apache.

Bash:

Problem binding to port 80: Could not bind to IPv4 or IPv6.

Solution: https://community.letsencrypt.org/t...lugin-does-not-appear-to-be-installed/95682/2

Bash:

$ sudo apt-get update
$ sudo apt-get install python-certbot-apache
$ sudo service apache2 start

Try renew again:

Bash:

$ certbot renew

Saving debug log to /var/log/letsencrypt/letsencrypt.log

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Processing /etc/letsencrypt/renewal/api.puterise.com.conf
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Attempting to parse the version 1.9.0 renewal configuration file found at /etc/letsencrypt/renewal/api.puterise.com.conf with version 0.27.0 of Certbot. This might not work.
Cert is due for renewal, auto-renewing...
/etc/letsencrypt/options-ssl-apache.conf has been manually modified; updated file saved to /usr/lib/python3/dist-packages/certbot_apache/options-ssl-apache.conf. We recommend updating /etc/letsencrypt/options-ssl-apache.conf for security purposes.
Plugins selected: Authenticator apache, Installer apache
Renewing an existing certificate
Performing the following challenges:
http-01 challenge for api.puterise.com
Waiting for verification...
Cleaning up challenges

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
new certificate deployed with reload of apache server; fullchain is
/etc/letsencrypt/live/api.puterise.com/fullchain.pem
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Congratulations, all renewals succeeded. The following certs have been renewed:
/etc/letsencrypt/live/api.puterise.com/fullchain.pem (success)
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

taada...
Now restart my B4J server apps.

OliverA · Jan 29, 2021

aeric said:
Now restart my B4J server apps

You’ll have to recreate your keystore file. Otherwise the jServer will not use the new certificate

aeric · Jan 29, 2021

OliverA said:
You’ll have to recreate your keystore file. Otherwise the jServer will not use the new certificate

Right, I need to rerun the steps above.

aeric said:
Now, to make it work on B4J JRDC2 app:

OliverA · Jan 29, 2021

aeric said:
Your system is not supported by certbot-auto anymore

certbot-auto has been deprecated. See: https://certbot.eff.org/lets-encrypt/ubuntubionic-other. Looks like the new certbot has some pre and post hooks that could be used to
pre-hook: stop jServer
post-hook: create/update keystore and start jServer

aeric · Jan 29, 2021

OliverA said:
certbot-auto has been deprecated. See: https://certbot.eff.org/lets-encrypt/ubuntubionic-other. Looks like the new certbot has some pre and post hooks that could be used to
pre-hook: stop jServer
post-hook: create/update keystore and start jServer

Unfortunately the VPS image I am using does not support update to latest version. Until it stops working one day, I just leave it first. The purpose of the VPS is just for my experiment and demo. It is the cheapest VPS hosting package with very minimum specs. If one day I need a real production server, I will take note on this. Thanks.

aeric · Jan 29, 2021

tchart said:
I use this as it sends reminders when the cetificate is about to expire.

Actually I did receive email from Let's Encrypt Expiry Bot. I just ignored it. My bad. ?

OliverA · Jan 29, 2021

aeric said:
Unfortunately the VPS image I am using does not support update to latest version

What version are you looking for? For 18.0.5 LTS it seems to be 0.27 (that's what I have running). I use it to renew (manually) my certs. I just tried

Bash:

sudo certbot renew --dry-run

and it works fine

aeric · Jan 29, 2021

OliverA said:
What version are you looking for? For 18.0.5 LTS it seems to be 0.27 (that's what I have running). I use it to renew (manually) my certs. I just tried

Bash:

sudo certbot renew --dry-run

and it works fine

My certbot is still working. It just prompt me that it might not working...

aeric said:
Attempting to parse the version 1.9.0 renewal configuration file found at /etc/letsencrypt/renewal/api.puterise.com.conf with version 0.27.0 of Certbot. This might not work.
Cert is due for renewal, auto-renewing...

OliverA · Jan 29, 2021

That (the updated config file) may have happened when you tried to upgrade it via snap (instead of just letting apt-get do it).

aeric · Jan 29, 2021

OliverA said:
That (the updated config file) may have happened when you tried to upgrade it via snap (instead of just letting apt-get do it).

I didn't use snap. I think the conf file is automatic updated when updating the apache plugin.

ilan · Apr 28, 2021

very nice tutorial thanx aeric.
i have a server running on a google cloud VM instance running Debian 10. i managed to create an SSL certificate from let's encrypt using certbot. everything works fine. if i enter the site from my mobile phone I see the lock left to my domain and also at home but at my work i get a security warning "NOT SECURE". what could be the reason? it may be the firewall security at my work but why can i access other websites over HTTPS like b4x and much more? could it be that the lets encrypt certificate is not good enough?

aeric · Apr 28, 2021

ilan said:
very nice tutorial thanx aeric.
i have a server running on a google cloud VM instance running Debian 10. i managed to create an SSL certificate from let's encrypt using certbot. everything works fine. if i enter the site from my mobile phone I see the lock left to my domain and also at home but at my work i get a security warning "NOT SECURE". what could be the reason? it may be the firewall security at my work but why can i access other websites over HTTPS like b4x and much more? could it be that the lets encrypt certificate is not good enough?

I don’t think this is because let’s encrypt is not good enough. Have you try restart the browser because I suspect the browser is loading old cache. Refresh and click the “i” near the lock and see is the certificate is valid.

aeric · Apr 29, 2021

My certificate should be expired in June but reported that it expired yesterday. So I force certbot to renew using the following command:

B4X:

certbot renew --force-renewal

yfleury · Apr 10, 2023

./letsencrypt-auto certonly --standalone -d reseau-municipal
Skipping bootstrap because certbot-auto is deprecated on this system.
Your system is not supported by certbot-auto anymore.
Certbot cannot be installed.
Please visit https://certbot.eff.org/ to check for other alternatives.

aeric · Apr 10, 2023

Are you running the following command:

Bash:

$ sudo apt install certbot

yfleury · Apr 11, 2023

Just for the followers, remove $ sign

B4X:

sudo apt install certbot

B4J Tutorial [Server] Using Let's Encrypt on Ubuntu VPS

Expert

Well-Known Member

Expert

Expert

Expert

Expert

Expert

Expert

Expert

Expert

Expert

Expert

Expert

Expert

Expert

Expert

Active Member

Expert

Active Member

Similar Threads