Debian 12 bookworm
Sponsored Link

Apache2 : Configure mod_md2023/07/04

Install and Configure [mod_md] to automate managing certificates from Let's Encrypt.
It's possible to configure for each VirtualHost.
And it's not need to configure manual SSL/TLS setting like here for the Site with [mod_md].
Also it needs that it's possible to access from the Internet to the Site with [mod_md] because of verification from Let's Encrypt.
[1] Install [mod_md].
apt -y install libapache2-mod-md
[2] Configure [mod_md].
vi /etc/apache2/conf-available/acme.conf
# create new

MDBaseServer              on
MDCertificateProtocol     ACME
MDCAChallenges            http-01
MDDriveMode               auto
MDPrivateKeys             RSA 2048
MDRenewWindow             33%
MDStoreDir                md

<Location "/md-status">
    SetHandler md-status
    Require ip

# [MDRenewWindow]
# default is [33%] if not specified
# if validity of certificates falls specified duration,
# [mod_md] will get new certificates
# 90 days * 33% ≒ 30 days
# if you'd like to set with day, specify [d]
# 30 days ⇒ [30d]

# [MDStoreDir]
# the directory certificates or other data are stored
# if not specified, default is [md]
# it is relative path from [ServerRoot] in [httpd.conf]

# [md-status]
# monitor MD status
[3] Configure each VirtualHost you'd like to set [mod_md].
It needs to specify valid email address for each [ServerAdmin] directive because Let's Encrypt will send various notification.
# for example, set on the site [] site

vi /etc/apache2/sites-available/
MDCertificateAgreement accepted
DirectoryIndex index.html

<VirtualHost *:80>
    DocumentRoot /var/www/rx-9

<VirtualHost *:443>
    SSLEngine on
    DocumentRoot /var/www/rx-9

a2enmod md

Enabling module md.
To activate the new configuration, you need to run:
  systemctl restart apache2
a2enconf acme

Enabling conf acme.
To activate the new configuration, you need to run:
  systemctl reload apache2

Enabling site
To activate the new configuration, you need to run:
  systemctl reload apache2

systemctl restart apache2
# on initial loading, some validation checks run and
# dumy certificate is created under the directory you set for [MDStoreDir]

ll /etc/apache2/md/domains/

total 12
-rw------- 1 root root 1700 Jul  3 20:00 fallback-privkey.pem
-rw------- 1 root root 1168 Jul  3 20:00 fallback-pubcert.pem
-rw------- 1 root root  596 Jul  3 20:00 md.json

# reload again

systemctl reload apache2
# if all checks passed, valid certificate is gotten

ll /etc/apache2/md/domains/

total 24
-rw------- 1 root root 4895 Jul  3 20:01 job.json
-rw------- 1 root root  654 Jul  3 20:01 md.json
-rw------- 1 root root 1704 Jul  3 20:01 privkey.pem
-rw------- 1 root root 5510 Jul  3 20:01 pubcert.pem
[4] It's possible to confirm expiration date and others of certificate with [openssl] command like follows.
Or it's possible to see them to access to the URL of [md-status] you set on [2].
openssl s_client -connect | openssl x509 -noout -startdate -enddate

depth=2 C = US, O = Internet Security Research Group, CN = ISRG Root X1
verify return:1
depth=1 C = US, O = Let's Encrypt, CN = R3
verify return:1
depth=0 CN =
verify return:1
notBefore=Jul  4 00:01:02 2023 GMT
notAfter=Oct  2 00:01:01 2023 GMT
Matched Content