Let's Encrypt -

Change on 9.8.24

I decided that it was time to stop paying $400-$500 a year on Godaddy Certificates and switch to Let’s Encrypt. It was a big change from 2 year certificates to those that renew every 90 days. Many changes needed to be made in order to get Let’s Encrypt to work.

Install Let’s Encrypt on Ubuntu 22.04

I spent time fixing the DNS entries on Godaddy.com for each of my domains. I added CAA record for letsencrypt.org similar to the one for godaddy.com. I had to fix issues in the conf file that the apache 2 config test didn’t find.

I had to add a Let’s Encrypt E5 CA Root certificate to the Fortinet 60E. The new certificate require this certificate to pass SSL Labs tests on web sites.

Make sure all redirects end in /

<VirtualHost *:80>
     ServerName mc.scsiraidguru.com
     Redirect permanent / https://mc.scsiraidguru.com/
</VirtualHost>

SSLCACertificateFile has been deprecated in Apache 2.4.8

SSLCertificateChainFile /etc/letsencrypt/live/xxxx/fullchain.pem
SSLCertificateFile /etc/letsencrypt/live/xxxx/cert.pem
SSLCertificateKeyFile /etc/letsencrypt/live/xxxx/privkey.pem

Add to protocols

SSLProtocol -all +TLSv1.3 +TLSv1.2
Protocols h2 h2c http/1.1 acme-tls/1