Let’s Encrypt SSL for your website

The entire web is moving to HTTPS encryption thanks Google announcing that starting July, with Chrome 68, all HTTP sites will be marked as “not secure”. They had earlier slightly up-ranked sites with HTTPS to nudge adoption of encryption which seems to have worked to a certain extant. There is of course, the highlighting of unencrypted forms by almost all browsers.

This site is hosted on BigRock which itself resells certificates from Rs.1,425/year (+tax) and costs as much as the hosting itself! If you don’t want such an expensive solution to begin SSL journey with, there is Let’s Encrypt. Let’s Encrypt gives free 3 month certificates that is as good as the best. If you are running on a Linux hosting plan and have CPanel access, here are the steps to set up SSL on your site.

1. Generating a Private Key
   1. Login to cPanel on your Hosting service
   2. In the Security section, click on SSL/TLS Manager
   3. Under Private Keys (KEY), click on Generate, view, upload, or delete your private keys
   4. Set the Key Size to 2,048 bits
   5. Description can be blank; or name it if you want to identify the private key easily (helpful if you have multiple sub-domains)
   6. Click on Generate to generate the Private key and keep it handy
      
2. Generate a Public Key (Certificate Signing Request)
   1. Return to SSL Manager
   2. Under Certificate Signing Requests (CSR), click on Generate, view, or delete SSL certificate signing requests
   3. Select the Key you’ve generated (the name you gave in 1.5 above helps)
   4. Enter your domain name for which you’d like to install SSL
      • If you have subdomains, you can generate Wildcard certificates that allow you to secure a domain and any subdomains under that domain – read the ‘advanced option’ section in the page
   5. Fill in the company details along with the email address
   6. Set a random alphanumeric Passphrase
   7. You can leave the Description blank
   8. Click to Generate the Encoded Certificate Signing (CSR) Request and keep the CSR handy
3. Generate the Certificate – Use anyone of the ACME clients that Let’s Encrypt supports to verify that you control a given domain name and to get your certificate; I used SSL for free and the following steps are for the same.
   1. Goto SSL for free
   2. Enter the domain name for which you’d want the certificate – Note it has to the same as 2.4 above
   3. Chose manual verification
      • All verification options – FTP, manual or manual (DNS) – are fairly easy but I found manual is a breeze
   4. Click on Manual verification
   5.  Follow the steps given
      1. Download the file generated from the link given
      2. Create 2 folders in your domain; “.well-known” > “acme-challenge”
      3. Upload the downloaded files to the “acme-challenge” folder
      4. Verify successful upload by visiting the link given
      5. Check the “I have my own CSR” box
         • Note: SSLforfree can directly generate private keys in your browser using the Web Cryptography API. You can choose this option and not do Steps 1 & 2 above with your hosting service provider.
      6. Paste the CSR generated from 2.8 above
      7. Click Download SSL Certificate
      8. Download the certificate file or copy the CRT and CA Bundle
4. Install the Certificate
   1. Goto your cPanel
   2. In the Security section, Manage SSL sites under Install and Manage SSL for your site (HTTPS)
   3.  Select your domain name for which you want to setup the certificate
   4. Now copy CRT, Private Key and CA Bundle
   5. Click on Install Certificate
   6. Click on OK
5. A few minutes later, check if the site is resolving on HTTPS.
6. Most Linux Hosting providers have the mod_rewrite module enabled and you can make use of this module to automatically redirect visitors from HTTP to HTTPS.  All you need is the following code in .htaccess file
   • RewriteEngine On
   • RewriteCond %{HTTPS} off
   • RewriteRule (.*) https://<common_name>%{REQUEST_URI}
     • The <common_name> needs is the Name for which the Digital Certificate is issued i.e., 2.4 above.
7. Set the Address (URL) to HTTPS
   1. Login to your WordPress site
   2. Goto WordPress Dashboard > Settings > General
   3. Begin both the WordPress Address (URL)  and Site Address (URL) with HTTPS

That’s it, you are done with setting up SSL!