Securing Your Website with Let's Encrypt
Hey there, how's it going everybody? In this video, we're going to secure our web server and enable HTTPS on our website with a free certificate using a service called Let's Encrypt. So I have my website pulled up right now, and we can see in the last video, we set this up so that we have a domain name working, which I have my domain name here as myawesomapp.com. But if we also look at the top left here, we can see that it says "not secure." So this website is not using SSL certificates and that's why it's not secure. And if you go to a website, sometimes they'll have a little lock up here and that means that the website is secure. So in this video, that's what we're going to do. And we're going to do that using a service called Let's Encrypt. And Let's Encrypt is a Certificate Authority that lets anyone obtain, renew, and manage certificates for their site. Now they're a nonprofit and provide all of this for free, and it's easy to get running on our server. So let's go ahead and get started and see how to do this.
Now first, you're going to want to SSH into your server.
Finding Certbot Installation Commands
Now if you're coming to this tutorial and haven't seen the previous videos in this series, then that's not a big deal, but you will need SSH access to your server in order to get this running, and that's something that we covered in previous videos. So once we're in our server, we simply need to run a few commands.
Now, in order to find the commands that you need to run for your operating system, you simply want to go to the Let's Encrypt website, which we have pulled up here, and then you're going to want to go to the getting starting page. And from here, if we look down in the section where we have shell access, we can see that Let's Encrypt recommends the Certbot client, and that makes it super easy to get these certificates working on our server. So I'm going to click on that Certbot link. And once we're on the Certbot website, now we want to choose the web server and operating system that we're using. Now for our Flask series, we're using Nginx and Ubuntu 18.04, so I'm going to select those options, but you want to select whatever web server and operating system that you're using. So that's what I'm doing here. And once we do that, it's going to pull up the documentation and the commands that we need to run for Nginx on Ubuntu 18.04.
Preparing for Certbot Installation
So this gives you all of the commands that you need to run. They also have a lot of explanation as to what you're doing with these commands if you read through this. Now I would suggest you read through the page if you'd like to see more information and detail about these commands. But I have all of these commands pulled up in a text file here on my machine. And I also have these available in my GitHub if anyone would like to follow along and copy these, and I'll leave a link to that in the description section below. So these are the commands that I just took from that Certbot website. And again, this is for Nginx and Ubuntu. So if you're using a different web server or operating system, then you're going to need to get the commands for your server and OS.
Installing Certbot on Ubuntu
Okay, so I also have my server pulled up here in my terminal. So I'm SSH'd into my machine and now we just want to run these commands on the machine. Now, I'm simply going to copy these into the terminal since I'm kind of a slow typer and I'll do these one at a time. So I will go ahead and start here. So I will paste in the first one: sudo apt-get update, and we'll need to put in the sudo password for the first time. And I'll just go through these one at a time.
So this one goes onto the next line here. So this one is sudo apt-get install software-properties-common. So we'll run that. That one went pretty quick. Sudo add-apt-repository, so we're adding a repository called Universe here. So I'll run through that one. Now some of these take a little bit of time, so if you need to pause the video, then you can pick up when these are done, but I'm just going to fast forward to where these are completed with installing. Okay, so that one's actually complete. So now I'll add another repository here, so PPA certbot/certbot. So we'll run that. So this one is asking me to hit Enter to continue. So I'll do that. And now that's installing. Okay. Now it's telling us we should run sudo apt-get update again. So I'll clear my screen and run that. And finally once that is done, then we can run sudo apt-get install python-certbot-nginx. So I will run that, and this one's going to ask me if we want to continue, so I will just hit Enter to accept the default of yes.
Updating the Nginx Server Name
Okay, so once that is done, we are ready to run this Certbot command, but first I'm going to make a change to my Nginx configuration before we run this next command. I currently have our server name set as the IP address, and I'm instead going to change that to be our domain name. So to do this, I'm going to open up our Nginx configuration in Nano. So I'll say sudo nano and that is in /etc/nginx/sites-enabled Whoops, that is sites-enabled. Okay, and the configuration file, I called this one flaskblog. Now sorry that this is running on two lines here. I kind of have to trade off between having this text large enough for you all to read it and, but also that makes it run onto a new line sometimes. I'll go ahead and spread this out for now so that we can see that. Okay, so I'm going to open that in Nano. And for our server name here, we currently have this set as the IP address, but now that we have a domain name, I'm going to go ahead and put that in there instead. So in my case, that's www.myawesomeapp.com. So now I'll save that by hitting Ctrl+X, Y to save, and then hit Enter.
Obtaining the SSL Certificate with Certbot
Okay, so now I'm going to run that Certbot command for Nginx, and that will automatically update a lot of our configurations to work with these certificates. So if I look back in the commands here, that is sudo certbot with the nginx option there. So I will paste that in and run that. And now this is going to ask us to insert some information here. So we need an email address, so I will put in my email address there. And now it's going to ask us to accept some terms and conditions. So I'm going to put A for agree. And now it's asking us if we want to share our email address with the foundation for the nonprofit so that they can send us, you know, updates about encrypting the web, news, campaigns, stuff like that. That's optional. I'm just going to say no to that. Okay, and now it's saying which names would you like to activate HTTPS for? So we can either select the appropriate numbers here if there were more than one, or if we just want all of these, then we can just hit Enter. So I'm just going to hit Enter because my awesome app is the only one in there. And now once that is done, it should ask us if we want to redirect or not. So this is just going to take a second here. Okay, so now this is asking us if we would like to redirect. So the option number one here is no redirect. That means that we could go to the HTTP version of our website and the HTTPS version. Now number two here, redirect, that makes all of the requests redirect to secure HTTPS access. Now I almost always choose number two here. Well, I always choose number two there. I'm not sure why you would want both enabled, but I always want to redirect our users to the secure version of the website. So I'm going to say number two there to redirect.
Reviewing Nginx Configuration Changes
And now that is done. It says, congratulations, your certificate and chain have been saved, and gives you the locations. And if we scroll up here a little bit, then we can see that it updated some configurations here within our Nginx file here. So it changed this nginx/sites-enabled/flaskblog file. So let me cat that file so that we can see what changes it made. So I'm going to clear my screen. And now I'm just going to hit the up arrow a couple times. So originally we did a nano on that file, but I just want to cat that file to see what changes it made. Okay, so we can see, and actually some of these are going on new lines. So let me actually just nano that file. I think it would be easier to read if I did that.
Okay, so let's look at some of the changes that it made in here. Okay, so we can see within our first server block here where we have our static location and the Gunicorn proxy, that now this is listening on Port 443, which is SSL. And also it added some SSL certificate options down here for us, some variables here. Now we also said that we wanted that traffic on HTTP to be redirected to HTTPS. So if we scroll down here a little bit, we have another server block here, and this one is listening on Port 80, which is HTTP, and it is redirecting us. We see here if it says if ($host = www.myawesomeapp.com), then return 301, which is a redirect to the HTTPS version of that website. So that's good. That Certbot command automatically updated these configurations for us so that we didn't have to, you know, dive into this documentation and see exactly how to do redirects and stuff like that. So that is good.
Now if you have problems with that automatic Certbot command running into any issues, then I would recommend going back to their website and looking at the cert-only installation and walking through from there. So that will allow you to modify your configuration files manually instead of it changing those automatically for you. But I've personally always found it easier to just let it do most of that for me automatically.
Firewall Configuration and Server Restart
Okay, so we're just about done here, but one more thing that I want to point out is that if you test your Nginx configuration, it might look like you have an issue. So if I say nginx -t, which will test our configuration, then we can see that we get a couple of alerts here. So it says that our SSL permission is denied here and things like that. Now those are just permission issues and you can expect that. The reason that we're getting those is that we should run that command using sudo, and you'll find that you don't have any of those syntax problems. So if I run that same command and instead use sudo—I'm going to clear my screen before I do that—if I run that, then we can see that it says that the syntax is okay and that the configuration test is successful. Okay, so that looks good.
Now all we have to do is allow HTTPS traffic to our website and then all of this should work. So if you've been following along with this series, then when we set up a firewall, we originally only allowed HTTP traffic. So now we need to allow HTTPS. So we can do that just by saying sudo ufw allow https. So we can see that it added that rule. Now you can disallow HTTP traffic if you'd like, but since we're redirecting that traffic anyway, I'm just going to leave it there. So now let's restart our server for these changes to take effect, and then we'll take a look at our website to see if this all worked. So I'll restart the server by saying systemctl restart nginx. Run that.
Verifying HTTPS on the Live Site
Okay, now let me bring up our browser here and go back to our website. Now if you look in the top left here, it says not secure. So if I reload this page, then now we can see that we're going to the HTTPS version of this website. And now there's a little lock here. And if we click on that lock, it says connection is secure, your passwords, credit card numbers is private when it is sent to this site. So that's perfect, it's working just as expected.
Now, just to make sure that this is working on all pages with our functionality, let's go ahead and log in and see if our functionality is working on HTTPS as well. So I'm going to log in using my email. And I believe my password was that. Okay, yep, that was it. Okay. So now let's look at a post here. So we can see that even though the URL is, you know, for /post/27, we're still on the HTTPS version of this website and it's still secure. And we can update our post. So "my latest updated post." If I post that, then we can see that all of that is done with our lock in the top corner. So I'm not going to go through all the functionality of the website. I think we can assume that that's working well.
Automating Certificate Renewal with Cron
Okay, so these certificates last for around, I think, 90 days, and after that they'll need to be renewed. Now, we don't want to do this manually every 90 days. So let's set this up to where it does it automatically for us. So first, let's run a dry run of what a renew looks like. So I'm going to pull back up our terminal here. And to do a dry run of a certificate renewal, we can simply say sudo certbot renew --dry-run. So if I run this, then this just simulated a renewal for us, but it didn't actually do a real renewal. So we can see, congratulations, all renewals succeeded, and that this was just a dry run. So that's great.
So now let's create a cron job that will renew this every month or so. So like I said, the certificates are good for about 90 days, but we can just run the renew command every month or so and that should be fine. Now if you've never run cron jobs before, basically it's a way to run demands at certain intervals. And I have a separate video on working with cron in general if you want to learn more about it in detail, and I'll leave the link to that in the description section below.
Okay, so if we want to edit our crontab, we're going to want to do that with sudo so that the commands that we add to that cron tab will be run as root. So I'm going to clear my screen here. So I'm going to say sudo crontab -e and that'll edit the root's cron tab. And now we need to choose an editor, since we don't have one set up by default. I'm just going to choose one for Nano. And now I'm going to scroll down here a little bit. Now the documentation in here, yours might be empty, but this is just documentation kind of explaining how crontab works as well.
So for our cron job, let's just say that we want to renew our certificate at 4:30 a.m. on the first of every month. So in order to do that, I will do a 30 for the minutes, a four for the hour, so 4:30, one for the day, so the first of each month. And then I'm going to do an asterisk for the month, so that means it'll do it every month. And an asterisk for the day of the week, which means it'll do it no matter what day of the week it is. And now we can put in our command. So I'll do sudo certbot renew. And now we don't want to use the dry run command here because we actually want to renew their certificate. One thing I will put in is a --quiet option. And that'll just run it in the background, you know, without any feedback. Okay, so to save that, I'm going to hit Ctrl+X, Y to save, and then Enter. I can clear my screen here.
Conclusion and Future Topics
Okay, so I think that is going to do it for this video. So hopefully now you feel comfortable setting up SSL encryption and HTTPS for your websites using a service like Let's Encrypt. Now, as usual, there's still a lot that we can do with this website. I'm still going to do a video showing you all how to deploy to a service like Heroku. We'll also see how to use a Postgres database instead of SQLite, since we're still using the SQLite database in the background. Also, I prefer to have my website set up so that the www version of the website gets redirected to the non-www version of the website. So for example, if you go to www.twitter.com, Twitter actually just gets rid of the www and redirects you to twitter.com instead. So that's what I prefer to do with my websites, and I can show you how to do that in a future video as well. So those will likely be the next videos that I work on for this series. But if anyone has any questions about what we've covered in this video, then feel free to ask in the comment section below, and I'll do my best to answer those. And if you enjoy these tutorials and would like to support them, then there are several ways you can do that. The easiest way is to simply like the video and give it a thumbs up. And also, it's a huge help to share these videos with anyone who you think would find them useful. And if you have the means, you can contribute through Patreon, and there's a link to that page in the description section below. Be sure to subscribe for future videos, and thank you all for watching.
