Easy SSL Cert for testing

Have you ever needed to test something with a web server that you stand up quickly, but don’t have an SSL cert for it, and don’t have access to a wildcard cert for the domain? Check out http://www.letsencrypt.org and be prepared to quickly and easily get an SSL cert. 

On a RaspberryPi system you start by installing certbot  via “sudo apt-get install python-certbot-apache” and then I ran in to some trouble trying to just use certbot’s automagic apache mechanism so I did this;

1. Enable SSL on Apache with “sudo a2enmod ssl”
2. Stop Apache with “sudo /etc/init.d/apache2 stop”
3. “sudo certbot certonly –standalone” to go through the process. It will launch a process that the certificate authority will connect to on TCP 80 to verify you control the DNS name you are trying to make a cert for so that name should resolve to this server.
4. Edit /etc/apache2/sites-enabled/default-ssl.conf to point to your SSL certs. These 3 settings must be changed and make sure the path matches where your files are stored;
   

SSLCertificateFile /etc/letsencrypt/live/example.com/cert.pem
SSLCertificateKeyFile /etc/letsencrypt/live/example.com/privkey.pem
SSLCertificateChainFile /etc/letsencrypt/live/example.com/fullchain.pem

Now you need to start Apache back up with “sudo /etc/init.d/apache2 start” and hopefully it should load. I don’t believe any steps are missing here, but please do let me know in the comments if you tried this and were totally stuck. Remember you’ll have to renew your certs each year, but certbot has a renew function as well. Super simple. 

Protecting a RespberryPi

So I had a need for work to setup an Apache server to test a feature of our product. It was easy enough to get it going;

1. Install Noobs to SD card
2. Boot up RaspberryPi 3B+ with Noobs
3. Install Raspian
4. Use apt-get to install apache2
5. Port Forward 80 and 443 to my RPi
6. Use DynDNS to direct a DNS name to my home IP

So all that was super easy. Next I started to worry about protecting my little pocket computer. I looked at DenyHosts, but it seems like the version in apt-get was super old and even the latest seems not maintained. So I did “apt-get install fail2ban” because that seems fairly current. So this is more of a question post than a helpful post for others. My question is if fail2ban via apt-get needs certain config changes or if it is good with default settings? If you read this and can comment with guidance it would help me, and hopefully others. If the steps above seem complicated and anyone wants a step by step posted then I’m happy to do so. If you’d like to try to beat up on my little computer that’s cool too. Nothing private is on it. http://absolute.jnux.net is the Apache2 instance.