Let's Encrypt SSL

Objective

This guide explains how to use Let's Encrypt SSL on Ruk-Com Cloud PaaS, with ordered procedures and practical verification points.

Before you begin

• Sign in with an account permitted to manage the relevant environment.
• Confirm the target environment, region and resources before saving changes.
• Create a backup or rollback plan before changing a production system.

Free SSL certificates from Let's Encrypt: Instantly install and use with popular software stacks.

One of the important issues that must be addressed for production applications isdata securityThe basic method that is most commonly used is It also encrypts data sent and received through the application.HTTPS protocol

Since January 1, 2017, Google Chrome, one of the most used browsers, has It has started showing a warning that the website is asking to be filled out. Password or credit card information However, if SSL is not used, it will be considered "unsecure". This is an important change that emphasizes that Encryption via HTTPS isn't just an option. But it is necessary. For the reliability and security of the website

Issuing and setting up a custom SSL certificateIndividual projects can be complex and time-consuming, however.Let's Encrypt(LE), which issues certificatesFree and automatic activationhas made installing reliable SSL easy and hassle-free.

The global trend of websites shifting to HTTPS is widespread. is pushing for Full automation both in issuing and managing SSL certificates. To answer this problem, the developers ofRuk-Com CloudLet's Encrypt is integrated with Cloud Scripting, eliminating the need to manually renew certificates.

Important advantagesOne of the key benefits of this solution is SSL integration, available from the start on popular load balancers and application servers. allows toIndependently secure applications running on Ruk-Com Cloud.

For use in the formAdd-onThis solution can be easily installed on any container that supports custom SSL, covering the following servers: (and the list continues to expand):

• Load Balancers - NGINX, Apache LB, HAProxy, Varnish
• Java application servers - Tomcat, TomEE, GlassFish, Payara, Jetty
• PHP application servers - Apache PHP, NGINX PHP
• Ruby application servers - Apache Ruby, NGINX Ruby

If you use another stack and want to use Let's Encrypt SSL, just add a Load Balancer to the front of your application and install the add-on right away. SSL termination at the Load Balancer level (SSL Termination) will be applied automatically in cluster topologies.

How does Let's Encrypt SSL work?

During installation of the Let's Encrypt add-onThe system will perform several automatic steps, including:

• Download and configure the Let's Encrypt Client (also known as Certificate Management Agent – CMA).
• Send a certificate request to Let's Encrypt CA.
• Take the received certificate and install it with the software you are using.
• Set up a Cron Job to automatically renew certificates as they near their expiration.

When a certificate is requested, Let's Encrypt verifies that the domain actually belongs to the requester by:

• checkEntry point of environment via port 80
• All inbound HTTP traffic will be redirected toPort 12345which is used for CMA Proxy
• In cases where a layer has multiple nodes of the same nature, it is selected.Main nodeto manage requests and scheduleTemporary DNAT ruleSo that verification can be done through that node only at one point.

Once domain name verification is successful, these DNAT rules will be automatically removed.

• CMA will be able toRequest, renew and revoke certificatesfor configurable domains
• will be createdAutomatically pair new SSL keys
• The issued certificate is published to all nodes in the entry point layer through the Jelastic API.
• The application will automatically be set up to be available over HTTPS.

Even though the steps seem complicated But the entire system only takes a few minutes to set up.

Installing Add-On Let's Encrypt SSL

1. Click on the balancer add-on icon and press the Install button.add-on Let's Encrypt

2. Fill in the domain where you want to install the certificate. If not filled in, it will be used as the environment's domain instead.

This step must provide an External Domain(s) pointing to the desired environment. Possible options are:

• Leaving this blank will create an SSL certificate pointing to the internal environment for testing.
• Enter the actual domain you use. You can enter multiple domains step by step with a comma (,).

Finally, clickinstallto begin installation

Note: Installation of this add-on requirespublic IPTo work, so in cases where the environment doesn't have a public IP, it will be added automatically during installation. (Be careful that installing additional public IPs costs money.)

3. The installation process will take some time. When the installation is complete, you can check it in the environment.Setting > Custom SSLThis will see that HTTPS has been enabled by the certificate's expiration date.

4. You can check the correctness of the installation. You can do this by trying to access the application via HTTPS. If it can be launched normally and the browser shows that Secure connection readypadlock symbolIndicates that the SSL certificate is installed and configured correctly.

Update Let's Encrypt certificate

Let's Encrypt SSL certificatehas a lifespan90 daysAnd it needs to be renewed in order for the encryption to continue to work.

The system will set it up for you.Automatically renew certificateThis will start this process.30 days in advance before the expiration dateand you will receiveEmail notificationTo know in advance

You can manually update your SSL certificate at any time by following these steps:

1. Go to the environment's control panel. (Environment)
2. Click onAdd-on button(add-on) next to the layer where SSL is installed
3. Within the Add-ons panel, click the button.“Update Now” 
   
   

You can also update your SSL certificate by reinstalling the add-on for the original domain name. However, if during this process youAdd or change a domain nameused will make the systemIssue a completely new certificate in place of the old one.automatically

Configuring a new Let's Encrypt certificate

You can customize the installed Let's Encrypt SSL add-on to your new needs with just a click of a button.“Configure”Inside the Let's Encrypt control panel

Then in the pop-up window that appears You can change External Domain names or delete specific domain names, for example if you're having trouble assigning SSL certificates to those domains.

Note: For safety, the system willAlways issue a new SSL certificate.Even in cases where you just delete some domain names from the original certificate.

Uninstall Let's Encrypt SSL Add-On

You can easily remove the Let's Encrypt SSL add-on from your environment. By following these steps:

1. Go to the tabAdd-ons
2. Click the options icon in the top right corner of the panel.Let's Encrypt SSL
3. Then select the commandUninstall

After you confirm the uninstallation, the Let's Encrypt add-on will be removed and the associated SSL certificate will be automatically disabled.

Now you have learned how. Install and manageAdd-onofLet's EncryptYou are now ready to set up custom SSL in your environment. This way, you can easily protect your applications. It doesn't take long and the important thing isThere is no charge.You can start using it immediately throughRuk-Com Cloud PaaS