In the final part of this tutorial, we will talk about how to set up a secure HTTPS connection for our Django project on Apache as well as install a free SSL certificate provided by Let’s Encrypt.
Generating The SSL Certificate
Installing Certbot
To generate our certificate, we’re going to need Certbot. Boot up PuTTY and log into the system’s Shell and run the following commands to install Certbot.
ubuntu@instance_name:~$ sudo wget https://dl.eff.org/certbot-auto -O /usr/sbin/certbot-auto ubuntu@instance_name:~$ sudo chmod a+x /usr/sbin/certbot-auto
That’s it! Certbot is now on our system.
Generating The Certificate
With Certbot now installed, we can proceed to generate our certificate.
First, we’d need to shut down Apache momentarily to generate our certificate. Since Certbot runs off of port 80, we’d want to make sure there are no conflicts. To shut down Apache use the following command:
ubuntu@instance_name:~$ sudo service apache2 stop
Once down, run the following command to begin generating our certificate:
ubuntu@instance_name:~$ sudo certbot-auto certonly --standalone -d domain.com -d www.domain.com
Replace domain.com and www.domain.com with your domain.
You’ll be prompted to answer a few questions and enter your email. After you’ve completed this step, your SSL certificate will be generated.
Your SSL certificate can be found at the following path:
/etc/letsencrypt/live/domain.com
You’ll notice four files got created.
- cert.pem
- chain.pem
- fullchain.pm
- Privkey.pm
Configuring The VirtualHost
Back in Part 4 of this tutorial, Deploy Django to DreamCompute on Ubuntu with Apache – Part 4, we’ve edited a file called 000-default.conf to set up our VirtualHost for our Django project to run on HTTP port 80. This time around we’re going to do the following:
- Redirect all traffic coming in through our HTTP version of the site to HTTPS
- Set up our HTTPS connection with our SSL certificate
To do that, edit the 000-default.conf file by running:
/etc/letsencrypt/live/domain.com
Delete everything within the file and use the new template below:
<VirtualHost *:80>
ServerName domain.com
ServerAdmin na**@do****.com
ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined
RewriteEngine On
RewriteCond %{SERVER_PORT} !^443$
RewriteRule ^(.*)$ https://%{HTTP_HOST}$1 [R=301,L]
</VirtualHost>
<VirtualHost *:443>
SSLEngine on
SSLCertificateFile /etc/letsencrypt/live/domain.com/cert.pem
SSLCertificateKeyFile /etc/letsencrypt/live/domain.com/privkey.pem
SSLCertificateChainFile /etc/letsencrypt/live/domain.com/chain.pem
Alias /assets /home/ubuntu/domain.com/public/assets
<Directory /home/ubuntu/domain.com/public/assets>
Require all granted
</Directory>
<Directory /home/ubuntu/domain.com/projectname/projectname>
<Files wsgi.py>
Require all granted
</Files>
</Directory>
WSGIDaemonProcess projectname python-path=/home/ubuntu/domain.com/projectname python-home=/home/ubuntu/domain.com/env
WSGIProcessGroup projectname
WSGIScriptAlias / /home/ubuntu/domain.com/projectname/projectname/wsgi.py
</VirtualHost>
Press Ctrl + X, Y, then Enter to save.
You’ll notice we’ve moved around a few things and added a new VirtualHost rule for port 443 for our HTTPS connection.
Before we can turn Apache back on, there are two things we have to enabled to have Apache running without errors. That is Apache’s SSL mod and the Rewrite mod. To do that run the following:
ubuntu@instance_name:~$ sudo a2enmod ssl ubuntu@instance_name:~$ sudo a2enmod rewrite
That’s it; both mods are installed. All we have left to do is start our Apache server again by running:
ubuntu@instance_name:~$ sudo service apache2 start
If you load up your website using HTTP, it should now redirect to the HTTPS version.
Auto Renewing The Certificate
With our SSL certificate now installed and our HTTPS connection currently working, the last thing we’d want to set up is a way for the SSL certificates to auto-renew because Let’s Encrypt certificates are only valid for 90 days.
To renew our certificate, we’ll be leveraging cron jobs. To edit our cron jobs run the following:
ubuntu@instance_name:~$ crontab -e
Note: If this is your first time running the above command, you may be prompt to choose a way to open the file.
Once you are in the file, navigate to the bottom and enter the following:
0 0,12 * * * sudo /usr/sbin/certbot-auto -q renew
Press Ctrl + X,Y, then Enter to save.
Note: The above will make Certbot run at noon and midnight every day.
That’s it!