Migrate from Nginx to Caddy for SSL auto-renewal in Amazon AWS EC2

 Dear friends,

Today, we will see a simple migration with less configuration of SSL auto-renewal.

I was using Nginx for SSL auto-renewal using certbot. Every 90 days, the renewal code should run, I made one more service it.

I have come across Caddy, which does an auto-renewal of SSL automatically with certbot. Reducing efforts and making the system smooth.

Follow the steps below

Stop and disable the Nginx

sudo systemctl stop nginx

sudo systemctl disable nginx

Install the Caddy

In EC2, if you are running Amazon Linux, then execute the following to install Caddy.

    sudo yum -y install yum-plugin-copr

    sudo yum -y copr enable @caddy/caddy epel-8-$(arch)

    sudo yum -y install caddy

Edit and configure the Caddyfile

Usually, it will be in the path /etc/caddy/Caddyfile

sudo vi /etc/caddy/Caddyfile

I have only one server that is running locally. So, my configuration is easy

domain_name {

    reverse_proxy localhost:port

}

You can configure more with your existing Nginx sites-enabled reference.

Happy SSLing.

If you like the blog or want to comment, kindly reach out to psrdotcom@gmail.com

Configure a API Backend Server with custom domain on Amazon Web Services (AWS) EC2 Ubuntu with NGINX and Certbot SSL

Hi all,

Build your own API backend server on AWS free-tier with SSL.

The below steps with reference links will provide detailed information of each step.

1. AWS account - Free-tier
2. Create EC2 Ubuntu
3. Connect to Ubuntu from your local using SSH/Putty
4. Install NodeJS
1. Open terminal
2. curl -fsSL http://deb.nodesource.com/setup_lts.x | sudo -E bash -
3. sudo apt update
4. sudo apt install nodejs //installs latest LTS nodejs
5. Create a sample node server
6. Install and configure node server process manager
1. sudo npm install -g pm2@latest
2. Navigate to nodejs server folder
3. pm2 start <filename>
4. pm2 startup systemd
5. pm2 save
6. pm2 list // List all the nodejs apps with status
7. pm2 stop/restart/start app_name/id // Actions of nodejs servers
7. Install Nginx
8. Configure your domain DNS records to map to AWS EC2 public/elastic IP address
9. Secure Nginx with SSL certs

Hope the above information is useful to set up the environment and play with your backend server.

Feel free to send your feedback and comments to psrdotcom@gmail.com

Generate Free SSL HTTPS Certificates with 90 days validity using letsencrypt

 Hi all,

As discussed in my earlier blog, Generate Free SSL Certificate using ZeroSSL where the limitation of one free certificate on ZeroSSL can be eliminated using Get HTTPS for free!

This process includes the following prerequisites and procedures.

Note: This process is not for beginners or production usage scenarios. Use this process if you are knowledgeable about certificate generation.

Prerequisites

• OpenSSL command line
• [Li]nix / Mac OS

Procedure

• Open the URL https://gethttpsforfree.com
• It has 5 steps
• Account Info
• Certificate Signing Request
• Sign API Requests
• Verify Ownership
• Install Certificate
• In each step, some commands or processes need to be followed to get the free SSL certificate.

1. Account Info
1. In this step, we will be providing the email and public key.
2. Keep the generated private key security in your system.

• Note: If you are unsure about the public key generation commands, click on the "how do I generate this?" link, which is available over the public key input textbox.

2. Certificate Signing Request (CSR)
1. Generate the CSR for the required domains

• Note: You can generate the CSR for wildcard certificates and www subdomain with the same command

2. Try to follow the same format, including the line feeds mentioned below.

#change "/etc/ssl/openssl.cnf" as needed:
    #  Debian: /etc/ssl/openssl.cnf
    #  RHEL and CentOS: /etc/pki/tls/openssl.cnf
    #  Mac OSX: /System/Library/OpenSSL/openssl.cnf

    openssl req -new -sha256 -key domain.key -subj "/" \
      -reqexts SAN -config <(cat /etc/ssl/openssl.cnf \
      <(printf "\n[SAN]\nsubjectAltName=DNS:foo.com,DNS:www.foo.com")) 

3.  Sign API Requests
1. Sign all the requests with the private key

• Note: You need to copy the command and execute it on your PC/Mac terminal, and the result needs to be pasted on the web page.

4. Verify Ownership
1. In this step, you need to prove your domain ownership
2. You will be given 3 options
1. Python server
2. file-based
3. DNS record (I've used this option)
1. Update the DNS records with new TXT entries, and use the online dig tool to make sure the records are visible.
2. After we verify the availability of the records, you need to click on the respective buttons on the web page.
3. Repeat the same steps for each domain on CSR (www and any sub-domains).
5. Install Certificate
1. You will be able to receive your certificate in "chained.pem" format
2. Copy and paste the first certificate section (e.g. the first "-----BEGIN CERTIFICATE-----" section) into a text file named "domain.crt".
3. Copy and paste the second certificate section (e.g. the second "-----BEGIN CERTIFICATE-----" section) into a text file named "intermediate.pem".

• Note: Expand the "how do I install this?" link for quick help.

Hope this will help you to generate free SSL for your websites.

Request you to send your valuable feedback and comments to psrdotcom@gmail.com

Generate Free SSL Certificate using ZeroSSL

 Hi all,

Today I am going to explain the process of generating free SSL certificate using ZeroSSL

Pre-requisite

1. We should have our own domain
2. We should be able to add/update the DNS settings like A, CNAME, TXT records

Best free SSL providers

As per my research I found the best free SSL (90 days) certificate providers

1. ZeroSSL
2. Let's Encrypt

In this blog, i'll explain ZeroSSL process

ZeroSSL Free SSL Certificate

1. Navigate to https://zerossl.com/
2. Signup with your email by clicking on "FreeSSL"
3. After email verification, login to zerossl site
4. Click on "New Certificate"
5. 
6. Enter your domain name and click on "Next Step"
7. Default validity is 90 days for free SSL
8. 
9. In the CSR section we have couple of options
10. Default is Auto-Generate CSR enabled
11. Disable Auto-Generate CSR - only your zerossl registered email address with default values
12. Enable Paste Existing CSR - If you have already created a CSR then you can use this option
13. 
14. Finalize your order
15. 

Note

ZeroSSL will generate the certificate using signature algorithm SHA-384

In some cases, if SHA-384 based SSL is not valid then we have to mandatory go for alternate "Let's Encrypt". I will explain Let's Encrypt in my next blog.

For every 90 days, we need to renew our certificate in the above mentioned manner.

Download Certificate

1. Navigate to Certificates section
2. Go to Issued tab
3. 
4. Click on "Install"
5. 
6. You can select the Default Format dropdown to select specified server or just leave it default.
7. Download the certificate zip file which will contain 
1. ca_bunder.crt - CA Bundle
2. certificate.crt - Certificate
3. private.key - Private Key

Hope, you will be able to make use of this free SSL feature and encrypt your domain traffic.

Please let me know your feedback and suggestions in comments or mail to psrdotcom@gmail.com

SSH Versus SSL (Difference)

Hi everyone,

I googled and found out some differences.

SSH protocol is mainly used for shell based solutions and won’t be used to protect web browsing sessions and other application services 

SSL protocol is mainly used for secure http sessions (HTTPS). Now a days, all browsers are coming with built in SSL Protocol support with CA(Certification Authority) root certificates.  We no need to configure to use the SSL. No extra client software needed to use SSL.

SSH protocol is used to remotely login to remote network system/server and execute commands.

SSL protocol is used to send the data/files securely to a remote and/or network system.

References:

http://www.k2esec.com/secure-communications/network-security-protocols-ipsec-vs-tlsssl-vs-ssh-part-ii

http://kb2.adobe.com/cps/161/tn_16159.html