Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revisionPrevious revision
Next revision		Previous revision
obtain_let_s_encrypt_trusted_tls_certificate [28 May 2025 / 07:13:28] – kadekobtain_let_s_encrypt_trusted_tls_certificate [23 June 2025 / 19:29:39] (current) – [Using webroot Plugin] kadek
Line 1: Line 1:
 ===== Let's Encrypt TLS Certificate ===== ===== Let's Encrypt TLS Certificate =====
  
-SoftEtherVPN server creates a self-signed TLS certificate during the installation process, but we will use Let’s Encrypt certificate. The advantage of using Let’s Encrypt certificate is that it’s free, easier to set up, and trusted by VPN client software.+softEtherVPN server creates a self-signed TLS certificate during the installation process, but we will use Let’s Encrypt certificate. The advantage of using Let’s Encrypt certificate is that it’s free, easier to set up, and trusted by VPN client software.
  
   * Run the following commands to install Let’s Encrypt client (certbot) from the default Ubuntu repository:   * Run the following commands to install Let’s Encrypt client (certbot) from the default Ubuntu repository:
Line 11: Line 11:
   certbot --version   certbot --version
  
-  * Use the standalone plugin to obtain TLS certificate (if SoftEther VPN server will use port 443, no Webserver installed):+==== Standalone Plugin ====
  
-  sudo certbot certonly --standalone --preferred-challenges http --agree-tos --key-type rsa --email you@yourdomain.com -d vpn.yourdomain.com+  * If there’s no Web Server running on your Ubuntu 24.04 server and  softEtherVPN server intended to use port 443, then we can use the standalone plugin to obtain TLS certificate from Let’s Encrypt: 
 + 
 +   sudo certbot certonly --standalone --preferred-challenges http --agree-tos --key-type rsa --email you@yourdomain.com -d vpn.yourdomain.com 
 + 
 +==== Using webroot Plugin ==== 
 + 
 +  * If Ubuntu 22.04/20.04 server has a Web Server listening on port 80 and 443, then use the webroot plugin to obtain a certificate because the webroot plugin works with pretty much every web server and we don’t need to install the certificate in the web server. 
 +  * First, create a virtual host for vpn.example.com, in this example is using Apache: 
 + 
 +  sudo nano /etc/apache2/sites-available/vpn.example.com.conf 
 +  sudo ln -s /etc/apache2/sites-available/vpn.example.com.conf /etc/apache2/sites-enable/vpn.example.com.conf 
 + 
 +  * And paste the following lines into the file: 
 + 
 +  <VirtualHost *:80>         
 +      ServerName vpn.example.com 
 +      DocumentRoot /var/www/vpn.example.com 
 +      <Directory /var/www/vpn.example.com> 
 +         Options Indexes FollowSymLinks 
 +         AllowOverride All 
 +         Require all granted 
 +      </Directory> 
 +  </VirtualHost> 
 + 
 +  * Save and close the file. Then create the web root directory: 
 + 
 +  sudo mkdir /var/www/vpn.example.com 
 + 
 +  * Set www-data (Apache user) as the owner of the web root: 
 + 
 +  sudo chown -R www-data:www-data /var/www/vpn.example.com 
 + 
 +  * Enable this virtual host: 
 + 
 +  sudo a2ensite vpn.example.com 
 + 
 +  * Reload Apache for the changes to take effect: 
 + 
 +  sudo systemctl reload apache2 
 + 
 +  * Once virtual host is created and enabled, run the following command to obtain Let’s Encrypt certificate using webroot plugin: 
 + 
 +  sudo certbot certonly --webroot --agree-tos --key-type rsa --email you@exmaple.com -d vpn.example.com -w /var/www/html
  
-If your Ubuntu 22.04/20.04 server has a web server listening on port 80 and 443, then it’s better to use the webroot plugin to obtain a certificate because the webroot plugin works with pretty much every web server and we don’t need to install the certificate in the web server. 
  
 ==== Install The Certificate on SoftEther VPN Server ==== ==== Install The Certificate on SoftEther VPN Server ====
Line 39: Line 80:
   exit   exit
  
-  Restart VPN server:+  * Restart VPN server:
  
   sudo systemctl restart softether-vpnserver   sudo systemctl restart softether-vpnserver