Let’s Encrypt on Private Network Ubuntu 24 VM with Manual DNS

Step 1: Install Certbot

Update your package list:

sudo apt update

Install Certbot and the manual plugin:

sudo apt install certbot

Step 2: Prepare for Manual DNS Validation

Run Certbot with the manual DNS challenge:

sudo certbot certonly --manual --preferred-challenges dns -d private-server-1.pri.smortler.com

Certbot will prompt you to manually add a TXT record to your DNS for the domain private-server-1.pri.smortler.com.

Step 3: Add the TXT Record to Your DNS

After running the Certbot command, you’ll see a message like this:

Please deploy a DNS TXT record under the name:
_acme-challenge.private-server-1.pri.smortler.com

With the following value:
fTPc1PAOSe9p0GBqP7IaJklJUMEaM5tHMohMZ2alPGU

Before continuing, verify the record is deployed.
    

Log in to your DNS management system and add a TXT record:

Save the DNS record.

Step 4: Verify DNS Propagation

Use a DNS propagation tool (e.g., whatsmydns.net) or check manually using dig:

dig TXT _acme-challenge.private-server-1.pri.smortler.com

Ensure the correct TXT record is visible.

Step 5: Complete the Validation

Return to the terminal where Certbot is running.

Press Enter to continue once the TXT record is propagated.

Step 6: Certbot Generates the Certificate

Once validation is successful, Certbot will generate the certificates and store them in:

Certificate: /etc/letsencrypt/live/private-server-1.pri.smortler.com/fullchain.pem
Private Key: /etc/letsencrypt/live/private-server-1.pri.smortler.com/privkey.pem
    

Step 7: Configure Your Web Server

Configure your web server (e.g., Apache, Nginx) to use the certificate and private key:

Apache:

Update your virtual host file:

sudo nano /etc/apache2/sites-available/private-server-1.conf

Add or update the SSL settings:

SSLEngine on
SSLCertificateFile /etc/letsencrypt/live/private-server-1.pri.smortler.com/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/private-server-1.pri.smortler.com/privkey.pem
    

Enable SSL:

sudo a2enmod ssl
sudo systemctl reload apache2

Nginx:

Update your server block configuration:

sudo nano /etc/nginx/sites-available/private-server-1

Add or update the SSL settings:

server {
    listen 443 ssl;
    server_name private-server-1.pri.smortler.com;

    ssl_certificate /etc/letsencrypt/live/private-server-1.pri.smortler.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/private-server-1.pri.smortler.com/privkey.pem;
}
    

Reload Nginx:

sudo systemctl reload nginx

Step 8: Automate Certificate Renewal

Since the DNS challenge requires manual steps, fully automating renewal isn’t possible. However, Certbot can notify you when renewal is needed.

Add a cron job to check for certificate expiration:

sudo crontab -e

Add this line:

0 0 * * * certbot renew --dry-run --manual-public-ip-logging-ok

Certbot will notify you if the certificate is nearing expiration.

Alternative: Use a Wildcard Certificate

If you need certificates for multiple subdomains, consider generating a wildcard certificate (e.g., *.pri.smortler.com). The process is similar but requires DNS-01 validation with a wildcard domain.