I have a website running successfully on Apache port 80 HTTP (on a temporary subdomain).

I am following this tutorial in order to setup an SSL certificate on Apache2, Ubuntu using LetsEncrypt with certbot:


The following steps have been performed:

sudo add-apt-repository ppa:certbot/certbot
sudo apt-get update
sudo apt-get install python-certbot-apache
sudo certbot --apache -d example.com -d www.example.com

The latest step fails with a

not authorized

message, maybe because the site is behind a proxy and/or because example.com is not live yet (the DNS A and CNAME records are not set yet, as there should be a fluent change from the old host and the website is already live).

Therefore I have to setup the certificate manually before the DNS records are set. I have discovered that certbot has a --manual option: https://certbot.eff.org/docs/using.html#manual

I also have a .cert file for example.com from LetsEncrypt if this is more useful?

However this is where I am stuck and where I do not know how to proceed correctly (yes I am quite of a noob to server setups).

Can you tell me what is/are the next step(s) in order to setup this ssl certificate in a manual manner correctly?

  • Before I can start to answer your question, I need some clarification. What does the .cert file contain? A certificate for example.com? If so, why don't you use this certificate? Because you also need a certificate for www.example.com? – malte Oct 21 '17 at 10:55

Certbot has three ways to validate your ownership of the domain to letsencrypt. Two of them (http and tls-sni) open a port and serve a certain piece of content (http) or a certificate (tls-sni); both of them aren't usable for you since the domain (as you said) does not point to the host where you are running certbot.

The third way (dns) and is perfect for your scenario. To quote the certbot documentation:

When using the dns challenge, certbot will ask you to place a TXT DNS record with specific contents under the domain name consisting of the hostname for which you want a certificate issued, prepended by _acme-challenge. For example, for the domain example.com, a zone file entry would look like:

_acme-challenge.example.com. 300 IN TXT "gfj9Xq...Rg85nM"

And that is what you need to do. Run

certbot certonly --manual --preferred-challenges dns -d example.com -d www.example.com

This command should do the following:

  • Ask you to create a DNS TXT record
  • Acquire the certificate as soon as you created the DNS TXT record
  • Place the certificate in /etc/letsencrypt

Finally you have to add the certificate configuration to your webserver.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.