Skip to main content

Obtaining a Server Certificate from Let's Encrypt Using Certify The Web

Jeff Reed
Updated

Drivemap_over_HTTPS.pngBackground

According to the Let's Encrypt website:

"Let’s Encrypt is a free, automated, and open certificate authority brought to you by the non-profit Internet Security Research Group (ISRG)."

According to the Certify The Web documentation:
"Certify The Web (a.k.a Certify) is a Let's Encrypt GUI for Windows, allowing you to request, deploy and auto-renew free SSL/TLS certificates from the letsencrypt.org Certificate Authority"

This document will describe how to install and configure Certify The Web to automate the process of requesting, installing and renewing a server certificate for use on CentreStack.

Procedure

Prerequisites

  1. CentreStack must be installed. The Certify configuration will require a working web site in order for the "http-01 challenge" process to succeed.
  2. The CentreStack server must have a fully qualified domain (FQDN) that resolves to a publicly accessible IP address. The Let's Encrypt service will call back to the CentreStack server over TCP 80 to verify the web server's identity. This is part of the "http-01 challenge" process.
  3. TCP port 80 and TCP port 443 for the CentreStack server's public IP must be port forwarded by the firewall to the private IP address of the CentreStack server.
  4. TCP port 80 and TCP port 443 must be allowed in the Windows software firewall (this is the default when IIS is installed on Windows).

Install Certify The Web ("Certify")

  1. Navigate to: https://certifytheweb.com
  2. Click the download button to download the latest version of Certify:
    mceclip0.png
  3. Run the installer "as Administrator":
  4. Accept the license agreement and then click the Next button:
    mceclip1.png
  5. Leave the default installation path then click the Next button:
    mceclip2.png
  6. Click the Next button:
    mceclip3.png
  7. Click the Install button:
    mceclip4.png
  8. Click the Finish button:
    mceclip5.png

Configure Certify the Web

  1. Launch Certify The Web,
  2. The Certify user interface will be displayed. Click the New Certificate button:
    mceclip6.png
  3. this message will be displayed, click the OK button:
  4. Enter your email address then click the Yes, I Agree option and the REGISTER CONTACT button:
    mceclip7.png
  5.  
  6. In the Certificate Domains property sheet:
    1. Change the Select Website drop-down to show the Default Web Site,
    2. Add your fully qualified domain name (FQDN) in the Add domains to certificate text box. In our example screenshots the certificate will be configured for the FQDN "fileshare.acmedrive.com".
    3. Click the ADD DOMAINS button:mceclip8.png
  7. Once the ADD DOMAINS button was clicked a new row is added to the property sheet to reflect that the subject of the certificate will be the FQDN specified.
    mceclip9.pngClick the Authorization button to proceed to the next property sheet.
  8. The Domain Authorization sheet requires the Website Root Directory. Start IIS Manager and navigate in the left tree pane to the Default Web Site, then click on the Basic Settings option in the right Actions pane:
  9. Select the text in the Physical Path text box and copy it to the clipboard:
  10. Return to the Certify The Web app and in the Domain Authorization property sheet:
    1. Set the Challenge Type drop-down to: http-01
    2. Paste the text from the clipboard into the Website Root Directory text box:
      mceclip10.pngThen click the Deployment button to proceed to the next property sheet.
  11. In the Certificate Deployment sheet:
    1. Change the Deployment Mode drop-down to Single Site (selected in Domains tab)
    2. Leave Binding Add/Update as Add or Update https bindings as required
    3. In the Matching any of section enable Binding hostname not specified (IP only or All Unassigned)
    4. Leave Auto create/update IIS bindings (uses SNI):
      mceclip12.png
      Click the Test button
  12. Assuming the test completes successfully click the right arrow to collapse the Test Progress pane:
    mceclip13.png
  13. If the test were successful proceed by clicking the Request Certificate button:
    mceclip14.png
    If the test was unsuccessful, see the Troubleshooting section at the end of this article.
  14. The request process will begin:
    mceclip15.png
  15. It should complete successfully:
    mceclip16.png
  16. Click the Settings tab, the defaults are acceptable:
    mceclip17.png

Verify the Certificate Installation

  1. In IIS Manager, check the bindings for TCP 443. Navigate to the Default Web Site in the left pane and click on Bindings in the Actions pane on the right:
  2. In the Site Bindings dialog, select the row for https, port 443, then click the Edit button:
  3. You should see that Certify installed the certificate it obtained and bound it to All Unassigned for TCP port 443:
    mceclip19.png
    Click on the View button.
  4. The certificate information will be displayed. Notice that Let's Encrypt certificate expire in 90 days. This is OK since Certify will renew the certificate every 14 days by default.
    mceclip20.png
    Click on the Certification Path tab
  5. This shows the Certification Path:mceclip22.png
  6. Use a browser on a client PC to verify the certificate is valid for your website:
    mceclip23.png

Troubleshooting

If the http-01 challenge fails it could be caused by this issue: https://github.com/ebekker/ACMESharp/issues/15

Attempt to navigate to this URL from a browser outside the CentreStack server's network: http://<fqdn>/.well-known/acme-challenge/configcheck

If you receive a 404 error save this text as "C:\Program Files (x86)\Gladinet Cloud Enterprise\root\.well-known\acme-challenge\web.config" as described here: https://github.com/ebekker/ACMESharp/issues/15#issuecomment-231272435

Related articles

Comments

3 comments

Date Votes
  • Mods sims

    Great work is done man nice effort

    Sims 4 Drunk Mod Download 12 hours

    0
  • Alop Ulid

    Great work is done man nice effort

    construction company lake city

    0
  • kalvindavid

    The Azure deployment recommendations for CentreStack provide a practical starting point for both testing and production environments, with the production setup favoring a virtual machine with at least 4 vCPUs and 8 GB RAM, while 16 GB RAM is preferred for better performance. CentreStack also requires a compatible MySQL or Microsoft SQL database, and using Azure MySQL or Azure SQL as an external database can provide a more scalable production architecture at an additional cost. When planning the deployment, administrators should review compute, storage, and database expenses and consider current Azure pricing rather than relying on older estimates. These recommendations can also be useful when configuring applications that involve https://theusefulpost.com/how-to-build-a-closet/ or other specialized content workflows, provided the overall deployment meets the required security, performance, and resource requirements.

    0

Please sign in to leave a comment.