Setting up HTTPS using Let's Encrypt - Revision history

Drn@ecs.soton.ac.uk: Added turning off SSLCompression and SSLSessionTickets for better security

2025-10-16T15:33:53Z

Added turning off SSLCompression and SSLSessionTickets for better security

← Older revision		Revision as of 15:33, 16 October 2025
Line 37:		Line 37:
	SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1		SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
	SSLHonorCipherOrder on		SSLHonorCipherOrder on
			SSLCompression off
			SSLSessionTickets off
	SSLCipherSuite ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256		SSLCipherSuite ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256

Drn@ecs.soton.ac.uk: Updated supported ciphers to remove weak ones

2025-09-09T12:06:32Z

Updated supported ciphers to remove weak ones

← Older revision		Revision as of 12:06, 9 September 2025
Line 37:		Line 37:
	SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1		SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
	SSLHonorCipherOrder on		SSLHonorCipherOrder on
	SSLCipherSuite ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM~~-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128~~-SHA256		SSLCipherSuite ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256

	SSLCertificateFile /etc/letsencrypt/live/YOUR-REPOSITORY-DOMAIN/cert.pem		SSLCertificateFile /etc/letsencrypt/live/YOUR-REPOSITORY-DOMAIN/cert.pem

Drn@ecs.soton.ac.uk: /* Additional Notes */ Add some more notes to determine if you need rewrite trigger.

2023-03-29T00:02:24Z

Additional Notes: Add some more notes to determine if you need rewrite trigger.

← Older revision		Revision as of 00:02, 29 March 2023
Line 105:		Line 105:

	== Additional Notes ==		== Additional Notes ==
	The default EPrints Apache Rewrite handler ~~use to decline~~ any requests to a URL containing <code>/.</code>. ~~This meant~~ that the challenge/response for a Let's Encrypt certificate renewal that uses the <code>/.well-known/acme-challenge/</code> path will fail. ~~However~~, ~~this does not seems~~ to be the ~~case in recent (March 2023) testing, although there has not been a specific change to stop declining~~ <code>/.</code> ~~requests~~. ~~If you still find issues it is worth trying the advice below.~~		The default EPrints Apache Rewrite handler declines any requests to a URL containing <code>/.</code>. However, this should not mean that the challenge/response for a Let's Encrypt certificate renewal that uses the <code>/.well-known/acme-challenge/</code> path will fail. As if a request is declined by the handler, it should drop through to looking for the file on the <code>DocumentRoot</code> either set for the Apache or a specific VirtualHost.

	To make this work you could add a location block to your Apache config, to ensure the <code>/.well-known/</code> are not handled by EPrints, or use an EPrints URL rewrite trigger to handle the request:		You can test to confirm this by creating a <code>.well-known/acme-challenge/</code> directory in your <code>DocumentRoot</code>. Typically, this will be something like <code>/var/www/html/.well-known/acme-challenge/</code>. If you then add a small text file you can request (e.g. <code>test.txt</code>) to this directory and then see if you can download it from your web browser, (e.g. <code>http://example.eprints.org/.well-known/acme-challenge/test.txt</code>), if you can download this, Let's Encrypt Acme challenges should work and you can remove the <code>.well-known</code> directory as Certbot will re-create this when it needs it.

			However, if this does not work, you could make this work you could add a location block to your Apache config, to ensure the <code>/.well-known/</code> are not handled by EPrints, or use an EPrints URL rewrite trigger to handle the request:

	<syntaxhighlight lang="perl">		<syntaxhighlight lang="perl">

Drn@ecs.soton.ac.uk at 23:23, 28 March 2023

2023-03-28T23:23:05Z

← Older revision		Revision as of 23:23, 28 March 2023
Line 105:		Line 105:

	== Additional Notes ==		== Additional Notes ==
	The default EPrints Apache Rewrite handler use to decline any requests to a URL containing <code>/.</code>. This meant that the challenge/response for a Let's Encrypt certificate renewal that uses the <code>/.well-known/acme-challenge/</code> path will fail. However, this does not seems to be the case in recent ~~version of EPrints 3~~.4. If you still find issues it is worth trying the advice below.		The default EPrints Apache Rewrite handler use to decline any requests to a URL containing <code>/.</code>. This meant that the challenge/response for a Let's Encrypt certificate renewal that uses the <code>/.well-known/acme-challenge/</code> path will fail. However, this does not seems to be the case in recent (March 2023) testing, although there has not been a specific change to stop declining <code>/.</code> requests. If you still find issues it is worth trying the advice below.

	To make this work you could add a location block to your Apache config, to ensure the <code>/.well-known/</code> are not handled by EPrints, or use an EPrints URL rewrite trigger to handle the request:		To make this work you could add a location block to your Apache config, to ensure the <code>/.well-known/</code> are not handled by EPrints, or use an EPrints URL rewrite trigger to handle the request:

Drn@ecs.soton.ac.uk: Added advice that rewrite trigger should no longer bee needed

2023-03-28T22:45:28Z

Added advice that rewrite trigger should no longer bee needed

← Older revision		Revision as of 22:45, 28 March 2023
Line 99:		Line 99:
	</syntaxhighlight>		</syntaxhighlight>

	12. If the ~~guide on cerbot.eff.org you used in step 1 tells you to to setup a cron job then follow those instructions. The easiest way to do this is probably to run <tt>crontab~~ -~~e</tt> as root and add the following cron job, substituting the minute (43) and hours (6,18) for you own choice maintaining a 12 hour gap between the hours~~:		12. To ensure that the certificate get renewed when necessary enable the certbot-renew timer:

	<syntaxhighlight lang="bash">		<syntaxhighlight lang="bash">
	43 6,18 * * * certbot renew		systemctl enable --now certbot-renew.timer
	</syntaxhighlight>		</syntaxhighlight>

	== Additional Notes ==		== Additional Notes ==
			The default EPrints Apache Rewrite handler use to decline any requests to a URL containing <code>/.</code>. This meant that the challenge/response for a Let's Encrypt certificate renewal that uses the <code>/.well-known/acme-challenge/</code> path will fail. However, this does not seems to be the case in recent version of EPrints 3.4. If you still find issues it is worth trying the advice below.
	The default EPrints Apache Rewrite handler ~~declines~~ any requests to a URL containing <code>/.</code>.

	This ~~means~~ that the challenge/response for a ~~LetsEncrypt~~ certificate renewal that uses the <code>/.well-known/acme-challenge/</code> path will fail.

	To make this work you could add a location block to your Apache config, to ensure the <code>/.well-known/</code> are not handled by EPrints, or use an EPrints URL rewrite trigger to handle the request:		To make this work you could add a location block to your Apache config, to ensure the <code>/.well-known/</code> are not handled by EPrints, or use an EPrints URL rewrite trigger to handle the request:

Drn@ecs.soton.ac.uk: Use 15_https.pl rather than https.pl to make sure it loads before 20_baseurls.pl

2023-03-08T21:04:32Z

Use 15_https.pl rather than https.pl to make sure it loads before 20_baseurls.pl

← Older revision		Revision as of 21:04, 8 March 2023
Line 60:		Line 60:
	</syntaxhighlight>		</syntaxhighlight>

	6. If you have not already done so, add a configuration file at <tt>/opt/eprints3/archives/REPOID/cfg/cfg.d/~~https~~.pl</tt> with the following configuration:		6. If you have not already done so, add a configuration file at <tt>/opt/eprints3/archives/REPOID/cfg/cfg.d/15_https.pl</tt> with the following configuration:

	<syntaxhighlight lang="perl">		<syntaxhighlight lang="perl">

Drn@ecs.soton.ac.uk at 07:18, 1 October 2021

2021-10-01T07:18:29Z

← Older revision		Revision as of 07:18, 1 October 2021
Line 39:		Line 39:
	SSLCipherSuite ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256		SSLCipherSuite ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256


	SSLCertificateFile /etc/letsencrypt/live/YOUR-REPOSITORY-DOMAIN/cert.pem		SSLCertificateFile /etc/letsencrypt/live/YOUR-REPOSITORY-DOMAIN/cert.pem
	SSLCertificateKeyFile /etc/letsencrypt/live/YOUR-REPOSITORY-DOMAIN/privkey.pem		SSLCertificateKeyFile /etc/letsencrypt/live/YOUR-REPOSITORY-DOMAIN/privkey.pem

Drn@ecs.soton.ac.uk: updated supported protocols and ciphers

2021-10-01T07:16:22Z

updated supported protocols and ciphers

← Older revision		Revision as of 07:16, 1 October 2021
Line 35:		Line 35:

	SSLEngine on		SSLEngine on
	SSLProtocol all -SSLv2 -SSLv3		SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
	SSLHonorCipherOrder on		SSLHonorCipherOrder on
	SSLCipherSuite ~~HIGH~~:~~!aNULL~~:~~!eNULL~~:~~!kECDH~~:~~!aDH~~:~~!RC4~~:~~!3DES~~:~~!CAMELLIA~~:~~!MD5~~:~~!PSK:!SRP:!KRB5:@STRENGTH~~		SSLCipherSuite ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256


	SSLCertificateFile /etc/letsencrypt/live/YOUR-REPOSITORY-DOMAIN/cert.pem		SSLCertificateFile /etc/letsencrypt/live/YOUR-REPOSITORY-DOMAIN/cert.pem

Drn@ecs.soton.ac.uk at 07:14, 1 October 2021

2021-10-01T07:14:43Z

← Older revision		Revision as of 07:14, 1 October 2021
Line 53:		Line 53:
	"%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"		"%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"

	Include ~~EPRINTS_PATHH~~/cfg/apache_ssl/REPOID.conf		Include EPRINTS_PATH/cfg/apache_ssl/REPOID.conf

	PerlTransHandler +EPrints::Apache::Rewrite		PerlTransHandler +EPrints::Apache::Rewrite

Libjlrs at 11:15, 21 May 2021

2021-05-21T11:15:10Z

← Older revision		Revision as of 11:15, 21 May 2021
Line 28:		Line 28:
	<syntaxhighlight lang="apache">		<syntaxhighlight lang="apache">
	<VirtualHost *:443>		<VirtualHost *:443>

	ServerName YOUR-REPOSITORY-DOMAIN:443		ServerName YOUR-REPOSITORY-DOMAIN:443

Line 69:		Line 69:

	7. Now you will need to regenerate the rest of your Apache configuration for EPrints with the following command run as the EPrints user. (Substitute the path as appropriate):		7. Now you will need to regenerate the rest of your Apache configuration for EPrints with the following command run as the EPrints user. (Substitute the path as appropriate):

	<syntaxhighlight lang="bash">		<syntaxhighlight lang="bash">
	/opt/eprints3/bin/generate_apacheconf --system --replace		/opt/eprints3/bin/generate_apacheconf --system --replace
Line 81:		Line 82:

	9. Once you have found it you will need to edit it and add the following line, changing the path as appropriate:		9. Once you have found it you will need to edit it and add the following line, changing the path as appropriate:

	<syntaxhighlight lang="apache">		<syntaxhighlight lang="apache">
	Include EPRINTS_PATH/archives/REPOID/ssl/securevhost.conf		Include EPRINTS_PATH/archives/REPOID/ssl/securevhost.conf
	</syntaxhighlight>		</syntaxhighlight>

	10. Now, (as root or using sudo) test that the Apache configuration is correct and fix any issues if necessary:		10. Now, (as root or using sudo) test that the Apache configuration is correct and fix any issues if necessary:

	<syntaxhighlight lang="bash">		<syntaxhighlight lang="bash">
	apachectl configtest		apachectl configtest
Line 90:		Line 94:

	11. Restart Apache and check whether you can access your EPrints repository using HTTPS in a web browser:		11. Restart Apache and check whether you can access your EPrints repository using HTTPS in a web browser:

	<syntaxhighlight lang="bash">		<syntaxhighlight lang="bash">
	apachectl restart		apachectl restart
Line 95:		Line 100:

	12. If the guide on cerbot.eff.org you used in step 1 tells you to to setup a cron job then follow those instructions. The easiest way to do this is probably to run <tt>crontab -e</tt> as root and add the following cron job, substituting the minute (43) and hours (6,18) for you own choice maintaining a 12 hour gap between the hours:		12. If the guide on cerbot.eff.org you used in step 1 tells you to to setup a cron job then follow those instructions. The easiest way to do this is probably to run <tt>crontab -e</tt> as root and add the following cron job, substituting the minute (43) and hours (6,18) for you own choice maintaining a 12 hour gap between the hours:
	<syntaxhighlight lang="~~text~~">
			<syntaxhighlight lang="bash">
	43 6,18 * * * certbot renew		43 6,18 * * * certbot renew
	</syntaxhighlight>		</syntaxhighlight>