2

I have a CentOS 7 Server with Apache. Currently there are multiple websites hosted on Virtual Server as "Top Level Server" and "Sub-Server" using VirtualMin, i.e., Multiple Virtual Servers in Apache Webserver.

  • Top-Level Server - www.example1.com (wordpress)
  • Sub-Server - www.example2.com (wordpress)
  • Sub-Server - www.example3.com (opencart)
  • and so on..

Apache Virtual Servers:

  • Default Server - /var/www/html
  • Virtual Server - example1.com - /home/example1/public_html
  • Virtual Server - example2.com - /home/example1/domains/example2.com/public_html
  • Virtual Server - example3.com - /home/example1/domains/example3.com/public_html

I want to install LetsEncrypt SSL for all the websites. Should I install 1 SSL Certificate for all domains or 1 for each domain?

How should I proceed? Any help would be much appreciated.

2 Answers 2

2

You have two options:

  • to obtain multiple certificate, via multiple, separate certbot invocation;

  • to obtain a single certificate with multiple SANs - subject alternative names, via a single certbot invocation (with multiple -d options specified).

If the websites are totally disconnected, I would use option #1. If they are strongly related, I would use option #2.

0

I'm on Debian and Ubuntu systems, and I like their "sites-available vs sites-enabled separate config for each site" mentality.

So...

I have a httpd conf file for each vhost.

<VirtualHost *:80>
  ServerName example.com
  ServerAlias www.example.com
  RewriteEngine on
  RewriteRule ^/(.*)$ https://www.example.com/$1 [R,L]
</VirtualHost>
<VirtualHost 10.0.2.15:443>
    ServerName example.com
    ServerAlias www.example.com
    ServerAdmin [email protected]
    SSLEngine on
    SSLCertificateFile /etc/letsencrypt/live/example.com/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/example.com/privkey.pem
    SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown
    CustomLog ${APACHE_LOG_DIR}/ssl_request_log "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
    DocumentRoot /var/www-example.com
    <directory /var/www-example.com>
        Options All
                AllowOverride All
                Require all granted
    </directory>
    ErrorLog ${APACHE_LOG_DIR}/ssl-example.com-error.log
    CustomLog ${APACHE_LOG_DIR}/ssl-example.com-access.log combined
</VirtualHost>

Don't forget to make your directories for the DocumentRoot.

Then, stop the apache webserver, make sure your firewall is accepting connections to port 443, and invoke the certbot or letsencrypt. I don't trust it to modify my apache config, so I use the certonly option. Do one run through for each domain -

letsencrypt certonly -d example.com -d www.example.com

Then link the apache configs over to sites-enabled or use a2ensite or however you are managing active configurations, test the apache config with apache2ctl -t and if all reports fine then restart apache.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .