Skip to main content

Certbot example: Issue and install certificate for Apache using HTTP-01 domain validation

At the command-line prompt, use the below command syntax to issue and install a public DV/OV/EV certificate for the Apache web server, requesting domain control validation via HTTP-01:

sudo certbot --apache --register-unsafely-without-email --eab-kid {MY-KEY-IDENTIFIER} --eab-hmac-key {MY-HMAC-KEY} --server {ACME-URL} --config-dir {MY-CONFIG-DIR} -d example.com -d www.example.com --manual --preferred-challenges http

Note the following:

  • For DV certificates, domain control validation checks always get handled dynamically by the ACME protocol.

  • For OV/EV certificates, domain validation checks only get handled by the ACME protocol if the domain is not already prevalidated in CertCentral. If the domain is prevalidated, then CertCentral validates the domain itself, out-of-band and independent of the ACME protocol.

  • The --preferred-challenges option specifies the preferred form of domain validation. Enter http here to request HTTP-01 validation.

  • This command runs interactively. Certbot presents you with the below menu to decide how the HTTP validation gets carried out:

    How would you like to authenticate with the ACME CA?
---------------------------------------------------------------------------
1. Apache Web Server plugin (apache)
2. Obtain certificates using a DNS TXT record (if you are using AWS Route 53 for DNS). (dns-route53)
3. Spin up a temporary webserver (standalone)
4. Place files in webroot directory (webroot)
---------------------------------------------------------------------------
Select the appropriate number [1-4] then [enter] (press 'c' to cancel):

  • Select option 1 in the above menu to have Certbot automatically configure the Apache web server for HTTP validation. Your web server must have port 80 open. Certbot will add lines like the following to the virtual host configuration for port 80:

    Alias /.well-known/acme-challenge/ "/var/www/acme/acme-challenge/"
RewriteRule "^/.well-known/acme-challenge/" = [L]
<Directory "/var/www/acme/acme-challenge/">
    Options Indexes MultiViews
    AllowOverride None
    Order allow,deny
</Directory>

  • After validating, the command completes, and the certificate is issued and installed.

  • If the requested certificate matches an existing order, CertCentral applies the default automation action for that order (see ACME automation actions). If there is no matching order, or if the ACME URL includes ?action=enroll, CertCentral treats it as a new order and enrolls the new certificate for you.

Example command:

sudo certbot --apache --register-unsafely-without-email --eab-kid abcdef8sCnHGBsbCOgnv1ijy00l6UeEYCavSSSirl-k --eab-hmac-key EEEraHBXQUxWTEFGdFhndjRVNmV4t4F6c2VNZDM1QzRURGhjdHF3S1NublJjN0dhVUFObzA0SXJwVHBnU2yyUH --server https://one.digicert.com/mpki/api/v1/acme/v2/directory --config-dir /usr/local/certbot/my_other_public_webserver_config/ -d test.com -d www.test.com --preferred-challenges http
En esta sección: