13

https://letsencrypt.org/ is a new free, automated SSL certificate issuing service that simplifies SSL certificate issuance. Despite being a new CA (Certificate Authority), the certificates are recognized by all major browsers already because they are cross-signed by IdenTrust. The project is intended to facilitate much more pervasive encryption of the Internet - https://www.eff.org/deeplinks/2016/03/new-name-and-roadmap-lets-encrypt-client.

The Electronic Frontiers Foundation and others launched the service to the public in December 2015 (https://www.eff.org/deeplinks/2015/12/lets-encrypt-project-comes-fruition-2015-review), and it recently issued its 1,000,000th certificate (https://www.eff.org/deeplinks/2016/03/new-name-and-roadmap-lets-encrypt-client). Has anyone in the CiviCRM community started using Let's Encrypt in production despite the warning that it is only a beta (https://letsencrypt.readthedocs.org/en/latest/intro.html)? Any problems or gotchas?

Improve this question
1
  • I'm using it on a personal test server, but not in production.
    – DaveFF
    Commented Mar 21, 2016 at 12:21

3 Answers 3

Reset to default
6

Yes - I'm using it on one production site and one pre-production. One has the full letsencrypt client, but it assumes root access. The other uses an alternative client https://github.com/diafygi/letsencrypt-nosudo that doesn't need root and works on shared hosting (but you may need to tweak your .htaccess file for the verification process).

I've not needed to renew certs yet. Although not really a problem, be aware that certs only last 3 months (though I think that's during beta). If you have access to the webserver config, there is an auto-renewal feature but if you need to raise a support ticket on a shared hosting platform, that's less convenient.

Improve this answer
4

I am using a hosting control panel that supports it. Sign up, certificate creation and renewal are hassle free with this panel. You only need a (virtual private) server, and a linux distribution, preferably Debian for better support. According to their comparison chart, Let's encrypt is supported both in Standard and Business edition.

The panel is written in C, has its own web GUI as independent service and works fast with only limited resources. See for more information http://www.liveconfig.com/en/ and http://www.liveconfig.com/en/editions

Improve this answer
3

Our WordPress 4.6.1 + CiviCRM 4.7.12 instance is hosted on Dreamhost. I simply added a free Let's Encrypt SSL certificate to our site from the Dreamhost cpanel, installed the "Really Simple SSL" WordPress plugin, activated, and done. Without the plugin, I was getting mixed-content warnings. Afterwards, in Chrome, the green lock displays in the address bar for every page, front-facing and back-end. The plugin also modified .htaccess to redirect https.

Improve this answer
1
  • 2
    I would also remind to go to Administer > System Settings > Resource URLs and check Yes on "Force Secure URLs (SSL)" For some reason, one of our admins kept getting time outs accessing the backend until this was set.
    – Karl Rudnick
    Commented Dec 17, 2016 at 7:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.