SSL via certbot

[davmlaw]

I just setup https on cdotlib.org via:

sudo apt update
sudo apt install certbot python3-certbot-nginx -y

sudo certbot --nginx -d cdotlib.org # Obviously your domain changes here

And it all works! No downloading SSL etc etc. We should do this for tests to start, then see if we can save money on prod certs as well.

[davmlaw]

🤖 Written by Claude

A few reasons this is worth doing:

• Cost savings — Commercial SSL certs (especially wildcard or multi-domain) can cost hundreds of dollars per year. Let's Encrypt certs are free.
• Auto-renewal — Certbot sets up a systemd timer/cron that auto-renews before expiry (certs are 90-day), eliminating the manual renewal process and risk of unexpected expiry.
• Simpler provisioning — No CSR generation, no waiting for CA approval, no downloading and installing cert bundles manually. One command and it's done, including Nginx config updates.
• Industry standard — Let's Encrypt is trusted by all major browsers/OS root stores. There's no practical trust difference vs commercial CAs for domain-validated certs.

Starting with test environments is a sensible approach — low risk way to validate the workflow before migrating prod.

[davmlaw]

🤖 Written by Claude

Let's Encrypt: https://letsencrypt.org/

[EmmaTudini]

Not for Shariant - we are doing certificates via AWS now.