Cat Pem into singline string, make public private key from p12 . Print pem file with in a single line string (useful for saml 2024) - convert cert to string!!! 2025

 https://serverfault.com/questions/466683/can-an-ssl-certificate-be-on-a-single-line-in-a-file-no-line-breaks

//clean up your pem to remove bag attributes

1) print a single line string with \n for line breaks(this is needed because many software will not working properly with

awk 'NF {sub(/\r/, ""); printf "%s\\n",$0;}'  ca.pem

2) print a single line string without \n (SAML metadata etc)

awk 'NF {sub(/\r/, ""); printf "%s",$0;}' ca.pem

make public private key from p12

openssl pkcs12 -in my.p12 -out fullchain.pem -clcerts -nokeys
openssl pkcs12 -in my.p12 -nodes -nocerts -out privkey.pem

HTTP/SSL lets encrypt, or CA either uses private/public key pair from your own server or they generate for u, browser HTTPS validation

 browser https validation:

https://www.linkedin.com/pulse/how-does-your-browser-knows-tls-certificate-presented-ehis-iribhogbe

lets encrypt how it works:

https://letsencrypt.org/how-it-works/

The official Let’s Encrypt client can either use an already-created key pair, which you can generate under any circumstances you prefer, or it can perform the generation for you, which it will do with OpenSSL, see letsencrypt/crypto_util.py 184.

*Note: generation for you meaning that it will run script to generate public/private key pairs on your server.

def make_key(bits):

    """Generate PEM encoded RSA key.

    :param int bits: Number of bits, at least 1024.

    :returns: new RSA key in PEM form with specified number of bits

    :rtype: str

    """

    assert bits >= 1024  # XXX

    key = OpenSSL.crypto.PKey()

    key.generate_key(OpenSSL.crypto.TYPE_RSA, bits)

    return OpenSSL.crypto.dump_privatekey(OpenSSL.crypto.FILETYPE_PEM, key)

2022 HTTPS TLS/SSL- Virtual Host + Manual SSL with Lets Encrypt Guide (2024)

For detail see your own aws environment -2024

Virtual Host + Manual SSL with Lets Encrypt Guide
SSL not working?
visit https://joeyxff.blogspot.com/2020/01/apache2-ssl-does-not-work-on-server-or.html

********Redirect / https://mydomain.ca/

the slash behind mydomain.ca is important becasue without it http://mydomain.ca/test will go to https://mydomain.catest instead of https://mydomian.ca/test   

1. Purchase a valid domain
2. Add DNS A record to map the domain to public IP of server

VIRTUAL HOST:
(mkdir -p means: create the directory and, if required, all parent directories.)
3.  $sudo mkdir -p /var/www/mydomain/html
4. $sudo chown -R $USER:$USER /var/www/mydomain/
5. $sudo chmod -R 750 /var/www/mydomain/ (see following for details)

• Apache2 has default user www-data, group www-data, double check by using $ less /etc/passwd, check groups by using $cat /etc/group
• The key information is to realize that the web server will access vue js files && laravel php files using the www-data user to serve the application based on browser request
• A clean, independent group needs to be created for the current logged in user (with root permission) && www-data
• create a webdev group by using $sudo addgroup webdev. Add user to group by using sudo adduser www-data webdev. Then also add the current user to the webdev group adduser jxiang webdev
• Save all work, reboot OS for the newly created group to take effect. $sudo reboot
• Check if apache2 has restarted after reboot $ service apache2 status
• Restart apache2 if needed $service apache2 restart
• Change ownership of my-ssl.ca (/var/www/mydomain/) to current_user:webdev group. $chown user:webdev my-ssl.ca. 
• Give current user rwx permission, other user in the group rx permission, an no permission for public. $chmod 750 my-ssl.ca
• Set group id :  chmod g+s  my-ssl.ca. When this is set any new folders or files created inside my-ssl.ca will autmoatically inheirt group webdev. When this takes effect , s will appear in for example drwxrws--- folder
• The default permission for ubnutu for a new folder is 755, or 750 inside a user's home folder, for a file is 644 or 640 insider a user's home folder. We do not want that
• To change it, we need to add ACL, this requires group id. $id www-data, to see webdev groupid
• $sudo setfacl -Rdm g:group_id:rx my-ssl.ca
• R is recursive, which means everything under that directory will have the rule applied to it. 
  d is default, which means for all future items created under that directory, have these rules apply by default. m is needed to add/modify rules. This command is to give future items created or copied to my-ssl.ca only read and execute permission (Caution, moved file will not obey this rule) When this has effect drwxr-x---+ a + will appear showing ACL has effect
• use $getfacl folder to check if it is working. There should be default:user rwx, default:webdev:rw-
• For existing items use $sudo setfacl -Rm g:group_id:rx my-ssl.ca
• Remember, read permission for folder is the permission to open any files/folder, execute permission is to cd into folder, and write permission is to create any files/folder
• Remeber, read permission for file is to open a specific file, execute is to run file as an executable, and write is to change the content of file
• inside my-ssl.ca create html folder

6. $sudo vim /var/www/mydomain/html/index.html 
7. Index.html can have any contents for demo
8. $sudo cp /etc/apache2/sites-available/000-default.conf /etc/apache2/sites-available/mydomain.conf
9. $sudo vim /etc/apache2/sites-available/mydomain.conf
10.<VirtualHost *:80>

 # The ServerName directive sets the request scheme, hostname and port that
 # the server uses to identify itself. This is used when creating
 # redirection URLs. In the context of virtual hosts, the ServerName
 # specifies what hostname must appear in the request's Host: header to
 # match this virtual host. For the default virtual host (this file) this
 # value is not decisive as it is used as a last resort host regardless.
 # However, you must set it for any further virtual host explicitly.
 #ServerName www.example.com

   ServerAdmin webmaster@mydomain
   ServerName mydomain
   ServerAlias mydomain.ca/com (no www)

   DocumentRoot /var/www/mydomain/html 

// Disable default conf
* a2dissite  000-default.conf 
*
* a2dissite  default-ssl.conf 

11. $sudo a2ensite mydomain.conf
12. $ sudo systemctl reload apache2

LETS ENCRYPT
13.sudo add-apt-repository ppa:certbot/certbot (!! Deprecated use next line)

https://www.digitalocean.com/community/tutorials/how-to-secure-apache-with-let-s-encrypt-on-ubuntu-20-04
14. sudo apt install python-certbot-apache
#mydomain for next line sudois xxx.ca full domain
！！！！！！！！！！！ domain has to be without wwww, xxx@mail.ca can be your server mail address
15. $sudo certbot certonly --manual --preferred-challenges http -m xxx@mail.ca -d mydomain --dry-run
// If dry run success (follow instruction create file thats chmod 755 which is publicly accessible)
16. $ll
17. certs are valid for 3 months, located in /etc/letsencrypt/domain/fullchain.pem etc
18. create ssl.conf file
19. $sudo cp /etc/apache2/sites-available/default-ssl.conf /etc/apache2/sites-available/mydomain-ssl.conf
20. $sudo vim /etc/apache2/sites-available/mydomain-ssl.conf

21. For custom cert location, it should be at /etc/ssl
21. <VirtualHost *:443>

 # The ServerName directive sets the request scheme, hostname and port that
 # the server uses to identify itself. This is used when creating
 # redirection URLs. In the context of virtual hosts, the ServerName
 # specifies what hostname must appear in the request's Host: header to
 # match this virtual host. For the default virtual host (this file) this
 # value is not decisive as it is used as a last resort host regardless.
 # However, you must set it for any further virtual host explicitly.
 #ServerName www.example.com

   ServerAdmin webmaster@mydomain

   ServerName mydomain
   ServerAlias mydomain(no www)

   DocumentRoot /var/www/mydomain/html

SSLCertificateFile /etc/letsencrypt/domain/fullchain.pem

SSLCertificateKeyFile /etc/letsencrypt/domain/privkey.pem

22. $sudo a2ensite mydomain-ssl.conf
23. // Redirect http to https
24.  $sudo vim /etc/apache2/sites-available/mydomain.conf
25..<VirtualHost *:80>

 # The ServerName directive sets the request scheme, hostname and port that
 # the server uses to identify itself. This is used when creating
 # redirection URLs. In the context of virtual hosts, the ServerName
 # specifies what hostname must appear in the request's Host: header to
 # match this virtual host. For the default virtual host (this file) this
 # value is not decisive as it is used as a last resort host regardless.
 # However, you must set it for any further virtual host explicitly.
 #ServerName www.example.com

   ServerAdmin webmaster@mydomain
   ServerName mydomain
   ServerAlias mydomain

DocumentRoot /var/www/mydomain/html  

# Trailling slash is important as any http redirect of url that contains subdir will redirect to https://mydomain.ca/subdir instead of https://mydomain.ca.subdir

Redirect / https://mydomain.ca/   

(redirect need trailing slashe)
or https://community.letsencrypt.org/t/renewal-wrong-fetch-url/43879 this will occur  
!!!!!!!!!!!!!!!2021 @@ Apache need to enable mod-ssl

a2enmod ssl

https://stackoverflow.com/questions/5257974/how-to-install-mod-ssl-for-apache-httpd

26. sudo systemctl restart apache2
27. Lets encrypt certs expires every 3 month, cant auto renew because created manual. To renew check:
sudo openssl x509 -noout -dates -in /etc/letsencrypt/live/lab.citycentreupcc.ca/cert.pem

(certifcates date)

28. sudo certbot certificates

(list of certificates)

#######29. certbot certonly --manual --preferred-challenges=http --manual-auth-hook /path/to/http/authenticator.sh --manual-cleanup-hook /path/to/http/cleanup.sh -d secure.example.com --force-renewal


29.a) create a directory(domain_name) at home to run auto renew, set chmod 770 and set group inheritance and default acl to rwx to group, 
29. b) create ssl_renew folder
29. c) create autehticator.sh and cleanup.sh

30. /path/to/http/authenticator.sh (/home/authenticator.sh)
  
!!!! /.well-known/acme-challenge/ folder must be created for it to work. certbot is run as root.

!!!! .sh script must be executable by current user as current user runs certbot, check getfacl && chmod need to have execute and read

#!/bin/bash
echo $CERTBOT_VALIDATION > /var/www/htdocs/.well-known/acme-challenge/$CERTBOT_TOKEN

/path/to/http/cleanup.sh (/home/cleanup.sh)

#!/bin/bash
rm -f /var/www/htdocs/.well-known/acme-challenge/$CERTBOT_TOKEN

(https://certbot.eff.org/docs/using.html#pre-and-post-validation-hooks
https://community.letsencrypt.org/t/cant-renew-the-certification-with-error-an-authentication-script-must-be-provided-with-manual-auth-hook-when-using-the-manual-plugin-non-interactively/67216/2)


34. Sample dryrun for renewal (can also be used to get new certs)



sudo certbot certonly --manual --preferred-challenges=http --manual-auth-hook /absolute_path/authenticator.sh --manual-cleanup-hook /absolute_path/cleanup.sh -d <domain> --force-renewal --dry-run


**** make sure .sh are executable 770
(This can also be used to get certs directly)
sudo certbot certonly --manual --preferred-challenges=http --manual-auth-hook /absolute_path/authenticator.sh --manual-cleanup-hook /absolute_path/cleanup.sh -d <domain>  --dry-run


31.add to cron
32. sudo vim /etc/crontab(open cron job list as root)
33. Certs can only be renewed 30 days prior to expiration, for force renewal, allowed 5 renewal in 7 days per domain.  So we can schedule a cron job to renew every 1st, 7th, 21st, 28th of the month at 3:29 to renew . We also need to reload apache2 config afterwards
34. sudo vim /etc/crontab

!!!!!!!!!! domain has to be without www
29 3 1,7,21,28 * *  root  certbot certonly --manual --preferred-challenges=http --manual-auth-hook /absolute_path/authenticator.sh --manual-cleanup-hook /absolute_path/cleanup.sh -d <domain> --force-renewal && service apache2 reload


// check cron 

/ Schedule

vim /etc/crontab

// Check cron job status

tail -f /var/log/syslog

grep cron /var/log/syslog

https://askubuntu.com/questions/85558/verify-if-crontab-works





cron - Verify if crontab works - Ask Ubuntu

Stack Exchange Network. Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.. Visit Stack Exchange

askubuntu.com

https://dev-notes.eu/2018/05/set-up-an-automatic-letsencrypt-renewal-cronjob/


https://www.ostechnix.com/configure-apache-virtual-hosts-ubuntu-part-1/

https://www.linuxbabe.com/ubuntu/https-apache-letsencrypt-ubuntu16-04-17-10

https://community.letsencrypt.org/t/pluginerror-an-authentication-script-must-be-provided-with-manual-auth-hook-when-using-the-manual-plugin-non-interactively-skipping/69718