Certificats

Introduction

Garbal uses Let's Encrypt certificates for all websites. This page describes the steps to set up a new certificate using the Win ACME utility (wacs.exe), how the software can be updated and how to troubleshoot the renewal process. Note that the utility is frequently updated and its use may change over time. If the required steps have changed then please change this text accordingly. External reference for Windows Server 2019 with Apache

Installing a new certificate

• Download the latest x64 pluggable zip from Github and archive the file in C:\Programs\Installers.
• Unzip the contents to C:\Programs\LetsEncrypt
• Create the file C:\Programs\LetsEncrypt\RestartApache.bat with the following content:

net stop "ApacheMS4WWebServer4" & sc start "ApacheMS4WWebServer4"

• run wacs.exe from its installation folder as administrator
• New versions may use other shortcuts for the menu options, just follow their descriptions. We are installing to Apache, messages about IIS can be ignored
• M: Create certificate (full options)
• 2: Manual Input
• Host: ...the host name...
  • You will want to use a subdomain, like www.stamp-map.org
  • Make sure to use the actual full name/url of the site (with or without www, or the subdomain like stampdev.hoefsloot.com and wiki.garbal.org)
  • If you want to use both stamp-map.org and www.stamp-map.org then create 2 certificates.
• Friendly name: <enter> (leave it empty)
• How would you like to prove ownership:
• 1: [http-01] Save verification files on (network) path
• Path: C:\Websites\sites<enter>
  • which is the documentroot from apache httpd.conf
• Copy default web.config: n
• CSR request key
• 2: RSA key
• 2: PEM encoded files (Apache)
• File Path: C:\ms4w\Apache\conf
• Password on the private key file
• 1: None
• 5: No (additional) store steps
• 2: Start external script or program
• File: C:\Programs\LetsEncrypt\RestartApache.bat<enter>

{StoreType} {StorePath} {RenewalId}<enter>

• 3: No (additional) installation steps
• Setup for renewal scheduled task: The windows' Task Scheduler will be used. A new task will be installed.
• Do you want to specify the user the task will run as?: n
  • The problem here is that signing in will probably require verification
• R: Run renewal
• Q: Quit

Now change the Apache setup to use the certificate.

Maintenance of LetsEncrypt

If the automatic renewal fails, check Windows' Event Viewer first for error messages. Look for Windows Logs / Application, messages of source "win-acme". If you change settings in wacs, consider re-creating the "renewal scheduled task" from within wacs, because the task seems to be created with a copy of the settings. To test, simply run the task from Task Scheduler and check Windows' Event Viewer to see if there are any errors.