Skip to main content

Creating the server certificate

The first step in setting up HTTPS is to obtain the server certificate. This page will cover 3 ways to create said certificate, choose the one that best fit your use case.

In this guide, we will assume you are exposing FlowG via the logs.example.com hostname.

note

If using Caddy as a reverse proxy, this step can be skipped as it supports automatic ACME challenges.

Using a self-signed certificate​

A self-signed certificate is often used for pre-production/staging environments, or development environments. They are not really suitable for production, but it's still a good way to start.

First, generate a private key:

openssl genpkey -algorithm RSA -out server.key -aes256
note

If you don't want to use a passphrase, omit the -aes256 flag

Then, in a configuration file named openssl.cnf:

[ req ]
distinguished_name = req_distinguished_name
x509_extensions = v3_req
prompt = no

[ req_distinguished_name ]
C = US
ST = State
L = City
O = Organization
OU = Organizational Unit
CN = logs.example.com
emailAddress = admin@logs.example.com

[ v3_req ]
note

Modify the fields to your convenience.

Finally, generate the certificate:

openssl req -x509 -nodes \
  -days 365 \
  -key server.key \
  -out server.crt \
  -config openssl.cnf

And install the certificates:

sudo mv server.key /etc/ssl/private/logs.example.com.key
sudo chmod 600 /etc/ssl/private/logs.example.com.key
sudo chown root:root /etc/ssl/private/logs.example.com.key

sudo mv server.crt /etc/ssl/certs/logs.example.com.crt
sudo chmod 644 /etc/ssl/certs/logs.example.com.crt
sudo chown root:root /etc/ssl/certs/logs.example.com.crt

Using certbot​

First, install certbot:

apt install certbot

Then run the following command:

sudo certbot certonly --standalone -d logs.example.com

If you were running a webserver, for example NGINX, you need to stop it during the challenge:

sudo certbot certonly --standalone \
  --pre-hook "systemctl stop nginx" \
  --post-hook "systemctl start nginx" \
  -d logs.example.com

To renew the certificate:

sudo certbot renew --standalone --cert-name logs.example.com

Or with hooks:

sudo certbot renew --standalone \
  --pre-hook "systemctl stop nginx" \
  --post-hook "systemctl start nginx" \
  --cert-name logs.example.com

You can automate the renewal by adding the renew command to your crontab:

cat <<EOF | sudo tee /etc/cron.daily/certbot-flowg
#!/bin/bash
certbot renew --standalone --quiet --cert-name logs.example.com

## Or with hooks:
# certbot renew --standalone --quiet \
#   --pre-hook "systemctl stop nginx" \
#   --post-hook "systemctl start nginx" \
#   --cert-name logs.example.com
EOF

sudo chmox +x /etc/cron.daily/certbot-flowg

Certificates will be stored in /etc/letsencrypt/live/logs.example.com/.

Using Cert-Manager (on Kubernetes)​

If you deployed FlowG on Kubernetes, using the Helm Chart, you can either rely on Cert-Manager to issue and renew the certificate, or do it yourself by providing a custom secret to flowg.

Refer to Advanced Configuration / Kubernetes / Setting up HTTPS to see instructions.