How to create a “Let’s Encrypt” certificate on Linux

To fully utilize TrueConf Server and other TrueConf products, a TLS certificate is required. For example, for:

• Synchronize TrueConf Server with LDAP
• Join the webinars hosted on TrueConf Server from a browser.
• Previously we explained how to generate a free Let’s Encrypt certificate on Windows. This article will show how to generate this certificate on Linux-based operating systems that are supported by TrueConf Server and TrueConf MCU.
• HTTPS settings in TrueConf AI Server;
• connecting to conferences via a browser on TrueConf MCU.

Getting ready

In order to generate and use a Let’s Encrypt certificate, please follow the instructions below:

• Install the required solution

• Register a domain name with a public (white) IP address

• Open the 80 port on the TrueConf Server instance where you will get the certificate.

If a certificate is issued for a registered domain associated with your server, you can use TXT record verification as shown in the official acme.sh documentation.

Certificate generation

For TrueConf Group, a certificate issued by the reg.trueconf.com server (appears as self-signed in browsers) is already created and used by default. If necessary, you can upload a certificate for your domain as shown in the codec documentation.

For TrueConf Server, TrueConf MCU, and TrueConf AI Server, options for obtaining a certificate on the same machines where these solutions are installed are shown, as this will allow for automatic certificate updates later.

To obtain a certificate on Linux OS, the acme.sh utility will be used. Its main advantage is that it is compatible with all Linux distributions supported by our products.

In order to run the following commands you should have sudo app, while the user's name has to belong to the respective group. If you’d like to check whether you have sudo installed, please execute sudo -V command. If you don’t have sudo by default, you can install it by using apt install sudo command (it should be run under the root account). To add another user with user login to the sudo group, please run usermod -a -G sudo user command under the root account.

• Install the acme.sh utility by specifying your email for notifications using the command:

curl https://get.acme.sh | sh -s email=user@example.com

• Force restart the terminal with the command:

source ~/.bashrc

• By default, this utility uses the ZeroSSL certification authority, which may be unavailable for various reasons. Therefore, switch the certification authority to Let's Encrypt. To do this, execute the command:

acme.sh --set-default-ca --server letsencrypt

• To ensure you always have the latest version of the utility, enable automatic updates using the command:

acme.sh --upgrade --auto-upgrade

• Before executing this command make sure to stop the web server service or any other service,which uses the port 80. Otherwise, the command will not be executed since Certbot is using its own web server to access the Let's Encrypt registration address.

• Stop the TrueConf solution web service for which you are preparing the certificate:

• TrueConf Server:

sudo systemctl stop trueconf-web

• TrueConf MCU:

sudo systemctl stop tcmcu-webproxy

• TrueConf AI Server:

sudo systemctl stop trueconf-ai-manager

Since the certificate for the TrueConf Group codec is issued on a separate machine, you just need to ensure that TCP port 80 is available on this PC.

• Generate the Let’s Encrypt certificate by executing the command:

acme.sh --issue --standalone -d trueconf.domain.ru

The parameter’s description:

• --issue — parameter for obtaining a certificate;

• --standalone — runs its own web server to pass the authentication when getting the certificate.

• -d — indicates a domain or a list of domains separated by commas for which you need to get the certificates.

• trueconf.domain.com — your server's registered domain name.

• If the certificate has been generated successfully you will see the certificate creation message. Certificate’s files (cert.pem and privkey.pem) are saved in the catalogue /etc/letsencrypt/live/test.domain.ru/.

/home/$USER/.acme.sh/trueconf.domain.ru/

Installing a certificate on TrueConf Server

• Copy the certificate and key files, changing their extensions to those supported by the server:

• the certificate file with its extension changed from pem to crt:

sudo cp /home/$USER/.acme.sh/server.example.com/cert.pem /opt/trueconf/server/etc/webmanager/ssl/cert.crt

• the key file with its extension changed from pem to key:

sudo cp /home/$USER/.acme.sh/server.example.com/privkey.pem /opt/trueconf/server/etc/webmanager/ssl/privkey.key

• Restart the server web service using the following command:

sudo systemctl restart trueconf-web

• After restarting, go to the Web → Settings section in the TrueConf Server control panel, then ensure that the External address of the TrueConf Server web page is formatted as https://server_ip_address.

The installation of the certificate with explanations is also shown in the server documentation.

Installing a Certificate on TrueConf MCU

TrueConf MCU supports .crt and .pem formats for security certificates, and .key and .pem formats for keys, so there is no need to rename the files.

• Copy the certificate and key files:

• the certificate file

sudo cp /home/$USER/.acme.sh/server.example.com/cert.pem /opt/trueconf/mcu/etc/ssl/web/

• the key file

sudo cp /home/$USER/.acme.sh/server.example.com/privkey.pem /opt/trueconf/mcu/etc/ssl/web/

• Restart the web service using the command:

sudo systemctl restart tcmcu-webproxy

For additional information, refer to the MCU documentation.

Installing a Certificate on TrueConf AI Server

• Copy the certificate and key files, changing the extensions to those supported by the AI server:

• the certificate file with its extension changed from pem to crt:

sudo cp /home/$USER/.acme.sh/server.example.com/cert.pem /opt/trueconf/ai-server/etc/manager/ssl/cert.crt

• the key file with its extension changed from pem to key:

sudo cp /home/$USER/.acme.sh/server.example.com/privkey.pem /opt/trueconf/ai-server/etc/manager/ssl/privkey.key

• Restart the AI server web service to apply the settings:

systemctl restart trueconf-ai-manager

For AI server settings, refer to the documentation.

Configuring automatic renewal for Let’s Encrypt certificate

To automatically update an existing certificate, you need to create a task in Cron.

To do this, execute the command depending on the TrueConf solution:

• TrueConf Server:

(crontab -l; echo "0 1 * * 0 /home/$USER/.acme.sh/acme.sh --renew -d trueconf.domain.ru --force --reloadcmd 'cp /home/$USER/.acme.sh/trueconf.domain.ru/cert.pem /opt/trueconf/server/etc/webmanager/ssl/custom.crt && cp /home/$USER/.acme.sh/trueconf.domain.ru/privkey.pem /opt/trueconf/server/etc/webmanager/ssl/custom.key && systemctl restart trueconf-web'") | crontab -

• TrueConf MCU:

(crontab -l; echo "0 1 * * 0 /home/$USER/.acme.sh/acme.sh --renew -d trueconf.domain.ru --force --reloadcmd 'cp /home/$USER/.acme.sh/trueconf.domain.ru/cert.pem /opt/trueconf/mcu/etc/ssl/web/custom.crt && cp /home/$USER/.acme.sh/trueconf.domain.ru/privkey.pem /opt/trueconf/mcu/etc/ssl/web/custom.key && systemctl restart tcmcu-webproxy'") | crontab -

• TrueConf AI Server:

(crontab -l; echo "0 1 * * 0 /home/$USER/.acme.sh/acme.sh --renew -d trueconf.domain.ru --reloadcmd 'cp /home/$USER/.acme.sh/trueconf.domain.ru/cert.pem /opt/trueconf/ai-server/etc/manager/ssl/custom.crt && cp /home/$USER/.acme.sh/trueconf.domain.ru/privkey.pem /opt/trueconf/ai-server/etc/manager/ssl/custom.key && systemctl restart trueconf-ai-manager'") | crontab -

where (using the command for TrueConf Server as an example):

• crontab -l — displays current tasks, which is necessary for saving existing tasks in the scheduler;

• echo — inserts the specified string into crontab;

• how time is set (5 characters):

• minute — accepts values from 0 to 59, * — any minute;

• hour — ranges from 0 to 23, * — any hour;

• day of the month — ranges from 1 to 31, * — any day of the month;

• month — takes a value from 1 to 12, * — any month;

• day of the week — takes a value from 0 to 7, * — any day of the week.

In this example, we specified 0 1 * * 0, which means the command will run once a week. The certificate is valid for 90 days, but we will check it more frequently. The acme.sh utility will automatically determine if the certificates need to be renewed and the command will be executed before the certificate expires.

• /home/$USER/.acme.sh/acme.sh — the path to the executable file of the acme.sh utility.

• --renew — command for certificate renewal;

• -d trueconf.domain.ru — the domain name for which the certificate is issued;

• --reloadcmd — the command executed after successfully obtaining a new certificate;

• cp /home/$USER/.acme.sh/trueconf.domain.ru/cert.pem /opt/trueconf/server/etc/webmanager/ssl/custom.crt — copying and renaming the certificate file into the server directory;

• cp /home/$USER/.acme.sh/trueconf.domain.ru/privkey.pem /opt/trueconf/server/etc/webmanager/ssl/custom.key — copying and renaming the private key file to the server directory;

• systemctl restart trueconf-web — restart the service to apply changes.