How to setup AutoSSL on a free ServerPilot plan

ServerPilot the lightweight hosted control panel integrates well with Let’s Encrypt to generate free SSL certificates with a click of a button. ServerPilot calls this feature AutoSSL and makes it available only on the Coach plan that costs $10/month/server. But by using some custom Nginx configuration we can get Let’s Encrypt working on the free plan. That means you can have an unlimited number of SSL certificates that automatically renew once in three months.

If you haven’t tried ServerPilot, use my referral link to sign up and earn $10 in credit 🙂

Install certbot

Login to your server via SSH and execute the following command. You must be a root user or a user with sudo privileges.

sudo apt-get install software-properties-common
sudo add-apt-repository ppa:certbot/certbot
sudo apt-get update
sudo apt-get install certbot

We need the document root and the domains for the apps that need certificates. If you already know this skip to the next step. Usually the document root is /srv/users/serverpilot/apps/APPNAME/public. The following command extracts the document root from the App’s Nginx virtual host file. Replace APPNAME with your App’s name.

egrep '^\s*root\s+.+;$' /etc/nginx-sp/vhosts.d/APPNAME.conf

Example output:

    root   /srv/users/serverpilot/apps/APPNAME/public;

Note down the App’s domain names from the “Domains” tab.

You can also use the following command to get the domains served by an app.

sed -e '/server_name/,/\;/!d' /etc/nginx-sp/vhosts.d/APPNAME.conf

Example output:

    server_name
        server-appname
        example.com
        www.example.com
      ;

Ignore the first “server-appname” domain and take note of the rest.

Based on the information collected execute the following command replacing the document root and domain names. Add any additional domain names to the end of the command with a -d argument. Eg. -d example.net. Replace “user@example.com” with your email address. It’ll be used to send you alerts when certificates are about to expire.

sudo certbot certonly --agree-tos --non-interactive --email user@example.com --webroot -w /srv/users/serverpilot/apps/APPNAME/public -d example.com -d www.example.com

Note: This command must be executed for each ServerPilot app for which you need an SSL certificate.

Configure Nginx

Execute the following command to list the private key and certificate locations.

sudo certbot certificates

Create and edit a file named ssl.conf inside the /etc/nginx-sp/vhosts.d/APPNAME.d/ directory. Replace the file paths in the highlighted lines with your certificate locations.

/etc/nginx-sp/vhosts.d/APPNAME.d/ssl.conf

listen  443 ssl http2;

ssl_certificate         /etc/letsencrypt/live/example.com/fullchain.pem;
ssl_certificate_key     /etc/letsencrypt/live/example.com/privkey.pem;
ssl_trusted_certificate /etc/letsencrypt/live/example.com/chain.pem;
ssl_session_cache       shared:SSL:20m;
ssl_session_timeout     10m;

ssl_stapling            on;
ssl_stapling_verify     on;
resolver                8.8.8.8 8.8.4.4;

set $ssl_status off;

if ($scheme = "https") {
        set $ssl_status on;
}

proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Ssl $ssl_status;

Save the file and do a configuration test.

sudo service nginx-sp configtest

This should return something similar to the following:

nginx: the configuration file /etc/nginx-sp/nginx.conf syntax is ok
nginx: configuration file /etc/nginx-sp/nginx.conf test is successful

Now reload Nginx:

sudo service nginx-sp reload

That’s it, all the domains in your app should now have valid Let’s Encrypt certificates.

Automating renewal

Certbot already has a cron job in place to automatically renew certificates that will expire within 30 days. However Nginx has to be reloaded in order to utilize the renewed certificates. So we’ll create a shell script and place it inside /etc/letsencrypt/renew-hook.d/. Scripts placed this directory are executed each time certificates are renewed.

Create the a file:

/etc/letsencrypt/renew-hook.d/reload-nginx

with the following contents:

#!/bin/sh
service nginx-sp reload

Grant executable permissions to this file:

sudo chmod +x /etc/letsencrypt/renew-hook.d/reload-nginx

Certbot uses the run-parts command to execute scripts in this directory, so it is better to test if run-parts identifies this script.

run-parts --test /etc/letsencrypt/renew-hook.d

This should output the name of the file (reload-nginx). Hope this tutorial help you implement Let’s Encrypt certificates on a free ServerPilot plan. If not, you can always hire me to do this for you.