Now that we have a domain, let's use it to obtain an SSL certificate. Of course, obtaining an SSL certificate also costs money. Most active domain providers also offer SSL issuance alongside domains.

For testing purposes, SSL issuance would be an unwelcome cost, just like the domain was. There are also ways to obtain SSL for free, and there are actually far more options for this than there were for the domain.

However, being free, there are also some limitations that come with it — a very short validity period, or a cap on how many domains can be registered, for example. That said, using Let's Encrypt lets you obtain SSL without any real restrictions. Unlike Freenom, which was covered earlier, this one can be applied to a production server without any issues whatsoever. Thanks to this, if you look closely at the certificates on small-scale sites, you'll often find that the issuer is Let's Encrypt.

Let's obtain SSL through Let's Encrypt. The environment is as follows. We'll proceed based on Windows 10.

Actually, Let's Encrypt is the organization that issues SSL, but it doesn't work by having you sign up on their site and submit documents. There are many programs out there that communicate with Let's Encrypt to issue SSL certificates for you, so all you need to do is download one of those.

Check out the list of supported programs. Among them, we'll use win-acme, which is built for Windows 10.

Here's what you'll need:

• Windows 10
• A domain linked to your own IP address
• A network environment where port 80 is accessible
  • If not, DNS-based configuration is possible instead
• A WAS (we'll use Tomcat here)

Without the items above, it will be difficult to proceed with SSL issuance.

Download win-acme from the site below.

Download

Extract the archive. Running wacs.exe will bring up a window like the one below.

We'll proceed with issuance by entering commands.

• Create certificate (default settings): issue SSL with default options (N)
• Create certificate (full settings): issue SSL by choosing your own options (M)
• Run renewals: renew (R)
• Manage renewals: manage renewals (A)
• More options...: more options (O)
• Quit: quit (Q)

Enter [M] to issue SSL by choosing your own options. Case doesn't matter, so just type it as-is.

• Read site bindings from IIS: bind from IIS (1)
• Manual input: enter manually (2)
• CSR created by another program: a CSR created by another program (3)
• Abort: abort (C)

We'll enter [2] to input the domain manually.

Enter the domain you want to verify. You can also bundle multiple domains into a single certificate, in which case you separate them with commas (,).

BATCH
example.com

If you're verifying a single domain, enter it as shown above.

BATCH
example.com,www.example.com,admin.example.com

If you're verifying multiple domains, enter them separated by commas as shown above.

Keep in mind that every domain you enter needs to be successfully verified. After entering the domain, it will ask you to enter an alias for the domain — just leave it blank and press [Enter] to move on.

• Save verification files on (network) path: save verification files to a network path (1)
• Serve verification files from memory: serve verification files from memory (2)
• Upload verification files via FTP(S): upload verification files via FTP (3)
• Upload verification files via SSH-FTP: upload verification files via SSH-FTP (4)
• Upload verification files via WebDav: upload verification files via WebDav (5)
• Create verification records manually (auto-renew not possible): create verification records manually (auto-renewal not possible) (6)
• Create verification records acme-dns: create verification records via acme-dns (7)
• Create verification records with your own script: create verification records with your own script (8)
• Answer TLS verification request from win-acme: respond to win-acme's TLS verification request (9)

Option 1 creates the verification file at the web root path you'll enter next, while options 3-5 have you upload the provided file directly. Options 6-8 require DNS record configuration.

Option 1 is usually the easiest, so this document will proceed with option 1.

Enter the web root path. For example, if you have the domain https://example.com, you need to enter the path where that domain's files are located.

If it's a stock, unmodified Tomcat install, this would be %TOMCAT_HOME%/webapps/ROOT.

This varies by environment, so enter it appropriately. Note that, at this stage, you must be able to access it via port 80.

If port 80 isn't usable, try options 6-8, which use DNS-based verification instead. Email-based verification isn't supported here.

It will also ask whether you want to copy your web settings — don't do that.

• Elliptic Curve key: elliptic curve cryptography (1)
• RSA Key: asymmetric cryptography (2)

Select [2].

• IIS Central Certificate Store: certificate for IIS (.pfx) (1)
• PEM encoded files: certificate for Apache-family servers (.pem) (2)
• PFX archive: a .pfx file (3)
• Windows Certificate Store: the Windows certificate store (4)
• No (additional) store steps: don't store any (additional) certificate (5)

Since this document is based on Tomcat, select [2].

Enter the save path you want. Use whatever path is convenient for you.

• None: none (1)
• Type/paste in console: type/paste it into the console (2)
• Search in vault: search in the vault (3)

Select [2].

Enter the password you want. Once entered, it will ask whether you want to save that password in the vault for later use. Do whichever you prefer.

If you choose to save it, you'll likely be able to reuse the previous password later via option [3].

The same process as step 8. Repeat this if you need a certificate in another additional file format.

Since this isn't needed for this document, press [5] to skip creating any more, and move on.

• Create or update https bindings in IIS: create or update HTTPS bindings in IIS (1)
• Create or update ftps bindings in IIS: create or update FTPS (secure FTP) bindings in IIS (2)
• Start external scripts or program: run an external script (3)
• No (additional) installation steps: no additional installation steps (4)

Select [4] since there's nothing else to do, and move on.

Verification is performed for the domain you entered earlier. Since it only validates domain ownership, this can be considered a DV certificate.

A .well-known folder should now have been created at the web root you entered earlier.

Access http://www.kapoo.ga/.well-known/{hash}/{file} to check whether it matches the information of the randomly generated file you actually have. If it matches, the domain is judged to be valid.

Later, it will ask whether you want it to perform a certain task — answer no.

If you go to the save path you entered in step 9, you'll find that pem files have been generated.

• example.com-chain.pem: a certificate combining the signature and the CA's intermediate certificate
• example.com-chain-only.pem: the CA's intermediate certificate
• example.com-crt.pem: the signed certificate
• example.com-key.pem: the certificate's private key

Once these four files have been generated, SSL has been successfully issued. You can now apply this to your web server, WAS, and so on.

We obtained SSL for free through Let's Encrypt. Even though it's free, it comes with a validity period of a full year, and an auto-renewal script is even added automatically at the time of issuance.

Despite being free, once you've properly set up your environment, you barely need to think about SSL at all. Because of this convenience, many places use Let's Encrypt despite it being free.

In the next chapter, we'll apply this certificate directly to Tomcat.