> For the complete documentation index, see [llms.txt](https://prosbcdocs.telcobridges.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://prosbcdocs.telcobridges.com/configuration-details/configuration-by-web-portal-category/system-settings/configuring-letsencrypt-certificate.md).

# Configuring letsencrypt certificate

## Introduction

Let’s Encrypt is a free, automated, and open certificate authority (CA), run for the public’s benefit. It is a service provided by the Internet Security Research Group (ISRG). This tutorial provides you how to configure letsencrypt certificate to use in Telcobridges equipment's.

### Prerequisites

Make sure HTTPS is enabled for the HTTP default service at port 12358.

### Configuration Procedure

Note that the below procedure will survive a toolpack upgrade without breaking HTTPS.

1\. Install certbot and python3

```
 # Install python3 with virtual environment.
sudo yum -y install python3
sudo python3 -m venv /opt/pycertbot/
sudo /opt/pycertbot/bin/pip install --upgrade pip

# Install required dependency
sudo /opt/pycertbot/bin/pip install pyOpenSSL==23.1.1

# Install certbot from pip
sudo /opt/pycertbot/bin/pip install certbot certbot
sudo ln -s /opt/pycertbot/bin/certbot /usr/bin/certbot 
```

\
2\. Create certificate

If unsure, you can temporarily generate a test certificate with --test-cert. Replace the two -d with proper FQDNs, then run:

```
sudo certbot certonly --standalone --agree-tos \
    -d CUSTOMER1.saas.prosbc.com \
    -d ec2-3-96-231-114.ca-central-1.prosbc.com \
    --deploy-hook "cat \${RENEWED_LINEAGE}/privkey.pem \${RENEWED_LINEAGE}/fullchain.pem > \${RENEWED_LINEAGE}/fullchain_with_privkey.pem && ln --force -s \${RENEWED_LINEAGE}/fullchain_with_privkey.pem /lib/tb/toolpack/pkg/ssl_certificate/toolpack_cert.pem && killall -INT lighttpd" \
    --email certificate_saas@telcobridges.com --no-eff-email
```

(the toolpack web server will automatically reload to use the new certificate, thanks to the --deploy-hook)

\
3\. Validation

Validate that a symbolic link is present here:

```
ls -l /lib/tb/toolpack/pkg/ssl_certificate/toolpack_cert.pem
```

* It should point at /etc/letsencrypt/live/FQDN/fullchain\_with\_privkey.pem

If successful, you can access in HTTPS without any warning from the browser!

\
4\. Setup automatic renewal The certificate is valid for 90 days, so we have to enable automatic renewal.

Add the following lines in /etc/crontab:

```
# Run daily at 1 AM
0 1 * * * certbot renew --quiet --agree-tos
```

After a few days, validate there are log files created at 1 AM every day:

* ```
  sudo ls -lrt /var/log/letsencrypt/
  ```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://prosbcdocs.telcobridges.com/configuration-details/configuration-by-web-portal-category/system-settings/configuring-letsencrypt-certificate.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.