Scribbles for my bad memory

In the realm of modern web development, the HTTPS protocol stands as a cornerstone of security. While Let's Encrypt provides SSL certificates at no cost, their certificate chains don't always play well with older Android versions, such as Android 5. This guide delves into the art of generating Android 5-compatible certificates and automating their renewal.

Step 1: Install Certbot and Nginx

Before embarking on this quest, ensure that your Ubuntu host has Certbot and Nginx installed.

sudo apt-get update
sudo apt-get install certbot nginx

Step 2: Download ISRG Root X1 Certificate

From the Let's Encrypt website, procure the latest ISRG Root X1 certificate and store it in a designated directory.

sudo wget -O /etc/letsencrypt/isrgrootx1.pem https://letsencrypt.org/certs/isrgrootx1.pem

Step 3: Craft the Automation Script

Forge a script named "update-certificates.sh" that automatically generates an Android 5-compatible certificate chain and reloads Nginx's configuration whenever Certbot renews the certificate.

#!/bin/bash

DOMAIN="yourdomain.com" 
CERT_DIR="/etc/letsencrypt/live/$DOMAIN"
FULLCHAIN="$CERT_DIR/fullchain.pem"
PRIVKEY="$CERT_DIR/privkey.pem"
ANDROID_FULLCHAIN="$CERT_DIR/fullchain-android.pem"
ISRG_ROOT="/etc/letsencrypt/isrgrootx1.pem"

# Generate Android5-compatible certificate chain
sudo cat $FULLCHAIN $ISRG_ROOT | sudo tee $ANDROID_FULLCHAIN > /dev/null

# Reload Nginx configuration
sudo systemctl reload nginx

Remember to replace "yourdomain.com" with your actual domain name and verify the paths are correct.

Step 4: Grant Script Execution Privileges

sudo chmod +x /path/to/update-certificates.sh

Step 5: Configure Certbot Renewal Hook

Certbot allows running custom hook scripts upon certificate renewal. Configure the aforementioned script as Certbot's "--deploy-hook" hook.

Edit Certbot's renewal configuration file (usually located at /etc/letsencrypt/renewal/yourdomain.com.conf):

renew_hook = /path/to/update-certificates.sh

Alternatively, configure it using Certbot's command-line option:

sudo certbot renew --deploy-hook /path/to/update-certificates.sh

Step 6: Set Up Automatic Renewal

Certbot by default sets up a cron job or systemd timer to automatically renew certificates. Verify this using the following command:

sudo systemctl list-timers | grep certbot

If no automatic renewal task exists, add a cron job manually:

sudo crontab -e

In the crontab file, add the following line to perform a renewal check daily:

0 2 * * * /usr/bin/certbot renew --deploy-hook /path/to/update-certificates.sh

Conclusion

By following these steps, you can ensure that HTTPS certificates generated using Let's Encrypt are compatible with Android 5 and automate certificate renewal. This eliminates the need to manually renew certificates every three months, significantly streamlining website maintenance.