Adding a valid certificate

[darrenwoods3]

Would someone have the procedure for adding a valid certificate to my netbox server. Using Ubuntu and Apache

[candlerb]

This is not really a Netbox question, but I'll outline the things you need to search for.

You need to get yourself a free certificate using LetsEncrypt. There are various client programs which can do this for you, including certbot and dehydrated. As well as the client documentation, there are lots of how-tos out there on the web.

The client program automates the fetching of certificates, and should be run periodically so that it can renew them. This generally happens between 60 and 90 days after they were initially issued, because the certs themselves expire after 90 days.

A couple of points you might want to note:

• While you're setting up and testing, I strongly recommend you configure your client to use the "staging" LetsEncrypt endpoint rather than "production". The production environment has some rate-limiting rules that mean that if you hit it with too many erroneous requests, it will lock you out for some hours. The staging environment doesn't have this problem.
  Of course, the certificates it issues are signed by a CA that your browser won't trust, but once you've got the mechanics working correctly then you can repoint to the production server to get your real certificate.
• Your client needs to prove that the domain is yours, by responding to a challenge. The easiest way of doing this is called "HTTP-01", but it requires your server to have a public IP (v4 or v6), pointed to by the DNS name you're trying to get a certificate for, and more importantly it must accept incoming connections from the whole Internet on port 80, at least while the certificate issuance or renewal is taking place.
  If that's not possible in your environment then you can still use LetsEncrypt, but you need to use the "DNS-01" challenge instead. This involves you publishing a TXT record containing the challenge within your DNS zone. Therefore you either need to have some sort of dynamic DNS updates or API updates to your DNS authoritative server; or you need to install the challenges by hand (which is a bit tedious, as you'll have to repeat this periodically).