The bare installation process we just discussed is suitable for testing. OwnCloud and NextCloud will use HTTPS sessions if HTTPS support is available. Enabling HTTPS support requires an X.509 security certificate.

You can purchase a security certificate from one of the dozens of commercial providers, self-sign a certificate for your own use, or create a free certificate with Let's Encrypt (http://letsencrypt.org).

A self-signed certificate is adequate for testing, but most browsers and phone apps will flag this as an untrusted site. Let's Encrypt is a service of the Internet Security Research Group (ISRG). The certificates they generate are fully registered and all applications can accept them.

The first step in acquiring a certificate is verifying that your site is what you claim it is. Let's Encrypt certificates are validated using a system called Automated Certificate Management Environment (ACME). The ACME system creates a hidden file on your web server, tells the Certificate Authority (CA) where that file is, and the CA confirms that the expected file is there. This proves that you have access to the web server and that DNS records point to the proper hardware.

If you are using a common web server, such as Nginx or Apache, the simplest way to set up your certificates is with the certbot created by EFF:

    # wget https://dl.eff.org/certbot-auto
    # chmod a+x certbot-auto
    # ./certbot-auto

This robot will add new packages and install your new certificate in the proper place.

If you are using a less common server or have a non-standard installation, the getssl package is more configurable. The getssl package is a bash script that reads two configuration files to automate the creation of the certificate. Download the package from here and unzip from https://github.com/srvrco/getssl.

Unzipping getssl.zip creates a folder named getssl_master.

Generating and installing the certificates requires three steps:

1. Create the default configuration files with getssl -c DOMAIN.com.
2. Edit the configuration files.
3. Create the certificates.

Start by cd-ing to the getssl_master folder and creating the configuration files:

    # cd getssl_master
    # getssl -c DOMAIN.com

Replace DOMAIN with the name of your domain.

This step creates the $HOME/.getssl and $HOME/.getssl/DOMAIN.com folders and creates a file named getssl.cfg in both of these. Each of these files must be edited.

Edit ~/.getssl/getssl.cfg and add your email address:

    ACCOUNT_EMAIL='myName@mySite.com'

The default values in the rest of the fields are suitable for most sites.

Next, edit ~/.getssl/DOMAIN.com/getssl.cfg. There are several fields to modify in this file.

The main change is to set the Acme Challenge Location (ACL) field. The ACME protocol will try to find a file in http://www.DOMAIN.com/.well-known/acme-challenge. The ACL value is the physical location of that folder on your system. You must create the .well-known and .well-known/acme-challenge folders and set ownership if they don't exist.

If your web pages are kept in /var/web/DOMAIN, you could create new folders as follows:

# mkdir /var/web/DOMAIN/.well-known
# mkdir /var/web/DOMAIN/.well-known/acme-challenge
# chown webUser.webGroup /var/web/DOMAIN/.well-known
# chown webUser.webGroup /var/web/DOMAIN/.well-known/acme-challenge

The ACL lines would resemble the following:

ACL="/var/web/DOMAIN/.well-known/acme-challenge"
USE_SINGLE_ACL="true"

You must also define where the certificates are to be placed. This location must match the configuration option in your web server. For instance, if certificates are kept in /var/web/certs, the definitions will resemble this:

DOMAIN_CERT_LOCATION="/var/web/certs/DOMAIN.crt"
DOMAIN_KEY_LOCATION="/var/web/certs/DOMAIN.key"
CA_CERT_LOCATION="/var/web/certs/DOMAIN.com.bundle"

You must set the type of test that the ACME protocol will use. These are commented out at the bottom of the configuration file. Using the default values are usually best:

SERVER_TYPE="https"
CHECK_REMOTE="true"

After these edits are complete, test them by running this:

./getssl DOMAIN.com

This command resembles the first one, but it does not include the -c (create) option. You can repeat this command until you've corrected any errors and are happy with the results.

The default behavior of the getssl script is to generate a test certificate that's not really valid. This is done because Let's Encrypt limits the number of actual certificates it will generate for a site to avoid abuse.

Once the configuration files are correct, edit them again and change the server–from the Staging server to the actual Let's Encrypt server:

CA="https://acme-v01.api.letsencrypt.org"

Then, rerun the getssl script one last time with the -f option to force it to rebuild and replace the previous files:

./getssl -f DOMAIN.com

You may need to restart your web server or reboot your system before the new files are recognized.