Windows FREE ssl cert for your domain free or paid

[johnsamir]

Well recently i was trying to use certbot and noticed that support for windows was removed. Do not get if it's working or no, so found a workaround.

The ssl lasts 3 months according to the website. let's begin. Assuming that you already have a DUC no-ip free dns domain or a paid domain.
First of all go to

C:\Windows\System32\drivers\etc

and modify the file hosts.
AT THE END OF

# localhost name resolution is handled within DNS itself.
#    127.0.0.1       localhost
#    ::1             localhost

Add your domains in the following way

127.0.0.1           xxxxx.ddns.net
127.0.0.1          xxxxx.online
127.0.0.1           www.xxxxx.online

save and restart xampp/ apache.

THIS IS A VERY IMPORTANT PART!! we need this to validate our certifcate in the future
now go to

C:\xampp\apache\conf\extra\httpd-vhosts.conf

and add this. save

<VirtualHost *:80>
    ServerAdmin [email protected]
    DocumentRoot "C:/xampp/htdocs"
    ServerName yourdomain.ddns.net
    ServerAlias *.yourdomain.ddns.net
</VirtualHost>

and restart apache

Then, You must go to this website:

https://app.zerossl.com/

Create your account, then go here: Log In - ZeroSSL (https://app.zerossl.com/dashboard). Click where it says new certificate or create certificate if it's your first time.
Everything is very intuitive. Where it says enter domain, fill the form with your domain. Click in next choose 90 days certificate option and click in next step, now click in next step again and do it one more time.

NOW. You got 3 options:

Email Verification

DNS (CNAME)

HTTP File Upload

I used HTTP File Upload because it was the one that was easier to use while i was using DUC no-ip free dns domain. Click on HTTP File Upload a form like the shown in the picture will appear



Click on Download Auth File.( a txt file will be downloaded.

Now go to your website folder, as

i use xampp

the folder where my website is located is in the folder named htdocs located at

C:\xampp\htdocs

( does not matter if you use other Apache, just be sure of being located where your website is located that's it.

Now inside htdocs create a folder named

.well-known

and inside this folder create another one named

pki-validation

inside

pki-validation

we are going to place the txt file previously downloaded.

if everything is properly made you would be able to click in the links given in the step 3 and 4 of the picture above and they should display the info of the txt file.

NOW that everything is properly made, go back to the form and click in next step. a form like the shown below will appear. click on verify domain

STANB BY NEED TO RE DO
STANB BY NEED TO RE DO
STANB BY NEED TO RE DO


OKEY:

THE OTHER OPTION IS VIA

DNS (CNAME)

You need to use what's shown in the form in your CNAME records for that you need go to the website of you domain provider, it always almsot the same steps, go to dns records and fill the forms
here is an example of how it might look

then simply go back to the other website and click on next step, then verify domain

it should success





NOW DOWNLOADED THE ZIP file GO TO

C:\xampp\apache\conf

if you don't have a folder named ssl create one. and there extract the files inside the zip file they are named ca_bundle.crt, certificate.crt and private.key
now go to

C:\xampp\apache\conf\extra\httpd-vhosts.config

and paste this code where it does says

xxx

write your domain name ex(myserver.com), save. restart xampp

 <VirtualHost *:443>
     DocumentRoot "C:/xampp/htdocs"
     ServerName xxx
     ServerAlias *.xxx
     SSLEngine on
     SSLCertificateFile "conf/ssl/certificate.crt"
    SSLCertificateKeyFile "conf/ssl/private.key"
 </VirtualHost>

now you'll be able to access using https://

 

[222222]

When you modify the hosts file on Windows ("C:\Windows\System32\drivers\etc\hosts") you are applying this to your local network. People from the outside of your network will not always be able to see this TLS certificate. It's similar to how .NET Blazor apps work that applies a local certificate only, for testing purposes, and should not be used in production. Following your method might cause issues for other people (even if you portforward your webserver ports). You should only use this method for testing purposes (for example to test certain cookies that require TLS).

You could also get a certificate directly from LetsEncrypt and create a script that will recreate it every 90 days (there's many scripts available on the web). Or you could use an intermediary such as Cloudflare to create an origin certificate for you, so they can renew it on behalf of you. Cloudflare can handle that up to 15 years. I don't see any benefit in using ZeroSSL and then having to repeat this every 90 days, especially since they don't provide as good encryption "out of the box" as LetsEncrypt does. Yours got a "B" score, and misses a lot of important settings, which is not that great in today's day and age.



Is there any particular reason why you choose to host on Windows by the way?

 

[johnsamir]

When you modify the hosts file on Windows ("C:\Windows\System32\drivers\etc\hosts") you are applying this to your local network. People from the outside of your network will not always be able to see this TLS certificate. It's similar to how .NET Blazor apps work that applies a local certificate only, for testing purposes, and should not be used in production. Following your method might cause issues for other people (even if you portforward your webserver ports). You should only use this method for testing purposes (for example to test certain cookies that require TLS).

You could also get a certificate directly from LetsEncrypt and create a script that will recreate it every 90 days (there's many scripts available on the web). Or you could use an intermediary such as Cloudflare to create an origin certificate for you, so they can renew it on behalf of you. Cloudflare can handle that up to 15 years. I don't see any benefit in using ZeroSSL and then having to repeat this every 90 days, especially since they don't provide as good encryption "out of the box" as LetsEncrypt does. Yours got a "B" score, and misses a lot of important settings, which is not that great in today's day and age.

View attachment 84931

Is there any particular reason why you choose to host on Windows by the way?

true forgot to mention it thanks for point it out. after getting the certificate it's nesesary to revert that in order to get it working properly, related to the scripts found anything for windows at least, and read in the github repository that the support was removed, this was the quickest way and easier way. the website was shown as offline since i use dynu client to update my domain, becasue my ip is non static :/