How To Automate Ssl Generation And Renewals Using Laravel

We are using a simple regex that I “borrowed” from chat gpt🙂 to check the domain and return if it is valid or not.

Automate SSL renewals

Letsencrypt SSL certificates expire after 90 days. Luckily Certbort can renew SSL certificates for us.

Let’s add the method that will renew domain names for us

//App/Utils/SSLManager.php
execute($command);
    }
...

We will need a way of knowing when to renew these SSL certificates. Let’s add a new column on the domain table that will contain the renewal date.

php artisan make:migration add_renewal_column_to_domains_table --table=domains

dateTime('renewal_date')->nullable()->after('status');
        });
    }
    /**
     * Reverse the migrations.
     */
    public function down(): void
    {
        Schema::table('domains', function (Blueprint $table) {
            $table->dropColumn('renewal_date');
        });
    }
};

We will then prepare our job to renew these domains

php artisan make:job RenewSSLJob

domains = $domains;
    }
    /**
     * Execute the job.
     */
    public function handle(): void
    {
        foreach ($this->domains as $domain) {
            (new SSLManager())->renewSSL($domain);
        }
    }
}

Finally, we will schedule the command to run daily. We will get all domains that have expiration due in a month and renew them.

We want to renew them 30 days before they expire to prevent having expired SSL certificates on our server.

//App/Console/Kernel.php
command('inspire')->hourly();
        $renewalDate = Carbon::now()->addDays(30)->toDateTimeString();
        $domains = DB::table('domains')
            ->where('renewal_date', '<=', $renewalDate)
            ->pluck('domain')
            ->toArray();
        if (!empty($domains)) {
             $schedule->job(new RenewSSLJob($domains))->daily();
        }
    }
    /**
     * Register the commands for the application.
     */
    protected function commands(): void
    {
        $this->load(__DIR__ . '/Commands');
        require base_path('routes/console.php');
    }
}

The final helper class should resemble the one below

//App/Utils/SSLManager.php
certbot_command($domain, $email);
        $certbot = Process::path(base_path())->start($command);
        $process = $certbot->wait();

        if ($process->successful()) {
            $file_path = "/etc/nginx/sites-available/$domain";
            if (File::exists($file_path)) {
                $nginx = File::put($file_path, $this->nginx_config($domain));
            } else {
                touch($file_path);
                $nginx = File::put($file_path, $this->nginx_config($domain));
            }
            if ($nginx) {
                $symlink = $this->execute($this->symlink($domain));
                if ($symlink->successful()) {
                    $finally = $this->execute('sudo nginx -t && sudo systemctl reload nginx');
                    if ($finally->successful()) {
                        DB::table('domains')->where('domain', '=', $domain)->update([
                            'status' => 1,
                            'renewal_date' => now()->toDateTimeString()
                        ]);
                        return true;
                    } else {
                        return false;
                    }
                }
            }
        } else {
            return false;
        }
    }
    public function certbot_command($domain, $email): string
    {
        if (config('services.certbot.test') == true) {
            $command = "sudo certbot certonly --nginx --agree-tos --no-eff-email -d $domain --email $email --test-cert";
        } else {
            $command = "sudo certbot certonly --nginx --agree-tos --no-eff-email -d $domain --email $email";
        }
        return $command;
    }
    public function nginx_config($domain): string
    {
        $host = "short.app.com";
        $content = "
        server {
            if (\$host = $domain) {
               return 301 https://\$host\$request_uri;
            }
            listen 80;
            listen [::]:80;
            server_name $domain;
        }
        server {
            listen 443 ssl http2;
            listen [::]:443 ssl http2;
            server_name $domain;
            return 301 https://$host\$request_uri;
            resolver 8.8.8.8;
            location / {
                include proxy_params;
                proxy_pass https://$host\$request_uri;
                proxy_set_header Host $domain;
                proxy_set_header X-Forwarded-Host \$http_host;
                proxy_set_header X-Real-IP \$remote_addr;
                proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
                proxy_set_header X-Forwarded-Proto \$scheme;
                proxy_redirect off;
                proxy_http_version 1.1;
                proxy_set_header Upgrade \$http_upgrade;
            }
            ssl_certificate /etc/letsencrypt/live/$domain/fullchain.pem;
            ssl_certificate_key /etc/letsencrypt/live/$domain/privkey.pem;
            ssl_trusted_certificate /etc/letsencrypt/live/$domain/chain.pem;
            include /etc/letsencrypt/options-ssl-nginx.conf;
            ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
        }";
        return $content;
    }
    private function symlink($domain): string
    {
        return "sudo ln -s /etc/nginx/sites-available/$domain /etc/nginx/sites-enabled/";
    }
    private function execute($command)
    {
        return Process::path(base_path())->run($command);
    }
    public function renewSSL($domain)
    {
        $command = "sudo certbot certonly --force-renew -d $domain";
        return $this->execute($command);
    }
    public function deleteSSL(User $user)
    {
        $domains = $this->getUserDomains($user);
        if (!empty($domains)) {
            foreach ($domains as $domain) {
                $nginx_path = "/etc/nginx/sites-available/$domain";
                $this->deleteConfig($nginx_path);
                $this->execute("sudo rm -rf /etc/nginx/sites-enabled/$domain");
                $this->execute("sudo certbot delete --cert-name $domain --non-interactive");
            }
            $finally = $this->execute('sudo nginx -t && sudo systemctl reload nginx');
            if ($finally->successful()) {
                return true;
            } else {
                return false;
            }
        }
    }
    public function getUserDomains(User $user)
    {
        return Domains::where('user_id', $user->id)->pluck('domain')->toArray();
    }
    public function deleteConfig($file_path)
    {
        if (File::exists($file_path)) {
            return File::delete($file_path);
        } else {
            return false;
        }
    }
}

Final SSLManager Class

Tying it all up

Let’s piece everything together through a controller

php artisan make:controller DomainController

input('domain');
        $email = auth()->user()->email;
        if ((new DomainHelper())->is_valid_domain_name($domain_name)) {
            $domain = Domains::create([
                'user_id' => auth()->id(),
                'domain' => $domain_name,
                'status' => 0
            ]);
            if ((new DomainHelper())->verifycname($domain_name)) {
                $job = (new GenerateSSLJob($domain_name, $email));
                dispatch($job);
            }
            return $domain;
        } else {
            return response()->json([
                'message' => $domain_name . 'is not a valid domain name. Ensure your domain name is valid',
            ], 406);
        }
    }
}

Conclusion

And that’s it. We have automated the process of generating and renewing SSL certificates using laravel.

I hope this article was insightful and showed you how to automate SSL generation and renewals using laravel.

You can tweak the logic to suit your needs. For me, I was using a simple example of a URL shortener and this is how I achieved SSL generation automation.

If you have any questions, feel free to ask them in the comment section.

Thank you for reading.