Let’s Encrypt SSL Certificate Setup for Wazuh Dashboard

🚀 Let’s Encrypt SSL Certificate Setup for Wazuh Dashboard

This guide walks you through installing a free and secure SSL certificate on your Wazuh Dashboard using Let’s Encrypt and Certbot, including automatic renewal configuration.

📌 1. Install Certbot and Obtain Certificate

First, update your system and install Certbot, then obtain the certificate in standalone mode:

sudo apt update
sudo apt install certbot
sudo certbot certonly --standalone -d wazuh.arifakyuz.com

The --standalone flag allows Certbot to run its own temporary web server for validation.

📌 2. Copy Certificates to Wazuh Dashboard Directory

After obtaining the certificates, copy them to the directory accessible by Wazuh Dashboard:

sudo mkdir -p /etc/wazuh-dashboard/certs
sudo cp /etc/letsencrypt/live/wazuh.arifakyuz.com/fullchain.pem /etc/wazuh-dashboard/certs/
sudo cp /etc/letsencrypt/live/wazuh.arifakyuz.com/privkey.pem /etc/wazuh-dashboard/certs/

📌 3. Set Permissions for Certificate Files

Set correct ownership and permissions for security:

sudo chown -R wazuh-dashboard:wazuh-dashboard /etc/wazuh-dashboard/certs/
sudo chmod 440 /etc/wazuh-dashboard/certs/privkey.pem
sudo chmod 444 /etc/wazuh-dashboard/certs/fullchain.pem

📌 4. Configure SSL in Wazuh Dashboard

Edit the Wazuh Dashboard configuration file to enable SSL and specify certificate paths:

sudo nano /etc/wazuh-dashboard/opensearch_dashboards.yml

Add or update the following lines:

server.ssl.enabled: true
server.ssl.key: /etc/wazuh-dashboard/certs/privkey.pem
server.ssl.certificate: /etc/wazuh-dashboard/certs/fullchain.pem

📌 5. Restart Wazuh Dashboard Service

Restart the service to apply the new SSL configuration:

sudo systemctl restart wazuh-dashboard

📌 6. Set Up Automatic Certificate Renewal

Let’s Encrypt certificates expire every 90 days. To automate renewal and restart Wazuh Dashboard after renewal, add a renew hook:

sudo nano /etc/letsencrypt/renewal/wazuh.arifakyuz.com.conf

Add this line at the end of the file:

renew_hook = systemctl restart wazuh-dashboard

Test the renewal process with a dry run:

sudo certbot renew --dry-run

📌 7. Restart Service After Renewal

Finally, restart the Wazuh Dashboard service once more to ensure everything is running smoothly:

sudo systemctl restart wazuh-dashboard

✅ Summary Table

📝 Conclusion

Following these steps will help you secure your Wazuh Dashboard with a free SSL certificate from Let’s Encrypt and ensure automatic renewal for uninterrupted, secure access.