Add let´s enrypt to geonode

Apache:GeoNode SSL-TLS LE Authority

# - Close port 8080 for inbound networking
# - Edit your local_settings to use proxy /geonode (and not port 8080)
# - Add following to local_settings: AVATAR_GRAVATAR_SSL = True
# - make sure mod_ssl is active: $ a2enmod ssl

# add let´s encrypt repository 
  $ sudo add-apt-repository ppa:certbot/certbot
  $ sudo apt-get update

# install certbot
  $ sudo apt-get install python-certbot-apache

# add cert
# - this will create certs and geonode-le-ssl.conf ! see comment 1 below
# - Further it will configure a cron job to regenerate certs before 90 days limit
# - (for multiple domains use $ sudo certbot --apache -d example.com -d www.example.com)
# - if your certs coming from another authority or you´d like to force ssh see comment 2
  $ sudo certbot --apache -d example.com

# export database
  $ pg_dump -U geonode -d geonode > /tmp/geonode.sql

# replace old http urls
  $ sed -i 's,http://example.com,https://example.com,g' /tmp/geonode.sql

# rename geonode database
  $ sudo -u postgres psql -c "ALTER DATABASE geonode RENAME TO geonode_bak"

# create tmp database
  $ sudo -u postgres createdb -O geonode geonode

# restore dump 
  $ sudo -u postgres psql -d geonode -f /tmp/geonode.sql

# if all is fine drop geonode_bak

This is an apache conf example for a let´s encrypt cert. It will get auto generated with above commands. In this example http stays intact (by /etc/apache2/sites-available/geonode.conf)

$ cat /etc/apache2/sites-available/geonode-le-ssl.conf 

<IfModule mod_ssl.c>
<VirtualHost *:443>
    ServerName http://localhost
    ServerAdmin webmaster@example.com
    DocumentRoot /home/ubuntu/master/master

    LimitRequestFieldSize 32760
    LimitRequestLine 32760

    ErrorLog /var/log/apache2/error.log
    LogLevel warn
    CustomLog /var/log/apache2/access.log combined

    WSGIProcessGroup geonode
    WSGIPassAuthorization On
    WSGIScriptAlias / /home/ubuntu/master/master/wsgi.py

    Alias /static/ /home/ubuntu/master/master/static_root/
    Alias /uploaded/ /home/ubuntu/master/master/uploaded/

    <Directory "/home/ubuntu/master/master/">
         <Files wsgi.py>
             Order deny,allow
             Allow from all
             Require all granted
         </Files>

        Order allow,deny
        Options Indexes FollowSymLinks
        Allow from all
        IndexOptions FancyIndexing
    </Directory>

    <Directory "/home/ubuntu/master/master/static_root/">
        Order allow,deny
        Options Indexes FollowSymLinks
        Allow from all
        Require all granted
        IndexOptions FancyIndexing
    </Directory>

    <Directory "/home/ubuntu/master/master/uploaded/thumbs/">
        Order allow,deny
        Options Indexes FollowSymLinks
        Allow from all
        Require all granted
        IndexOptions FancyIndexing
    </Directory>

    <Directory "/home/ubuntu/master/master/uploaded/avatars/">
        Order allow,deny
        Options Indexes FollowSymLinks
        Allow from all
        Require all granted
        IndexOptions FancyIndexing
    </Directory>

    <Directory "/home/ubuntu/master/master/uploaded/people_group/">
        Order allow,deny
        Options Indexes FollowSymLinks
        Allow from all
        Require all granted
        IndexOptions FancyIndexing
    </Directory>

    <Directory "/home/ubuntu/master/master/uploaded/group/">
        Order allow,deny
        Options Indexes FollowSymLinks
        Allow from all
        Require all granted
        IndexOptions FancyIndexing
    </Directory>

    <Directory "/home/ubuntu/master/master/uploaded/documents/">
        Order allow,deny
        Options Indexes FollowSymLinks
        Deny from all
        Require all granted
        IndexOptions FancyIndexing
    </Directory>

    <Directory "/home/ubuntu/master/master/uploaded/layers/">
        Order allow,deny
        Options Indexes FollowSymLinks
        Deny from all
        Require all granted
        IndexOptions FancyIndexing
    </Directory>

    <Proxy *>
        Order allow,deny
        Allow from all
    </Proxy>

    ProxyPreserveHost On
    ProxyPass /geoserver http://127.0.0.1:8080/geoserver
    ProxyPassReverse /geoserver http://127.0.0.1:8080/geoserver

ServerAlias example.com
SSLCertificateFile /etc/letsencrypt/live/example.com/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/example.com/privkey.pem
Include /etc/letsencrypt/options-ssl-apache.conf
</VirtualHost>
</IfModule>