Let’s Encrypt - Revision history

Vincent: Wording

2017-04-05T06:02:03Z

Wording

← Older revision		Revision as of 06:02, 5 April 2017
Line 1:		Line 1:
	~~{{Debian}}~~

	This guide will show you how to get free certificates using [https://letsencrypt.org/ Let’s Encrypt].		This guide will show you how to get free certificates using [https://letsencrypt.org/ Let’s Encrypt].

Line 8:		Line 6:

	== Prerequisite ==		== Prerequisite ==
			This guide assume that you have a [[Nginx\|nginx]] server running and listening on port 80.

	~~This guide assume that you have an [[Nginx]] server running and listening on port 80.~~		The certificates can be then used for other purposes, like an email server. In that case, nginx is only used for the renewal process.

	The certificates can be then used for other purposes, like email server. ~~Nginx~~ is only used for the renewal process.

	== Installation ==		== Installation ==
Line 19:		Line 16:
	<syntaxhighlight lang="console">		<syntaxhighlight lang="console">
	$ sudo apt install certbot/jessie-backports		$ sudo apt install certbot/jessie-backports
	</syntaxhighlight>Next disable Cerbot auto-renewal script as it will interfere with the one bellow.<syntaxhighlight lang="console">		</syntaxhighlight>Next disable Cerbot auto-renewal script as it will interfere with the one you will create bellow.<syntaxhighlight lang="console">
	$ sudo systemctl stop certbot.timer		$ sudo systemctl stop certbot.timer
	$ sudo systemctl mask certbot.timer		$ sudo systemctl mask certbot.timer

Vincent: Fix json

2017-04-02T19:28:30Z

Fix json

← Older revision		Revision as of 19:28, 2 April 2017
Line 247:		Line 247:
	<syntaxhighlight lang="python">		<syntaxhighlight lang="python">
	[{		[{
	'domains': ['www.example.org', 'example.org'],		"domains": ["www.example.org", "example.org"],
	'reload': [['/~~usr~~/~~sbin/service'~~, 'nginx~~', 'reload'~~]]		"reload": [["/bin/systemctl", "reload", "nginx.service"]]
	}, {		}, {
	'domains': ['imap.example.org~~'],~~		"domains": ["imap.example.org"]
	~~'reload': [['/usr/sbin/service', 'dovecot', 'reload']~~]
	}, {		}, {
	'domains': ['smtp.example.org'],		"domains": ["smtp.example.org"],
	'reload': [['/usr/local/bin/myCustomCommand'], ['/~~usr/sbin~~/~~service'~~, ~~'dovecot'~~, ~~'reload'~~]]		"reload": [["/usr/local/bin/myCustomCommand"], ["/bin/systemctl", "reload", "exim.service"]]
	}]		}]
	</syntaxhighlight>		</syntaxhighlight>
Line 273:		Line 272:

	=== Renew the Certificate ===		=== Renew the Certificate ===
	If the certificate you want to revoke is active, you need to renew it before revoking it{{Let’s Encrypt/New Cert Command\|domain = www.example.org\|command = service ~~nginx restart~~\|beforeCommand = $ sudo touch /etc/letsencrypt/live/www.example.org/force_renew}}		If the certificate you want to revoke is active, you need to renew it before revoking it{{Let’s Encrypt/New Cert Command\|domain = www.example.org\|command = /bin/systemctl reload nginx.service\|beforeCommand = $ sudo touch /etc/letsencrypt/live/www.example.org/force_renew}}

	=== Revoke the Old Certificate ===		=== Revoke the Old Certificate ===

Vincent: Update link

2017-04-02T15:23:10Z

Update link

← Older revision		Revision as of 15:23, 2 April 2017
Line 65:		Line 65:
	=== Manage certificates ===		=== Manage certificates ===

	Let’s Encrypt delivers certificates that are valid for 90 days. It make automatic renewal an important part of the setup. They also have a [https://~~community.~~letsencrypt.org/t/rate-limits~~-for-lets-encrypt~~/~~6769~~ limit of 20 certificates per week per domain].		Let’s Encrypt delivers certificates that are valid for 90 days. It make automatic renewal an important part of the setup. They also have a [https://letsencrypt.org/docs/rate-limits/ limit of 20 certificates per week per domain].

	In order to avoid blocking your domain (in case you need to create a new certificate), the following script will renew at most one certificate per run.		In order to avoid blocking your domain (in case you need to create a new certificate), the following script will renew at most one certificate per run.

Vincent: renew_certificates > certmanage

2017-04-02T09:49:31Z

renew_certificates > certmanage

← Older revision		Revision as of 09:49, 2 April 2017
Line 200:		Line 200:
	* You can then run it automatically during the night. Add this to the file <code>/etc/crontab</code>		* You can then run it automatically during the night. Add this to the file <code>/etc/crontab</code>
	<syntaxhighlight lang="bash">		<syntaxhighlight lang="bash">
	12 4 * * * root /usr/local/sbin/~~renew_certificates~~		12 4 * * * root /usr/local/sbin/certmanage
	</syntaxhighlight>		</syntaxhighlight>

Vincent: disable certbot auto-renewall service

2017-01-22T22:36:06Z

disable certbot auto-renewall service

← Older revision		Revision as of 22:36, 22 January 2017
Line 19:		Line 19:
	<syntaxhighlight lang="console">		<syntaxhighlight lang="console">
	$ sudo apt install certbot/jessie-backports		$ sudo apt install certbot/jessie-backports
			</syntaxhighlight>Next disable Cerbot auto-renewal script as it will interfere with the one bellow.<syntaxhighlight lang="console">
			$ sudo systemctl stop certbot.timer
			$ sudo systemctl mask certbot.timer
			Created symlink from /etc/systemd/system/certbot.timer to /dev/null.
			$ sudo systemctl mask certbot.service
			Created symlink from /etc/systemd/system/certbot.service to /dev/null.

	</syntaxhighlight>		</syntaxhighlight>

	== Configuration ==		== Configuration ==

Vincent: Use sudo

2017-01-22T09:54:04Z

Use sudo

← Older revision		Revision as of 09:54, 22 January 2017
Line 18:		Line 18:

	<syntaxhighlight lang="console">		<syntaxhighlight lang="console">
	# apt install certbot/jessie-backports		$ sudo apt install certbot/jessie-backports
	</syntaxhighlight>		</syntaxhighlight>
	== Configuration ==		== Configuration ==
Line 26:		Line 26:
	Although not mandatory, it is recommended to provide an email when registering your account. Make sure you enter it right as Let’s Encrypt will not validate it.		Although not mandatory, it is recommended to provide an email when registering your account. Make sure you enter it right as Let’s Encrypt will not validate it.
	<syntaxhighlight lang="console">		<syntaxhighlight lang="console">
	# certbot register -n --agree-tos --email youremail@example.org		$ sudo certbot register -n --agree-tos --email youremail@example.org

	IMPORTANT NOTES:		IMPORTANT NOTES:
Line 41:		Line 41:
	* First create folder <code>/var/www/acme-challenge</code>		* First create folder <code>/var/www/acme-challenge</code>
	<syntaxhighlight lang="console">		<syntaxhighlight lang="console">
	# mkdir -p /var/www/acme-challenge/.well-known/acme-challenge		$ sudo mkdir -p /var/www/acme-challenge/.well-known/acme-challenge
	# chmod -R 750 /var/www/acme-challenge		$ sudo chmod -R 750 /var/www/acme-challenge
	# chown -R root:www-data /var/www/acme-challenge		$ sudo chown -R root:www-data /var/www/acme-challenge
	</syntaxhighlight>		</syntaxhighlight>

Line 187:		Line 187:

	* Create folder the config folder<syntaxhighlight lang="console">		* Create folder the config folder<syntaxhighlight lang="console">
	# mkdir /usr/local/etc/certmanage		$ mkdir /usr/local/etc/certmanage
	# echo [] > /usr/local/etc/certmanage/main.json		$ echo [] \| sudo tee /usr/local/etc/certmanage/main.json > /dev/null
	</syntaxhighlight>		</syntaxhighlight>
	* You can then run it automatically during the night. Add this to the file <code>/etc/crontab</code>		* You can then run it automatically during the night. Add this to the file <code>/etc/crontab</code>
Line 205:		Line 205:
	If your certificate is not intended for the web (SMTP, IMAP, Jabber…), you can create a dedicated config in Nginx		If your certificate is not intended for the web (SMTP, IMAP, Jabber…), you can create a dedicated config in Nginx
	<syntaxhighlight lang="console">		<syntaxhighlight lang="console">
	# touch /etc/nginx/sites-available/noweb		$ touch /etc/nginx/sites-available/noweb
	# ln -s /etc/nginx/sites-available/noweb /etc/nginx/sites-enabled		$ ln -s /etc/nginx/sites-available/noweb /etc/nginx/sites-enabled
	</syntaxhighlight>		</syntaxhighlight>

Line 223:		Line 223:
	Make sure you reload Nginx config		Make sure you reload Nginx config
	<syntaxhighlight lang="console">		<syntaxhighlight lang="console">
	# service nginx reload		$ service nginx reload
	</syntaxhighlight>		</syntaxhighlight>

Line 260:		Line 260:
	=== Identify the Certificate to Revoke ===		=== Identify the Certificate to Revoke ===
	The first thing to do if to know which certificate you want to revoke.<syntaxhighlight lang="console">		The first thing to do if to know which certificate you want to revoke.<syntaxhighlight lang="console">
	# ls -l /etc/letsencrypt/live/www.example.org/cert.pem		$ ls -l /etc/letsencrypt/live/www.example.org/cert.pem
	lrwxrwxrwx 1 root root 43 Jan 01 00:00 /etc/letsencrypt/live/www.example.org/cert.pem -> ../../archive/www.example.org/cert7.pem		lrwxrwxrwx 1 root root 43 Jan 01 00:00 /etc/letsencrypt/live/www.example.org/cert.pem -> ../../archive/www.example.org/cert7.pem
	</syntaxhighlight>This will give you the path of the currently active certificate in the <code>/etc/letsencrypt/archive/</code> folder.		</syntaxhighlight>This will give you the path of the currently active certificate in the <code>/etc/letsencrypt/archive/</code> folder.

	=== Renew the Certificate ===		=== Renew the Certificate ===
	If the certificate you want to revoke is active, you need to renew it before revoking it{{Let’s Encrypt/New Cert Command\|domain = www.example.org\|command = service nginx restart\|beforeCommand = # touch /etc/letsencrypt/live/www.example.org/force_renew}}		If the certificate you want to revoke is active, you need to renew it before revoking it{{Let’s Encrypt/New Cert Command\|domain = www.example.org\|command = service nginx restart\|beforeCommand = $ sudo touch /etc/letsencrypt/live/www.example.org/force_renew}}

	=== Revoke the Old Certificate ===		=== Revoke the Old Certificate ===
	Use the path found at step 1<syntaxhighlight lang="console">		Use the path found at step 1<syntaxhighlight lang="console">
	# certbot revoke --cert-path /etc/letsencrypt/archive/www.example.org/cert7.pem		$ sudo certbot revoke --cert-path /etc/letsencrypt/archive/www.example.org/cert7.pem
	</syntaxhighlight>The command doesn't output anything in case of success.		</syntaxhighlight>The command doesn't output anything in case of success.
	[[Category:Debian Release]]		[[Category:Debian Release]]
	[[Category:Linux Server]]		[[Category:Linux Server]]
	[[Category:Web Server]]		[[Category:Web Server]]

Vincent: bug #826939 is closed

2017-01-22T09:43:39Z

bug #826939 is closed

← Older revision		Revision as of 09:43, 22 January 2017
Line 19:		Line 19:
	<syntaxhighlight lang="console">		<syntaxhighlight lang="console">
	# apt install certbot/jessie-backports		# apt install certbot/jessie-backports
	</syntaxhighlight>~~Beware [https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=826939 bug #826939]: see [[Workarounds\|workaround]].~~		</syntaxhighlight>

	== Configuration ==		== Configuration ==

Line 271:		Line 270:
	Use the path found at step 1<syntaxhighlight lang="console">		Use the path found at step 1<syntaxhighlight lang="console">
	# certbot revoke --cert-path /etc/letsencrypt/archive/www.example.org/cert7.pem		# certbot revoke --cert-path /etc/letsencrypt/archive/www.example.org/cert7.pem
	</syntaxhighlight>The command doesn't output anything in case of success.[[Category:Debian Release]]		</syntaxhighlight>The command doesn't output anything in case of success.
			[[Category:Debian Release]]
	[[Category:Linux Server]]		[[Category:Linux Server]]
	[[Category:Web Server]]		[[Category:Web Server]]

Vincent: Rename script + External config

2016-08-05T16:00:21Z

Rename script + External config

← Older revision		Revision as of 16:00, 5 August 2016
Line 56:		Line 56:
	</syntaxhighlight>		</syntaxhighlight>

	=== ~~Renewal Script~~ ===		=== Manage certificates ===

	Let’s Encrypt delivers certificates that are valid for 90 days. It make automatic renewal an important part of the setup. They also have a [https://community.letsencrypt.org/t/rate-limits-for-lets-encrypt/6769 limit of 20 certificates per week per domain].		Let’s Encrypt delivers certificates that are valid for 90 days. It make automatic renewal an important part of the setup. They also have a [https://community.letsencrypt.org/t/rate-limits-for-lets-encrypt/6769 limit of 20 certificates per week per domain].
Line 64:		Line 64:
	Certificates are renewed 30d before expiry. Additionally, if a certificate is close to expiry (20 days) a warning will be displayed with details.		Certificates are renewed 30d before expiry. Additionally, if a certificate is close to expiry (20 days) a warning will be displayed with details.

	* Save the following file as <code>/usr/local/sbin/~~renew_certificates~~</code> and make it executable		* Save the following file as <code>/usr/local/sbin/certmanage</code> and make it executable
	<syntaxhighlight lang="python">		<syntaxhighlight lang="python">
	#! /usr/bin/env python		#! /usr/bin/env python

	from datetime import timedelta, date		from datetime import timedelta, date
			import json
	import time		import time
	import os~~.path~~		import os
	import subprocess		import subprocess
	import sys		import sys
	import OpenSSL		import OpenSSL
	import pyrfc3339		import pyrfc3339

	~~# Configure your certificates here~~
	~~# Each item in the list represent one certificate~~
	~~# If domains list contains multiple domains, the first one is used as filename for the certificate~~
	~~config = []~~

	RENEW_CMD = '/usr/bin/certbot'		RENEW_CMD = '/usr/bin/certbot'
Line 88:		Line 84:
	RENEW_DATE = timedelta(days=30)		RENEW_DATE = timedelta(days=30)
	ALERT_DATE = timedelta(days=20)		ALERT_DATE = timedelta(days=20)

			def read_config():
			domains = []
			scriptPath = os.path.dirname(os.path.realpath(__file__))
			cfgFolder = os.path.join(scriptPath, '../etc/certmanage/')
			files = [f for f in os.listdir(cfgFolder) if os.path.isfile(os.path.join(cfgFolder, f)) and os.path.splitext(f)[1] == '.json']
			for f in files:
			with open(os.path.join(cfgFolder, f), 'r') as conf:
			domains += json.load(conf)

			return domains

	def get_date(cert_path, force_renew_path):		def get_date(cert_path, force_renew_path):
Line 103:		Line 110:
	return date.min		return date.min

	def get_next_renew():		def get_next_renew(domains):
	mindate = date.max		mindate = date.max
	cert = None		cert = None
	for conf in ~~config~~:		for conf in domains:
	main_name = conf.get('domains')[0]		main_name = conf.get('domains')[0]
	filename = LIVE_FOLDER + main_name + CERT_FILE		filename = LIVE_FOLDER + main_name + CERT_FILE
Line 149:		Line 156:

	if __name__ == "__main__":		if __name__ == "__main__":
	next = get_next_renew()		domains = read_config()
			next = get_next_renew(domains)
	if should_renew(next):		if should_renew(next):
	print 'Renewing certificate for ' + ', '.join(next.get('domains')) + ' that will expire on ' + next.get('expiration').isoformat() + '\n'		print 'Renewing certificate for ' + ', '.join(next.get('domains')) + ' that will expire on ' + next.get('expiration').isoformat() + '\n'
	sys.stdout.flush()		sys.stdout.flush()
	renew(next)		renew(next)

	was_renewed = os.path.realpath(next.get('file')) != next.get('real_path')		was_renewed = os.path.realpath(next.get('file')) != next.get('real_path')
	if was_renewed:		if was_renewed:
Line 163:		Line 171:
	after_cert(next)		after_cert(next)

	next = get_next_renew()		next = get_next_renew(domains)
	if should_alert(next):		if should_alert(next):
	print """		print """
Line 179:		Line 187:
	</syntaxhighlight>		</syntaxhighlight>

			* Create folder the config folder<syntaxhighlight lang="console">
			# mkdir /usr/local/etc/certmanage
			# echo [] > /usr/local/etc/certmanage/main.json
			</syntaxhighlight>
	* You can then run it automatically during the night. Add this to the file <code>/etc/crontab</code>		* You can then run it automatically during the night. Add this to the file <code>/etc/crontab</code>
	<syntaxhighlight lang="bash">		<syntaxhighlight lang="bash">
Line 217:		Line 229:
	=== Certificate ===		=== Certificate ===

	Now, you just need to add your certificate ~~to the~~ <code>~~config~~</code> ~~list~~ in <code>/~~usr/local/sbin/renew_certificates~~</code>. Each certificate is represented y a dict with two keys:		Now, you just need to add your certificate in <code>/usr/local/etc/certmanage</code>. All file whose name end in <code>.json</code> can contain certificate configuration. You can either use <code>main.json</code> or create a new file.

			Each certificate is represented y a dict with two keys:
	;<code>domains</code>		;<code>domains</code>
	:The list of domains to be included in the certificate. The order is important as the first is domain is used for certificate file name.		:The list of domains to be included in the certificate. The order is important as the first is domain is used for certificate file name.
Line 225:		Line 239:
	Here are some examples:		Here are some examples:
	<syntaxhighlight lang="python">		<syntaxhighlight lang="python">
	~~config =~~ [{		[{
	'domains': ['www.example.org', 'example.org'],		'domains': ['www.example.org', 'example.org'],
	'reload': [['/usr/sbin/service', 'nginx', 'reload']]		'reload': [['/usr/sbin/service', 'nginx', 'reload']]

Vincent: Update for certbot 0.8.0

2016-06-10T21:47:41Z

Update for certbot 0.8.0

← Older revision		Revision as of 21:47, 10 June 2016
Line 19:		Line 19:
	<syntaxhighlight lang="console">		<syntaxhighlight lang="console">
	# apt install certbot/jessie-backports		# apt install certbot/jessie-backports
	</syntaxhighlight>		</syntaxhighlight>Beware [https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=826939 bug #826939]: see [[Workarounds\|workaround]].

	== Configuration ==		== Configuration ==
Line 27:		Line 27:
	Although not mandatory, it is recommended to provide an email when registering your account. Make sure you enter it right as Let’s Encrypt will not validate it.		Although not mandatory, it is recommended to provide an email when registering your account. Make sure you enter it right as Let’s Encrypt will not validate it.
	<syntaxhighlight lang="console">		<syntaxhighlight lang="console">
	# certbot ~~certonly --standalone~~ -n --agree-tos --email youremail@example.org		# certbot register -n --agree-tos --email youremail@example.org
	~~Missing command line flag or config entry for this setting:~~
	~~Please enter in your domain name(s) (comma and/or space separated)~~

	~~(You can set this with the --domains flag)~~

	IMPORTANT NOTES:		IMPORTANT NOTES:
	- If you lose your account credentials, you can recover through		- If you lose your account credentials, you can recover through
	e-mails sent to youremail@example.org.		e-mails sent to youremail@example.org.
	- Your account credentials have been saved in your ~~Let's Encrypt~~		- Your account credentials have been saved in your Certbot
	configuration directory at /etc/letsencrypt. You should make a		configuration directory at /etc/letsencrypt. You should make a
	secure backup of this folder now. This configuration directory will		secure backup of this folder now. This configuration directory will
	also contain certificates and private keys obtained by ~~Let's~~		also contain certificates and private keys obtained by Cerbot so
	~~Encrypt so~~ making regular backups of this folder is ideal.		making regular backups of this folder is ideal.
	</syntaxhighlight>		</syntaxhighlight>
	~~The error about missing parameter is normal. You should be looking at the ''IMPORTANT NOTES'' section in the output.~~

	=== Nginx ===		=== Nginx ===

Vincent: letsencrypt => certbot

2016-05-29T14:54:57Z

letsencrypt => certbot

← Older revision		Revision as of 14:54, 29 May 2016
Line 4:		Line 4:

	While Let’s Encrypt provide scripts that are able to edit your webserver configuration files, I don’t trust anyone enough to do that. Let’s Encrypt scripts will only be used to create and renew certificates.		While Let’s Encrypt provide scripts that are able to edit your webserver configuration files, I don’t trust anyone enough to do that. Let’s Encrypt scripts will only be used to create and renew certificates.

	{{Warning}} Let’s Encrypt is still a very young project. While certificate creation is working pretty well, scripts are still changing rapidly. Stay tuned and be prepared to update your configuration.		{{Warning}} Let’s Encrypt is still a very young project. While certificate creation is working pretty well, scripts are still changing rapidly. Stay tuned and be prepared to update your configuration.

Line 17:		Line 18:

	<syntaxhighlight lang="console">		<syntaxhighlight lang="console">
	# apt install ~~letsencrypt~~/jessie-backports		# apt install certbot/jessie-backports
	</syntaxhighlight>		</syntaxhighlight>

Line 26:		Line 27:
	Although not mandatory, it is recommended to provide an email when registering your account. Make sure you enter it right as Let’s Encrypt will not validate it.		Although not mandatory, it is recommended to provide an email when registering your account. Make sure you enter it right as Let’s Encrypt will not validate it.
	<syntaxhighlight lang="console">		<syntaxhighlight lang="console">
	# ~~letsencrypt~~ certonly --standalone -n --agree-tos --email youremail@example.org		# certbot certonly --standalone -n --agree-tos --email youremail@example.org
	Missing command line flag or config entry for this setting:		Missing command line flag or config entry for this setting:
	Please enter in your domain name(s) (comma and/or space separated)		Please enter in your domain name(s) (comma and/or space separated)
Line 34:		Line 35:
	IMPORTANT NOTES:		IMPORTANT NOTES:
	- If you lose your account credentials, you can recover through		- If you lose your account credentials, you can recover through
	e-mails sent to ~~logs-letsencrypt-anjie~~@~~meurisse~~.org.		e-mails sent to youremail@example.org.
	- Your account credentials have been saved in your Let's Encrypt		- Your account credentials have been saved in your Let's Encrypt
	configuration directory at /etc/letsencrypt. You should make a		configuration directory at /etc/letsencrypt. You should make a
Line 86:		Line 87:
	config = []		config = []

	RENEW_CMD = '/usr/bin/~~letsencrypt~~'		RENEW_CMD = '/usr/bin/certbot'
	RENEW_ARGS = ['certonly', '--non-interactive', '-a', 'webroot', '--webroot-path', '/var/www/acme-challenge/', '--renew-by-default', '--expand']		RENEW_ARGS = ['certonly', '--non-interactive', '-a', 'webroot', '--webroot-path', '/var/www/acme-challenge/', '--renew-by-default', '--expand']
	LIVE_FOLDER = '/etc/letsencrypt/live/'		LIVE_FOLDER = '/etc/letsencrypt/live/'
Line 261:		Line 262:
	=== Revoke the Old Certificate ===		=== Revoke the Old Certificate ===
	Use the path found at step 1<syntaxhighlight lang="console">		Use the path found at step 1<syntaxhighlight lang="console">
	# ~~letsencrypt~~ revoke --cert-path /etc/letsencrypt/archive/www.example.org/cert7.pem		# certbot revoke --cert-path /etc/letsencrypt/archive/www.example.org/cert7.pem
	</syntaxhighlight>The command doesn't output anything in case of success.[[Category:Debian Release]]		</syntaxhighlight>The command doesn't output anything in case of success.[[Category:Debian Release]]
	[[Category:Linux Server]]		[[Category:Linux Server]]
	[[Category:Web Server]]		[[Category:Web Server]]