Letsencrypt - Revision history

Hdridder at 08:39, 17 February 2025

2025-02-17T08:39:42Z

← Older revision		Revision as of 08:39, 17 February 2025
Line 15:		Line 15:
	:Manual renewal of the certificates that are due for it. Certbot installs a cronjob in /etc/cron.d to check for renewal every 12 hours.		:Manual renewal of the certificates that are due for it. Certbot installs a cronjob in /etc/cron.d to check for renewal every 12 hours.

	;<nowiki>certbot certonly -~~a certbot~~-~~plugin~~-gandi~~:dns~~ --~~certbot-plugin~~-gandi~~:dns~~-credentials /etc/letsencrypt/gandi.ini -d <domainname> </nowiki>		;<nowiki>certbot certonly --authenticator dns-gandi --dns-gandi-credentials /etc/letsencrypt/gandi.ini -d <domainname> </nowiki>
	:Get a certificate by DNS-authenication (for [https://gandi.net gandi]-DNS). Certbot must be able to use the API of your DNS-server. Create a new, as far as possible restricted, account for this. You need to install the [https://github.com/obynio/certbot-plugin-gandi gandi plugin for certbot] first.		:Get a certificate by DNS-authenication (for [https://gandi.net gandi]-DNS). Certbot must be able to use the API of your DNS-server. Create a new, as far as possible restricted, account for this. You need to install the [https://github.com/obynio/certbot-plugin-gandi gandi plugin for certbot] first.

	~~20230226: Certbot has moved to a snap (Don´t like that) and the gandi-plugin is not available for that. Check [https://esc.sh/blog/letsencrypt-ssl-for-local-domains/ this] an use below.~~
	;<nowiki>certbot -d <domainname> --manual --preferred-challenges dns-01 certonly</nowiki>		;<nowiki>certbot -d <domainname> --manual --preferred-challenges dns-01 certonly</nowiki>
	:If there is no plugin for your DNS provider use this.		:If there is no plugin for your DNS provider use this.
	:This command will provide you a string you should put in a TXT record.		:This command will provide you a string you should put in a TXT record _acme-challenge.<domainname>. Where domainname is what is missing in the domain this record is in. E.g. if you want a certificate for x.antiperfect.org the TXT record is for _acme-challenge.x

	;<nowiki>certbot revoke --cert-path /etc/letsencrypt/archive/<domainname>/cert1.pem</nowiki>		;<nowiki>certbot revoke --cert-path /etc/letsencrypt/archive/<domainname>/cert1.pem</nowiki>
	:Revoke an certificate, you get the option to remove all related files		:Revoke an certificate, you get the option to remove all related files

Hdridder at 18:56, 7 May 2023

2023-05-07T18:56:55Z

← Older revision		Revision as of 18:56, 7 May 2023
Line 2:		Line 2:

	It is using [https://certbot.eff.org/ certbot] to create and maintain SSL-certificates for websites.		It is using [https://certbot.eff.org/ certbot] to create and maintain SSL-certificates for websites.

	~~20230226: Certbot has moved to a snap (Don´t like that) and the gandi-plugin is not available for that. Check [https://esc.sh/blog/letsencrypt-ssl-for-local-domains/ this]~~

	* Get the software		* Get the software
Line 19:		Line 17:
	;<nowiki>certbot certonly -a certbot-plugin-gandi:dns --certbot-plugin-gandi:dns-credentials /etc/letsencrypt/gandi.ini -d <domainname> </nowiki>		;<nowiki>certbot certonly -a certbot-plugin-gandi:dns --certbot-plugin-gandi:dns-credentials /etc/letsencrypt/gandi.ini -d <domainname> </nowiki>
	:Get a certificate by DNS-authenication (for [https://gandi.net gandi]-DNS). Certbot must be able to use the API of your DNS-server. Create a new, as far as possible restricted, account for this. You need to install the [https://github.com/obynio/certbot-plugin-gandi gandi plugin for certbot] first.		:Get a certificate by DNS-authenication (for [https://gandi.net gandi]-DNS). Certbot must be able to use the API of your DNS-server. Create a new, as far as possible restricted, account for this. You need to install the [https://github.com/obynio/certbot-plugin-gandi gandi plugin for certbot] first.

			20230226: Certbot has moved to a snap (Don´t like that) and the gandi-plugin is not available for that. Check [https://esc.sh/blog/letsencrypt-ssl-for-local-domains/ this] an use below.
			;<nowiki>certbot -d <domainname> --manual --preferred-challenges dns-01 certonly</nowiki>
			:If there is no plugin for your DNS provider use this.
			:This command will provide you a string you should put in a TXT record.

	;<nowiki>certbot revoke --cert-path /etc/letsencrypt/archive/<domainname>/cert1.pem</nowiki>		;<nowiki>certbot revoke --cert-path /etc/letsencrypt/archive/<domainname>/cert1.pem</nowiki>
	:Revoke an certificate, you get the option to remove all related files		:Revoke an certificate, you get the option to remove all related files

Hdridder at 17:02, 5 March 2023

2023-03-05T17:02:06Z

← Older revision		Revision as of 17:02, 5 March 2023
Line 8:		Line 8:
	:<code>apt-get install certbot python-certbot-nginx</code>		:<code>apt-get install certbot python-certbot-nginx</code>

	;certbot certonly --nginx		;certbot certonly --nginx -d <domain> -d <domain>
	:Get a certificate by putting a challenge in a local directory		:Get a certificate for the specified domains by putting a challenge in a local directory

			;certbot certonly --nginx --cert-name <certificatename> -d <domain> -d <domain>
			:Get an new certificate for the certificate with cert-name <certificatename> for the specified domains.

	;certbot renew		;certbot renew
Line 20:		Line 23:
	;certbot delete		;certbot delete
	:Presents a menu to delete files for a domain		:Presents a menu to delete files for a domain

			;certbot certificates --cert-name <certificatename>
			:Show the certificate with the specified name, without --cert-name all certbot certificates on this server are shown.

	==Move to a new server==		==Move to a new server==

Hdridder at 10:22, 26 February 2023

2023-02-26T10:22:57Z

← Older revision		Revision as of 10:22, 26 February 2023
Line 2:		Line 2:

	It is using [https://certbot.eff.org/ certbot] to create and maintain SSL-certificates for websites.		It is using [https://certbot.eff.org/ certbot] to create and maintain SSL-certificates for websites.

			20230226: Certbot has moved to a snap (Don´t like that) and the gandi-plugin is not available for that. Check [https://esc.sh/blog/letsencrypt-ssl-for-local-domains/ this]

	* Get the software		* Get the software

Hdridder at 13:21, 12 November 2022

2022-11-12T13:21:15Z

← Older revision		Revision as of 13:21, 12 November 2022
Line 5:		Line 5:
	* Get the software		* Get the software
	:<code>apt-get install certbot python-certbot-nginx</code>		:<code>apt-get install certbot python-certbot-nginx</code>

			;certbot certonly --nginx
			:Get a certificate by putting a challenge in a local directory

	;certbot renew		;certbot renew

Hdridder at 20:21, 18 August 2022

2022-08-18T20:21:02Z

← Older revision		Revision as of 20:21, 18 August 2022
Line 11:		Line 11:
	;<nowiki>certbot certonly -a certbot-plugin-gandi:dns --certbot-plugin-gandi:dns-credentials /etc/letsencrypt/gandi.ini -d <domainname> </nowiki>		;<nowiki>certbot certonly -a certbot-plugin-gandi:dns --certbot-plugin-gandi:dns-credentials /etc/letsencrypt/gandi.ini -d <domainname> </nowiki>
	:Get a certificate by DNS-authenication (for [https://gandi.net gandi]-DNS). Certbot must be able to use the API of your DNS-server. Create a new, as far as possible restricted, account for this. You need to install the [https://github.com/obynio/certbot-plugin-gandi gandi plugin for certbot] first.		:Get a certificate by DNS-authenication (for [https://gandi.net gandi]-DNS). Certbot must be able to use the API of your DNS-server. Create a new, as far as possible restricted, account for this. You need to install the [https://github.com/obynio/certbot-plugin-gandi gandi plugin for certbot] first.
			;<nowiki>certbot revoke --cert-path /etc/letsencrypt/archive/<domainname>/cert1.pem</nowiki>
			:Revoke an certificate, you get the option to remove all related files
			;certbot delete
			:Presents a menu to delete files for a domain

	==Move to a new server==		==Move to a new server==

Hdridder at 16:47, 3 May 2021

2021-05-03T16:47:27Z

← Older revision		Revision as of 16:47, 3 May 2021
Line 8:		Line 8:
	;certbot renew		;certbot renew
	:Manual renewal of the certificates that are due for it. Certbot installs a cronjob in /etc/cron.d to check for renewal every 12 hours.		:Manual renewal of the certificates that are due for it. Certbot installs a cronjob in /etc/cron.d to check for renewal every 12 hours.

			;<nowiki>certbot certonly -a certbot-plugin-gandi:dns --certbot-plugin-gandi:dns-credentials /etc/letsencrypt/gandi.ini -d <domainname> </nowiki>
			:Get a certificate by DNS-authenication (for [https://gandi.net gandi]-DNS). Certbot must be able to use the API of your DNS-server. Create a new, as far as possible restricted, account for this. You need to install the [https://github.com/obynio/certbot-plugin-gandi gandi plugin for certbot] first.

	==Move to a new server==		==Move to a new server==

Hdridder at 21:10, 21 July 2020

2020-07-21T21:10:13Z

← Older revision		Revision as of 21:10, 21 July 2020
Line 17:		Line 17:
	* Move them to a new server		* Move them to a new server
	* Extract to the same location		* Extract to the same location

			==Issue==
			Failed to renew on a server that redirects to https:
			<syntaxhighlight lang=nginx>
			server {
			listen 443 ssl;
			listen [::]:443 ssl;
			listen 80;
			listen [::]:80;

			server_name *.domain.tld domain.tld;
			root /var/www/html;
			access_log /var/log/nginx/domain.access.log combined;
			error_log /var/log/nginx/domain.error.log error;

			ssl_certificate /etc/letsencrypt/live/domain.org/fullchain.pem;
			ssl_certificate_key /etc/letsencrypt/live/domain.org/privkey.pem;

			location ~ /.well-known {
			allow all;
			}

			# Comment the redirect for letsencrypt renewal
			if ($scheme = http) {
			return 301 https://$host$request_uri;
			}
			</syntaxhighlight>

Hdridder at 20:21, 4 March 2020

2020-03-04T20:21:48Z

← Older revision		Revision as of 20:21, 4 March 2020
Line 2:		Line 2:

	It is using [https://certbot.eff.org/ certbot] to create and maintain SSL-certificates for websites.		It is using [https://certbot.eff.org/ certbot] to create and maintain SSL-certificates for websites.

	~~Move to a new server. Inspiration came from [https://ivanderevianko.com/2019/03/migrate-letsencrypt-certificates-certbot-to-new-server Ivan Derevianko]. It can be even simpler.~~

	* Get the software		* Get the software
	:<code>apt-get install certbot python-certbot-nginx</code>		:<code>apt-get install certbot python-certbot-nginx</code>

			;certbot renew
			:Manual renewal of the certificates that are due for it. Certbot installs a cronjob in /etc/cron.d to check for renewal every 12 hours.

			==Move to a new server==
			Inspiration came from [https://ivanderevianko.com/2019/03/migrate-letsencrypt-certificates-certbot-to-new-server Ivan Derevianko]. It can be even simpler.

	Provided you have all configuration the same on the new server as on the old one you only need to do:		Provided you have all configuration the same on the new server as on the old one you only need to do:

Hdridder: Created page with "[https://letsencrypt.org/ Letsencrypt] is an initiative to have the web encrypted all over the place: It is using [https://certbot.eff.org/ certbot] to create and maintain SS..."

2019-12-22T14:24:52Z

Created page with "[https://letsencrypt.org/ Letsencrypt] is an initiative to have the web encrypted all over the place: It is using [https://certbot.eff.org/ certbot] to create and maintain SS..."

New page

[https://letsencrypt.org/ Letsencrypt] is an initiative to have the web encrypted all over the place:

It is using [https://certbot.eff.org/ certbot] to create and maintain SSL-certificates for websites.

Move to a new server. Inspiration came from [https://ivanderevianko.com/2019/03/migrate-letsencrypt-certificates-certbot-to-new-server Ivan Derevianko]. It can be even simpler.

* Get the software
:<code>apt-get install certbot python-certbot-nginx</code>

Provided you have all configuration the same on the new server as on the old one you only need to do:
* Archive certificates on the old servers
:<code>tar cvf letsencrypt.tar ./letsencrypt</code>
* Move them to a new server
* Extract to the same location