Letsencrypt - Revision history

Johnno: /* Run a script from cron */

2021-09-01T11:14:44Z

Run a script from cron

Johnno: /* Set up your HTTPS site */

2021-07-12T22:19:21Z

Set up your HTTPS site

Johnno: /* Fetch your certificates */

2021-07-12T21:07:12Z

Fetch your certificates

Johnno at 00:30, 13 January 2021

2021-01-13T00:30:08Z

Johnno: /* Run a script from cron */

2020-12-14T21:45:16Z

Run a script from cron

Johnno at 21:39, 14 December 2020

2020-12-14T21:39:54Z

Johnno: /* Set up the site's handshake */

2020-12-14T21:33:53Z

Set up the site's handshake

Johnno at 10:00, 15 July 2020

2020-07-15T10:00:40Z

Johnno at 09:56, 15 July 2020

2020-07-15T09:56:28Z

Johnno at 21:49, 26 January 2017

2017-01-26T21:49:15Z

@@ Line 78: / Line 78: @@
   ''# Script: /usr/local/bin/letsencrypt-renew''
   ''# Renew site SSL certificates with LetsEncrypt using dehydrated.''
   ''# See: https://github.com/lukas2511/dehydrated''
   for domain in                   \
           my-domain-1.com         \
@@ Line 85: / Line 84: @@
           foo-bar-baz.com         \
   ; do
-      $DEHYDRATED -c --domain $domain
+      dehydrated -c --domain $domain
       sleep 2
   done

@@ Line 41: / Line 41: @@
 == Set up your HTTPS site ==
-Now you can enable the HTTPS side of your site with the shiny new certificates the Letsencrypt CA generated for you (best to refer to the [https://mozilla.github.io/server-side-tls/ssl-config-generator/ Mozilla SSL config generator] for the most up-to-date configuration).
+Now you can enable the HTTPS side of your site with the shiny new certificates the Letsencrypt CA generated for you.
   <VirtualHost *:443>
     SSLEngine On
     SSLCertificateFile /var/lib/dehydrated/certs/'''www.myniftysite.com'''/fullchain.pem
     SSLCertificateKeyFile /var/lib/dehydrated/certs/'''www.myniftysite.com'''/privkey.pem
-    Header always set Strict-Transport-Security "max-age=15768000"
+    Header always set Strict-Transport-Security "max-age=63072000"
     ...
@@ Line 67: / Line 55: @@
   server {
     listen        *:443 ssl;
-    server_name   cloud.jon.geek.nz;
+    server_name   '''www.myniftysite.com;'''
     ssl  on;
     ssl_certificate     /var/lib/dehydrated/certs/'''www.myniftysite.com'''/fullchain.pem;
     ssl_certificate_key /var/lib/dehydrated/certs/'''www.myniftysite.com'''/privkey.pem;
     ssl_trusted_certificate /var/lib/dehydrated/certs/'''www.myniftysite.com'''/chain.pem;
     add_header Strict-Transport-Security max-age=63072000;
     ...
 == Run a script from cron ==

@@ Line 37: / Line 37: @@
 Then run the following command. Once you've proven it works, bung it in <tt>/etc/cron.d/letsencrypt-renew</tt> to run every so often (Letsencrypt certificates expire in 3 months).
-  /usr/local/bin/dehydrated -c --domain '''www.myniftysite.com''' --challenge http-01
+  /usr/bin/dehydrated -c --domain '''www.myniftysite.com''' --challenge http-01
 == Set up your HTTPS site ==

@@ Line 11: / Line 11: @@
 == Set up the site's handshake ==
-This script talks to the Letsencrypt CA and temporarily drops tokens in <tt>/var/lib/dehydrated/acme-challenges</tt> for your site to host for the handshake, deleting them afterwards. So make sure the HTTP side of your site can facilitate the handshake by using a known URL alias without redirecting it to HTTPS. In Apache, you need something like:
+You can use the dehydrated script to use the ACME HTTP challenge method. It talks to the Letsencrypt CA and temporarily drops tokens in <tt>/var/lib/dehydrated/acme-challenges</tt> for your site to host for the handshake, deleting them afterwards. So make sure the HTTP side of your site can facilitate the handshake by using a known URL alias without redirecting it to HTTPS. In Apache, you need something like:
   <VirtualHost *:80>

@@ Line 89: / Line 89: @@
 == Run a script from cron ==
-Set up a config file:
+Edit the config file:
-  # Stick this in /etc/dehydrated/config
+  ''# Contents of /etc/dehydrated/config''
   CERTDIR='/var/lib/dehydrated/certs'
   CHALLENGETYPE='http-01'
-Then a script somewhere in /usr/local/bin to run from a cron job:
+Then make a script to run from a cron job:
-<pre>
+ ''#!/bin/bash''
-#!/bin/bash
+ ''# Script: /usr/local/bin/letsencrypt-renew''
-# Renew SSL certificates with LetsEncrypt using dehydrated.
+ ''# Renew site SSL certificates with LetsEncrypt using dehydrated.''
-# See: https://github.com/lukas2511/dehydrated
+ ''# See: https://github.com/lukas2511/dehydrated''
-DEHYDRATED='/usr/local/bin/dehydrated'
+And a cron job like this:
-for domain in                   \
+ ''# Contents of /etc/cron.d/letsencrypt-renew''
-        my-domain-1.com         \
+ ''# Attempt SSL certificate renewals with dehydrated weekly''
-        my-other-domain.com     \
+22 * * 2 root /usr/local/bin/letsencrypt-renew > /var/log/letsencrypt-renew.log 2> /var/log/letsencrypt-renew.err
 == Notes ==
 <references/>

@@ Line 4: / Line 4: @@
 == Install the things ==
-First install the nifty dehydrated utility and make a directory<ref>If you don't have Ubuntu 20.04, use <pre>git clone <nowiki>https://github.com/lukas2511/dehydrated.git</nowiki> /opt/letsencrypt
+First install the nifty dehydrated utility<ref>If you don't have Ubuntu 20.04, use <pre>git clone <nowiki>https://github.com/lukas2511/dehydrated.git</nowiki> /opt/dehydrated
-ln -s /opt/letsencrypt/dehydrated /usr/local/bin</pre></ref>:
+ln -s /opt/dehydrated/dehydrated /usr/local/bin/</pre></ref>:
   apt install dehydrated
 == Set up the site's handshake ==
@@ Line 38: / Line 37: @@
 Then run the following command. Once you've proven it works, bung it in <tt>/etc/cron.d/letsencrypt-renew</tt> to run every so often (Letsencrypt certificates expire in 3 months).
-  /usr/local/bin/dehydrated -c --domain '''www.myniftysite.com''' --challenge http-01 --out /etc/ssl/letsencrypt
+  /usr/local/bin/dehydrated -c --domain '''www.myniftysite.com''' --challenge http-01
 == Set up your HTTPS site ==
@@ Line 46: / Line 45: @@
   <VirtualHost *:443>
     SSLEngine On
-    SSLCertificateFile /etc/ssl/letsencrypt/'''www.myniftysite.com'''/fullchain.pem
+    SSLCertificateFile /var/lib/dehydrated/certs/'''www.myniftysite.com'''/fullchain.pem
-    SSLCertificateKeyFile /etc/ssl/letsencrypt/'''www.myniftysite.com'''/privkey.pem
+    SSLCertificateKeyFile /var/lib/dehydrated/certs/'''www.myniftysite.com'''/privkey.pem
     Header always set Strict-Transport-Security "max-age=15768000"
     SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1
@@ Line 71: / Line 70: @@
     ssl  on;
-    ssl_certificate     /etc/ssl/letsencrypt/'''www.myniftysite.com'''/fullchain.pem;
+    ssl_certificate     /var/lib/dehydrated/certs/'''www.myniftysite.com'''/fullchain.pem;
-    ssl_certificate_key /etc/ssl/letsencrypt/'''www.myniftysite.com'''/privkey.pem;
+    ssl_certificate_key /var/lib/dehydrated/certs/'''www.myniftysite.com'''/privkey.pem;
-    ssl_trusted_certificate /etc/ssl/letsencrypt/'''www.myniftysite.com'''/chain.pem;
+    ssl_trusted_certificate /var/lib/dehydrated/certs/'''www.myniftysite.com'''/chain.pem;
     ssl_session_timeout  5m;
     ssl_protocols  TLSv1 TLSv1.1 TLSv1.2;
@@ Line 93: / Line 92: @@
   # Stick this in /etc/dehydrated/config
-  CERTDIR='/etc/ssl/letsencrypt'
+  CERTDIR='/var/lib/dehydrated/certs'
   CHALLENGETYPE='http-01'

@@ Line 18: / Line 18: @@
     Alias "/.well-known/acme-challenge/" "/var/lib/dehydrated/acme-challenges/"
     RewriteEngine On
-    RedirectMatch 302 ^(?!/\.well-known/acme-challenge/).* <nowiki>https://</nowiki>'''www.myniftysite.com'''$0
+    RedirectMatch 301 ^(?!/\.well-known/acme-challenge/).* <nowiki>https://</nowiki>'''www.myniftysite.com'''$0
   </VirtualHost>
@@ Line 30: / Line 30: @@
+    }
     location / {
-      return 302 <nowiki>https://$host$request_uri; </nowiki>
+      return 301 <nowiki>https://$host$request_uri; </nowiki>
+    }
+  }

@@ Line 1: / Line 1: @@
 __NOTOC__
-It's easy!
+It's easy in Ubuntu 20.04 using [https://github.com/lukas2511/dehydrated dehydrated].
 == Install the things ==
-First install the nifty checker and make some directories:
+First install the nifty dehydrated utility and make a directory<ref>If you don't have Ubuntu 20.04, use <pre>git clone <nowiki>https://github.com/lukas2511/dehydrated.git</nowiki> /opt/letsencrypt
-  git clone <nowiki>https://github.com/lukas2511/dehydrated.git</nowiki> /opt/letsencrypt
+  apt install dehydrated
   mkdir -p /etc/ssl/letsencrypt
 == Set up the site's handshake ==
-This script talks to the Letsencrypt CA and temporarily drops tokens in <tt>/var/www/dehydrated</tt> for your site to host for the handshake, deleting them afterwards. So make sure the HTTP side of your site can facilitate the handshake by using a known URL alias. In Apache, you need something like:
+This script talks to the Letsencrypt CA and temporarily drops tokens in <tt>/var/lib/dehydrated/acme-challenges</tt> for your site to host for the handshake, deleting them afterwards. So make sure the HTTP side of your site can facilitate the handshake by using a known URL alias without redirecting it to HTTPS. In Apache, you need something like:
   <VirtualHost *:80>
     ServerName '''www.myniftysite.com'''
-    Alias "/.well-known/acme-challenge/" "/var/www/dehydrated/"
+    Alias "/.well-known/acme-challenge/" "/var/lib/dehydrated/acme-challenges/"
     RewriteEngine On
     RedirectMatch 302 ^(?!/\.well-known/acme-challenge/).* <nowiki>https://</nowiki>'''www.myniftysite.com'''$0
@@ Line 27: / Line 27: @@
     server_name '''www.myniftysite.com''';
     location /.well-known/acme-challenge/ {
-      alias /var/www/dehydrated/;
+      alias /var/lib/dehydrated/acme-challenges/;
+    }
     location / {
@@ Line 38: / Line 38: @@
 Then run the following command. Once you've proven it works, bung it in <tt>/etc/cron.d/letsencrypt-renew</tt> to run every so often (Letsencrypt certificates expire in 3 months).
-  /opt/letsencrypt/dehydrated -c --domain '''www.myniftysite.com''' --challenge http-01 --out /etc/ssl/letsencrypt
+  /usr/local/bin/dehydrated -c --domain '''www.myniftysite.com''' --challenge http-01 --out /etc/ssl/letsencrypt
 == Set up your HTTPS site ==
@@ Line 103: / Line 103: @@
 # See: https://github.com/lukas2511/dehydrated
-DEHYDRATED='/opt/letsencrypt/dehydrated'
+DEHYDRATED='/usr/local/bin/dehydrated'
 # Save etckeeper state just in case.
@@ Line 124: / Line 124: @@
      /usr/sbin/service nginx restart
 fi</pre>