letsencrypt / certbot

#sudo apt-get install -y software-properties-common
#sudo add-apt-repository -y ppa:certbot/certbot
sudo apt-get update
sudo apt-get install -y certbot

certbot --nginx -d www.example.com

certbot certonly \
  --manual \
  --manual-public-ip-logging-ok \
  --preferred-challenges dns-01 \
  --register-unsafely-without-email \
  --agree-tos \
  --server https://acme-v02.api.letsencrypt.org/directory \
  -d \*.example.com

sudo tar --exclude=README -C /etc/letsencrypt/live -czhf /tmp/letsencrypt.tar.gz .

for DIR in $(find * -maxdepth 0 -type d); do
    openssl pkcs12 -export -passout "pass:" -out "${DIR}/${DIR}.p12" -inkey "${DIR}/privkey1.pem" -in "${DIR}/cert1.pem" -certfile "${DIR}/chain1.pem"
done

sudo certbot renew --force-renewal

sudo docker run --rm -i -t -v /tmp:/etc/letsencrypt certbot/certbot certonly \
    --manual --manual-public-ip-logging-ok --register-unsafely-without-email \
    --agree-tos --preferred-challenges dns-01 --server https://acme-v02.api.letsencrypt.org/directory \
    -d \*.example.com
sudo ls -l /tmp/archive/example.com/

sudo systemd-resolve --flush-caches

dig _acme-challenge.www.example.com TXT

apt-get install lets-encrypt
 
apt-get install -y git
git clone https://github.com/letsencrypt/letsencrypt /opt/letsencrypt
/opt/letsencrypt-auto --help all

HOSTS="
www1.example.com
www2.example.com
www3.example.com
mail.example.com
"
 
TXT=yuvAtjoicipsOvkashonFurkithsOtPeopNoHewtud4.chacnabvotfueHadgikthisDydsecCeowIkChirnuby
for HOST in ${HOSTS}; do
    ssh ${HOST} "mkdir -p /var/www/.well-known/acme-challenge && echo ${TXT} > /var/www/.well-known/acme-challenge/${TXT%.*}"
done
 
#wget -q ${URL} -O -
 
scp -3 root@letsencrypt.example.com:/etc/letsencrypt/live/www.example.com/* root@www.example.com:/etc/letsencrypt/live/www.example.com/
ssh www.example.com chmod 400 /etc/letsencrypt/live/www.example.com/privkey.pem
ssh www.example.com service apache2 restart
 
# create configuration file
apt-get install cron --no-install-recommends
 
cat <<EOF>> /etc/letsencrypt/cli.ini
domains = www.example.com,example.com
rsa-key-size = 4096
email = mal@example.com
text = true
authenticator = webroot
webroot-path = /var/www/html
EOF
 
# create cron
cat <<EOF> /etc/cron.d/letsencrypt
52 6    1 * *    root    /opt/letsencrypt-auto --renew certonly && /usr/sbin/service apache2 reload >> /var/log/letsencrypt-renew.log
EOF
 
service cron restart

letsencrypt certonly \
--standalone \
--manual-public-ip-logging-ok \
--agree-tos \
--rsa-key-size 4096 \
--email webmaster@$(hostname -f) \
--domains $(hostname -f) --domains www.$(hostname -f)

cd /root/letsencrypt
./letsencrypt-auto --renew certonly
 
# create (manual)
./letsencrypt-auto certonly --manual --manual-public-ip-logging-ok --agree-tos --rsa-key-size 4096 --email mail@example.com --rsa-key-size 4096 --domains www.example.com,example.com
# ./letsencrypt-auto certonly --standalone -d www.example.com
 
# configure apache
/opt/letsencrypt/letsencrypt-auto install --cert-path /etc/letsencrypt/live/www.example.com/cert.pem --key-path /etc/letsencrypt/live/www.example.com/privkey.pem --fullchain-path /etc/letsencrypt/live/www.example.com/fullchain.pem
 
mkdir -p /var/www/.well-known/acme-challenge
echo 'bar' > /var/www/.well-known/acme-challenge/foo
rm -r /var/www/.well-known
 
# certificate directory
ls -l /etc/letsencrypt/live/*/
 
# emable ssl
a2enmod ssl
a2ensite default-ssl
sed -i '12s|AllowOverride None|AllowOverride all|g' /etc/apache2/sites-enabled/default-ssl
service apache2 reload
 
# test
# --non-interactive 
 
# auto renew
30 2 * * 1 /usr/local/sbin/le-renew example.com >> /var/log/le-renew.log
 
# Apache confi
cat /etc/apache2/sites-enabled/000-default-le-ssl.conf
<IfModule mod_ssl.c>
<VirtualHost *:443>
    ServerAdmin mail@example.com
    DocumentRoot /var/www/html
    ErrorLog ${APACHE_LOG_DIR}/error.log
    CustomLog ${APACHE_LOG_DIR}/access.log combined
    SSLCertificateFile /etc/letsencrypt/live/www.example.com/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/www.example.com/privkey.pem
    Include /etc/letsencrypt/options-ssl-apache.conf
</VirtualHost>
</IfModule>
 
# apache < 2.4.8
SSLCertificateFile /etc/letsencrypt/live/www.example.com/cert.pem
SSLCertificateKeyFile /etc/letsencrypt/live/www.example.com/privkey.pem
SSLCertificateChainFile /etc/letsencrypt/live/www.example.com/chain.pem
 
# apache >= 2.4.8
 
# Nginx
/etc/nginx/sites-enabled/default
	listen 443 ssl default_server;
	listen [::]:443 ssl default_server;
	ssl_certificate /etc/ssl/certs/fullchain.pem;
	ssl_certificate_key /etc/ssl/private/privkey.pem;
 
 
# HAProxy
cat cert.pem fullchain.pem privkey.pem > all.pem
bind <SERVER_IP>:443 ssl crt /etc/letsencrypt/live/www.example.com/all.pem

curl https://raw.githubusercontent.com/dschoeffm/hetzner-dns-certbot/master/certbot-hetzner-auth.sh > /usr/local/bin/certbot-hetzner-auth.sh
chmod +x /usr/local/bin/certbot-hetzner-auth.sh
 
curl https://raw.githubusercontent.com/dschoeffm/hetzner-dns-certbot/master/certbot-hetzner-cleanup.sh > /usr/local/bin/certbot-hetzner-cleanup.sh
chmod +x /usr/local/bin/certbot-hetzner-cleanup.sh
 
echo xxxxxxxxxxxxxxxxxxxxx > /etc/hetzner-dns-token
 
 certbot certonly \
    -n \
    --manual \
    --manual-public-ip-logging-ok \
    --agree-tos \
    -m info@example.com \
    --preferred-challenges=dns \
    --manual-auth-hook /usr/local/bin/certbot-hetzner-auth.sh \
    --manual-cleanup-hook /usr/local/bin/certbot-hetzner-cleanup.sh \
    -d ${DOMAIN}