CERTBOT - http challenge: Difference between revisions
From Wiki.IT-Arts.net
imported>Z (Created page with "Category:Post-It = Vhost = <nowiki> ############################################################################# # Configuration file for Let's Encrypt ACME Challeng...") |
imported>Z No edit summary |
||
(2 intermediate revisions by the same user not shown) | |||
Line 1: | Line 1: | ||
[[Category:Post-It]] | [[Category:Post-It]] | ||
= Command = | |||
<nowiki> | |||
certbot certonly --dry-run --webroot -w /var/www/acme-challenge -d example.org</nowiki> | |||
= Vhost = | = Vhost = | ||
<nowiki> | |||
server { | |||
listen W.X.Y.Z:80; | |||
server_name _; | |||
# Let's encrypt snippet | |||
include /etc/nginx/snippets/letsencrypt.conf; | |||
root /var/www/acme-challenge; | |||
index index.html; | |||
location / { | |||
return 301 https://$server_name$request_uri; | |||
} | |||
}</nowiki> | |||
= Snippet = | |||
<nowiki> | <nowiki> | ||
############################################################################# | ############################################################################# | ||
# /etc/nginx/snippets/letsencrypt.conf | |||
# | |||
# Configuration file for Let's Encrypt ACME Challenge location | # Configuration file for Let's Encrypt ACME Challenge location | ||
# This file is already included in listen_xxx.conf files. | # This file is already included in listen_xxx.conf files. | ||
Line 51: | Line 79: | ||
} | } | ||
</nowiki> | </nowiki> | ||
= Cerbot Quick Help = | |||
<nowiki> | |||
# certbot --help | |||
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - | |||
certbot [SUBCOMMAND] [options] [-d DOMAIN] [-d DOMAIN] ... | |||
Certbot can obtain and install HTTPS/TLS/SSL certificates. By default, | |||
it will attempt to use a webserver both for obtaining and installing the | |||
certificate. The most common SUBCOMMANDS and flags are: | |||
obtain, install, and renew certificates: | |||
(default) run Obtain & install a certificate in your current webserver | |||
certonly Obtain or renew a certificate, but do not install it | |||
renew Renew all previously obtained certificates that are near | |||
expiry | |||
enhance Add security enhancements to your existing configuration | |||
-d DOMAINS Comma-separated list of domains to obtain a certificate for | |||
(the certbot apache plugin is not installed) | |||
--standalone Run a standalone webserver for authentication | |||
--nginx Use the Nginx plugin for authentication & installation | |||
--webroot Place files in a server's webroot folder for authentication | |||
--manual Obtain certificates interactively, or using shell script | |||
hooks | |||
-n Run non-interactively | |||
--test-cert Obtain a test certificate from a staging server | |||
--dry-run Test "renew" or "certonly" without saving any certificates | |||
to disk | |||
manage certificates: | |||
certificates Display information about certificates you have from Certbot | |||
revoke Revoke a certificate (supply --cert-path or --cert-name) | |||
delete Delete a certificate | |||
manage your account with Let's Encrypt: | |||
register Create a Let's Encrypt ACME account | |||
update_account Update a Let's Encrypt ACME account | |||
--agree-tos Agree to the ACME server's Subscriber Agreement | |||
-m EMAIL Email address for important account notifications | |||
More detailed help: | |||
-h, --help [TOPIC] print this message, or detailed help on a topic; | |||
the available TOPICS are: | |||
all, automation, commands, paths, security, testing, or any of the | |||
subcommands or plugins (certonly, renew, install, register, nginx, | |||
apache, standalone, webroot, etc.) | |||
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -</nowiki> | |||
Latest revision as of 19:54, 13 April 2020
Command
certbot certonly --dry-run --webroot -w /var/www/acme-challenge -d example.org
Vhost
server { listen W.X.Y.Z:80; server_name _; # Let's encrypt snippet include /etc/nginx/snippets/letsencrypt.conf; root /var/www/acme-challenge; index index.html; location / { return 301 https://$server_name$request_uri; } }
Snippet
############################################################################# # /etc/nginx/snippets/letsencrypt.conf # # Configuration file for Let's Encrypt ACME Challenge location # This file is already included in listen_xxx.conf files. # Do NOT include it separately! ############################################################################# # # This config enables to access /.well-known/acme-challenge/xxxxxxxxxxx # on all our sites (HTTP), including all subdomains. # This is required by ACME Challenge (webroot authentication). # You can check that this location is working by placing ping.txt here: # /var/www/letsencrypt/.well-known/acme-challenge/ping.txt # And pointing your browser to: # http://xxx.domain.tld/.well-known/acme-challenge/ping.txt # # Sources: # https://community.letsencrypt.org/t/howto-easy-cert-generation-and-renewal-with-nginx/3491 # ############################################################################# # Rule for legitimate ACME Challenge requests (like /.well-known/acme-challenge/xxxxxxxxx) # We use ^~ here, so that we don't check other regexes (for speed-up). We actually MUST cancel # other regex checks, because in our other config files have regex rule that denies access to files with dotted names. location ^~ /.well-known/acme-challenge/ { # Set correct content type. According to this: # https://community.letsencrypt.org/t/using-the-webroot-domain-verification-method/1445/29 # Current specification requires "text/plain" or no content header at all. # It seems that "text/plain" is a safe option. default_type "text/plain"; # This directory must be the same as in /etc/letsencrypt/cli.ini # as "webroot-path" parameter. Also don't forget to set "authenticator" parameter # there to "webroot". # Do NOT use alias, use root! Target directory is located here: # /var/www/common/letsencrypt/.well-known/acme-challenge/ root /var/www/letsencrypt; } # Hide /acme-challenge subdirectory and return 404 on all requests. # It is somewhat more secure than letting Nginx return 403. # Ending slash is important! location = /.well-known/acme-challenge/ { return 404; }
Cerbot Quick Help
# certbot --help - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - certbot [SUBCOMMAND] [options] [-d DOMAIN] [-d DOMAIN] ... Certbot can obtain and install HTTPS/TLS/SSL certificates. By default, it will attempt to use a webserver both for obtaining and installing the certificate. The most common SUBCOMMANDS and flags are: obtain, install, and renew certificates: (default) run Obtain & install a certificate in your current webserver certonly Obtain or renew a certificate, but do not install it renew Renew all previously obtained certificates that are near expiry enhance Add security enhancements to your existing configuration -d DOMAINS Comma-separated list of domains to obtain a certificate for (the certbot apache plugin is not installed) --standalone Run a standalone webserver for authentication --nginx Use the Nginx plugin for authentication & installation --webroot Place files in a server's webroot folder for authentication --manual Obtain certificates interactively, or using shell script hooks -n Run non-interactively --test-cert Obtain a test certificate from a staging server --dry-run Test "renew" or "certonly" without saving any certificates to disk manage certificates: certificates Display information about certificates you have from Certbot revoke Revoke a certificate (supply --cert-path or --cert-name) delete Delete a certificate manage your account with Let's Encrypt: register Create a Let's Encrypt ACME account update_account Update a Let's Encrypt ACME account --agree-tos Agree to the ACME server's Subscriber Agreement -m EMAIL Email address for important account notifications More detailed help: -h, --help [TOPIC] print this message, or detailed help on a topic; the available TOPICS are: all, automation, commands, paths, security, testing, or any of the subcommands or plugins (certonly, renew, install, register, nginx, apache, standalone, webroot, etc.) - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Source