Aquesta és una revisió antiga del document —-
Let's Encrypt wildcard
info
renovación autmatizada auth.acme-dns.io
- primera vegada:
sudo curl -o /etc/letsencrypt/acme-dns-auth.py https://raw.githubusercontent.com/joohoi/acme-dns-certbot-joohoi/master/acme-dns-auth.py sudo chmod +x /etc/letsencrypt/acme-dns-auth.py sudo certbot certonly --manual --manual-auth-hook /etc/letsencrypt/acme-dns-auth.py --preferred-challenges dns --debug-challenges -d "*.fidmag.org" -d "fidmag.org"
- creat registre CNAME:
_acme-challenge.fidmag.org CNAME 1569f935-7bf3-4630-9c3d-5846ad7c956e.auth.acme-dns.io.
dig _acme-challenge.fidmag.org CNAME +short - renovacions per cron
0 7,19 * * * certbot renew --quiet --deploy-hook "/home/fidmag/certbot/renew-dns.sh" > /home/fidmag/certbot/last_exec 2>&1
- simulacro:
certbot renew --dry-run - comprobar fichero configuración renovación:
- /etc/letsencrypt/renewal/fidmag.org-0001.conf
# Options used in the renewal process [renewalparams] account = *** pref_challs = dns-01, authenticator = manual server = https://acme-v02.api.letsencrypt.org/directory key_type = ecdsa manual_auth_hook = /etc/letsencrypt/acme-dns-auth.py
- Let's encrypt recomienda comprobar 2 veces al día (Gemini dixit)
--deploy-hook: script a ejecutar si la renovación es exitosa- certificats.config
# configuració declare -a CERTIFICATS=("matebcn.eu" "fruitsmontmany.es" "estellar.cat")
#!/usr/bin/env bash SCRIPT_SOURCE=`dirname "$0"` source ${SCRIPT_SOURCE}/certificats.config for cert "${CERTIFICATS[@]}"; do if [[ -f /home/mate/webservices/certs/${cert}.pem ]]; then sudo cp -f /home/mate/webservices/certs/${cert}.pem /home/mate/webservices/certs/old/${cert}.pem.old fi if [[ -f /home/mate/webservices/certs/${cert}.pem.key ]]; then sudo cp -f /home/mate/webservices/certs/${cert}.pem.key /home/mate/webservices/certs/old/${cert}.pem.key.old fi sudo cp -f /etc/letsencrypt/live/${cert}/fullchain.pem /home/mate/webservices/certs/${cert}.pem && \ sudo cp -f /etc/letsencrypt/live/${cert}/privkey.pem /home/mate/webservices/certs/${cert}.pem.key && \ sudo chmod +r /home/mate/webservices/certs/* && \ docker compose -f /home/mate/webservices/docker-compose.yml restart haproxy-proxy done