56 lines
2.6 KiB
Markdown
56 lines
2.6 KiB
Markdown
**Check config options in** `generate-certs.sh`.
|
|
|
|
---
|
|
|
|
## Info:
|
|
- It uses certbot's docker to generate LetsEncrypt SSL certificates, and it comes with simple script to generate and renew certificate for **single domain.**
|
|
- It **does not support multiple domains**. But you can create certificate for test.com, abc.test.com, *.test.com (wildcard).
|
|
|
|
1. This script will **create** SSL certificates based on `${new_ssl_command}`.
|
|
2. If the `${live_certs_dir}` and `${live_certs_dir}/cert.pem` exist then certificate is **renewed** based on `${renew_command}`
|
|
3. Post hook is only executed:
|
|
1. If a new ssl certificate is created.
|
|
2. If certificate is renewed (test is done by comparing ${live_certs_dir}/cert.pem modified time to last one).
|
|
|
|
---
|
|
|
|
## Usage:
|
|
|
|
- Set configuration in `generate-certs.sh`
|
|
- Set executable permission: `chmod +x generate-certs.sh`
|
|
- Run: `generate-certs.sh`
|
|
- After the certificates are created:
|
|
- Make sure to mount both `certs/live/test.com` and `certs/archive/test.com` directory, and use `live/test.com/*.pem` certificates in your nginx config.
|
|
- Because archive directory has actual files, but live directory has symlink to archive. In archive, certs are stored like this fullchain1.pem, cert1.pem and number is increased based on renewals. But live folder has direct certificates without number like cert.pem, fullchain.pem
|
|
- Also use certbot nginx options file in your nginx config: https://github.com/certbot/certbot/blob/master/certbot-nginx/certbot_nginx/_internal/tls_configs/options-ssl-nginx.conf
|
|
|
|
---
|
|
|
|
## Example nginx config:
|
|
```
|
|
server {
|
|
listen 443;
|
|
server_name test.com;
|
|
|
|
#SSL - Set in production.
|
|
ssl_certificate /etc/letsencrypt/live/test.com/fullchain.pem; #managed by Certbot
|
|
ssl_certificate_key /etc/letsencrypt/live/test.com/privkey.pem; #managed by Certbot
|
|
include /etc/nginx/commons/letsencrypt-options-ssl-nginx.conf;
|
|
}
|
|
```
|
|
|
|
## Important:
|
|
- **In case of errors, try clearing certs/\* folder and retry.** _(Although keep .gitkeep file inside.)_
|
|
- Use `dry_run=true` to test certbot instead of actually creating/renewing certificates.
|
|
|
|
---
|
|
|
|
## Cron:
|
|
- Run this file under cron to keep the certificates updated.
|
|
- Certbot generate certificates with expiry of 90days, so run this script every day once.
|
|
- If a certificate is renewed (based on change of last-modified time, to existing certificate) then `posthook` is executed.
|
|
- You can restart nginx in `posthook`, to reload used certificates.
|
|
- Example:
|
|
- `nano /etc/cron.d/generate-certs-for-test.com`
|
|
- `0 1 * * * root /script-location/generate-certs.sh > /script-location/generate-certs.log`
|