Difference between revisions of "Letsencrypt/fr"

'IMPORTANT'

# config show modSSL

modSSL=service
    TCPPort=443
    access=public
    status=enabled

config show modSSL > "/root/db_configuration_modSSL_backup_$(date +%Y%m%d_%H%M%S)"

yum install smeserver-letsencrypt

db yum_repositories setprop smeaddons status enabled
signal-event yum-modify

yum install smeserver-letsencrypt
signal-event console-save

db yum_repositories setprop smeaddons status enabled
signal-event yum-modify

yum update smeserver-letsencrypt dehydrated
config setprop letsencrypt ACCEPT_TERMS yes
signal-event console-save

config setprop letsencrypt ACCEPT_TERMS yes status test
# tâche très rapide pour activer le domaine principal :
db domains setprop $(config get DomainName) letsencryptSSLcert enabled
#pour chacun de vos domaines pour lesquels vous voulez le SSL, faites :
db domains setprop domain1.com letsencryptSSLcert enabled
#pour chacun de vos hôtes (sous-domaines) pour lesquels vous voulez le SSL, faites :
db hosts setprop www.domain1.com letsencryptSSLcert enabled
signal-event smeserver-letsencrypt-update
dehydrated -c

config setprop letsencrypt ACCEPT_TERMS yes status test API 2
#pour chacun de vos domaines pour lesquels vous voulez le SSL, faites :
db domains setprop domain1.com letsencryptSSLcert enabled
#pour chacun de vos hôtes (sous-domaines) pour lesquels vous voulez le SSL, faites :
db hosts setprop www.domain1.com letsencryptSSLcert enabled
signal-event console-save
dehydrated -c

config setprop letsencrypt status enabled email admin@$(config get DomainName)
signal-event smeserver-letsencrypt-update
dehydrated -c -x

config setprop letsencrypt status enabled email admin@domain1.com
signal-event console-save
dehydrated -c -x

db domains setprop $DOMAINE letsencryptSSLcert enabled

db domains setprop domaine1.com  letsencryptSSLcert enabled

db hosts setprop $NOM_D_HOTE letsencryptSSLcert enabled

db hosts setprop www.domaine1.com letsencryptSSLcert enabled

config setprop letsencrypt configure domains

config setprop letsencrypt configure hosts

config setprop letsencrypt configure all

config setprop letsencrypt configure none

config setprop letsencrypt status test
signal-event console-save

dehydrated -c

config setprop letsencrypt status enabled
signal-event console-save


dehydrated -c -x

dehydrated --cleanup (-gc)

yum remove smeserver-letsencrypt  letsencrypt

config setprop letsencrypt ACCEPT_TERMS yes

# config show letsencrypt
letsencrypt=service
   ACCEPT_TERMS=yes
   configure=none
   email=####@#####.###
   hookScript=disabled
   status=enabled

# config setprop letsencrypt API 1
# signal-event console-save

# config show letsencrypt
letsencrypt=service
   ACCEPT_TERMS=yes
   API=1
   configure=none
   email=####@#####.###
   hookScript=disabled
   status=enabled

# config setprop letsencrypt API 2 
# signal-event console-save

# config show letsencrypt
letsencrypt=service
   ACCEPT_TERMS=yes
   API=2
   configure=none
   email=####@#####.###
   hookScript=disabled
   status=enabled

db accounts setprop {accountname} SSL enabled

db accounts setprop Primary SSL enabled


Include=/etc/dehydrated

mkdir -p /etc/e-smith/templates-custom/etc/dehydrated/domains.txt
nano -w /etc/e-smith/templates-custom/etc/dehydrated/domains.txt/15Hostname

nom_d_hote.domaine

mkdir -p /etc/e-smith/templates-custom/usr/bin/hook-script.sh/
nano -w 05deploy_cert_hostname

{
    use strict;
    use warnings;
    use esmith::ConfigDB;

    my $configDB = esmith::ConfigDB->open_ro or die("can't open Config DB");

    my $letsencryptStatus = $configDB->get_prop( 'letsencrypt', 'status' )     || 'disabled';

    if ( $letsencryptStatus ne 'disabled' ) {

    $OUT .=<<'_EOF';
if [ $1 = "deploy_cert" ] && [ $2 = "hostname.domain.tld" ]; then
 echo "$2 certificate renewed" | mail -s "Certificate renewal" admin@yourdomain.com
 exit 0
fi
_EOF

    }
}

{
    use strict;
    use warnings;
    use esmith::ConfigDB;

    my $configDB = esmith::ConfigDB->open_ro or die("can't open Config DB");

    my $letsencryptStatus = $configDB->get_prop( 'letsencrypt', 'status' )     || 'disabled';

    if ( $letsencryptStatus ne 'disabled' ) {

    $OUT .=<<'_EOF';
if [ $1 = "deploy_cert" ] && [ $2 = "hostname.domain.tld" ]; then
  KEY=$3
  CERT=$4
  CHAIN=$6
  scp $CERT root@hostname:/etc/pki/tls/certs/pbx.familybrown.org.crt
  scp $KEY root@hostname:/etc/pki/tls/private/pbx.familybrown.org.key
  scp $CHAIN root@hostname:/etc/pki/tls/certs/server-chain.crt
  ssh root@pbx "/sbin/service httpd reload"
  echo "$2 certificate renewed" | mail -s "Certificate renewal" admin@domain.tld
  exit 0
fi
_EOF

    }
}

{
    use strict;
    use warnings;
    use esmith::ConfigDB;

    my $configDB = esmith::ConfigDB->open_ro or die("can't open Config DB");

    my $letsencryptStatus = $configDB->get_prop( 'letsencrypt', 'status' )     || 'disabled';

    if ( $letsencryptStatus ne 'disabled' ) {

    $OUT .=<<'_EOF';
if [ $1 = "deploy_cert" ] && [ $2 = "pve.domain.tld" ]; then
  KEY=$3
  CHAIN=$5
  scp $KEY root@pve:/etc/pve/nodes/pve/pveproxy-ssl.key
  scp $CHAIN root@pve:/etc/pve/nodes/pve/pveproxy-ssl.pem
  ssh root@pve "systemctl restart pveproxy"
  echo "$2 certificate renewed" | mail -s "Certificate renewal" admin@domain.tld
  exit 0
fi
_EOF

    }
}

signal-event console-save
dehydrated -c

config setprop letsencrypt hookScript enabled
config setprop letsencrypt host passerelle.mon-domaine.com
config setprop letsencrypt user root
config setprop letsencrypt path /home/e-smith/files/ibays/Primary/html/.well-known/acme-challenge
signal-event console-save

@@ Line 292: / Line 292: @@
 ==Dépannage==
-Voir cette [[Letsencrypt/Troubleshooting |page.]]
+Voir cette [[Letsencrypt/Troubleshooting |page (en anglais).]]
 ==Fonctions avancées==
@@ Line 365: / Line 365: @@
 au fichier de configuration d'Affa.
-== Troubleshooting ==
-===Certificate Errors===
-Errors in the certificate files may prevent Apache and some other services from starting.  If you previously had custom settings for modSSL, revert those with:
- config setprop modSSL crt (old value)
- config setprop modSSL key (old value)
- config setprop modSSL CertificateChainFile (old value--if this property was empty, delete it using the command line below)
-If you did not have custom settings for modSSL, remove your changes with:
- config delprop modSSL crt
- config delprop modSSL key
- config delprop modSSL CertificateChainFile
-Once you've made these changes, do:
-signal-event post-upgrade
- signal-event reboot
-Also see
-https://wiki.contribs.org/Useful_Commands#How_to_simply_recreate_the_certificate_for_SME_Server
- rm /home/e-smith/ssl.{crt,key,pem}/*
- config delprop modSSL CommonName
- config delprop modSSL crt
- config delprop modSSL key
- signal-event post-upgrade
- signal-event reboot
-===Authorization Errors===
-The first thing is to check all your domains can resolve
-http://my.domain/.well-known/acme-challenge
-Check that the following files are correctly generated
- /etc/dehydrated/config
- /etc/dehydrated/domains.txt
-Set letsencrypt back to test and remove any generated keys
- db configuration setprop letsencrypt status test
- rm /etc/dehydrated/certs/* -rf
- rm /etc/dehydrated/accounts/* -rf
-Then run letsencrypt again
- dehydrated -c
-To restore the original certificates:
- config delprop modSSL CertificateChainFile
- config delprop modSSL crt
- config delprop modSSL key
- signal-event console-save
-===Errors===
-====No registration exists matching provided key====
-If you see the following:
- {"type":"urn:acme:error:unauthorized","detail":"No registration exists matching provided key","status":403}
-https://github.com/lukas2511/letsencrypt.sh/issues/2
-See above for removing private keys and regenerating
-====rateLimited, Too many currently pending Authorizations====
-If you see something like this you may have hit the rate limit:
- {"type":"urn:acme:error:rateLimited","detail":"Error creating new authz :: Too many currently pending authorizations.","status":429}
-https://github.com/lukas2511/letsencrypt.sh/blob/master/docs/staging.md
-https://letsencrypt.org/docs/rate-limits/
-====Some challenges complete successfully but some hostnames fail====
-If you see some of your challenges returned without error but some fail, you possibly do not have Public DNS A or MX records for all the host names that you are adding to your certificate.
-Using the command:
- config setprop letsencrypt configure all
-Is likely to cause this error. When a domain is added to an SME server, several host names are created automatically. these include ftp.your-domain.com, wpad.your-domain.com, proxy.your-domain.com, mail.your-domain.com, www.your-domain.com. Most of us do not create public DNS records for all these host names. When letsencrypt issues a challenge for a list of host names and '''ONE''' does not resolve, the challenge will fail and the certificate will not generate at all.
-To resolve this, issue the following command:
- config setprop letsencrypt configure none
-Then follow up with the commands to enable letsencrypt for each PUBLIC resolvable domain and hostname:
- db domains setprop domain1.com letsencryptSSLcert enabled
-and for each hostname:
- db hosts setprop www.domain1.com letsencryptSSLcert enabled
- db hosts setprop mail.domain1.com letsencryptSSLcert enabled
-until all the public facing hostnames are enabled
-followed by:
- signal-event console-save
-Thanks to MSmith for the following forum thread.
-https://forums.contribs.org/index.php/topic,53052.0.html
-====Challenge fails with unauthorized 403 error====
-If your challenge returns something like the following:
- ERROR: Challenge is invalid! (returned: invalid) (result: {
-  "type": "http-01",
-  "status": "invalid",
-  "error": {
-    "type": "urn:acme:error:unauthorized",
-    "detail": "Invalid response from http://www.your-domain.com/.well-known/acme-challenge/<redacted text>
-    "status": 403
-and your ''httpd error_log'' on your server shows something like this:
- (13)Permission denied: access to /.well-known/acme-challenge/<redacted> denied
- (13)Permission denied: access to /.well-known/acme-challenge/<redacted> denied
- (13)Permission denied: access to /.well-known/acme-challenge/<redacted> denied
-You need to check the ownership and rights on ''/home/e-smith/files/ibays/Primary'' and on ''/home/e-smith/files/ibays/Primary/html''. The contrib creates a hidden working directory at ''/home/e-smith/files/ibays/Primary/html/.well-known'' and inside that directory a second directory with the following path ''/home/e-smith/files/ibays/Primary/html/.well-known/acme-challenge''. The script creates the two new directories with the correct ownerships and rights, however, if the ownership and rights on the ibay and the html directory do not allow the script to access the new location, the challenge will fail with ''access denied''
-use the following to check the rights:
- cd /home/e-smith/files/ibays
-then
- ls -l
-on my test server with only the Primary ibay I get the following (you will probably show a bunch more ibays on your server but we are only concerned with Primary):
- total 4
- drwxr-xr-x 5 root root 4096 Jul 25  2016 Primary
-If this is not what you see, you need to correct it.
-'''THIS MAY BREAK NON STANDARD CUSTOMIZATION OF YOUR SERVER, YOU NEED TO UNDERSTAND WHY THIS HAS BEEN CHANGED BEFORE YOU REVERSE IT'''
-From within ''/home/e-smith/files/ibays/'' issue the following:
- chown root:root Primary
-If the rights are not correct, issue:
- chmod 0755 Primary
-Next check the html directory.
- cd /home/e-smith/files/ibays/Primary
-then
- ls -l
-on my test server I have the following
- [root@backupserver Primary]# ls -l
- total 12
- drwxr-s--- 2 admin shared 4096 Jul 25  2016 cgi-bin
- drwxr-s--- 2 admin shared 4096 Jul 25  2016 files
- '''drwxr-s--- 3 admin shared 4096 Jun 11 08:06 html'''
-If this is not what you see,
-'''FIRST READ ABOVE WARNING'''
-then adjust as follows
- chown admin:shared html
-If the rights are not correct, issue:
- chmod 2750 html
-rerun
- dehydrated -c
-and your challenges should complete.
-https://forums.contribs.org/index.php/topic,53147.0.html
 ==Sujets avancés==


letsencrypt logo
Maintainer	John Crisp
Url	https://github.com/dehydrated-io/dehydrated
Licence	MIT license
Category	certificates
Tags	dehydrated, letsencrypt, dns, http, ssl

Clé	propriété	par défaut	valeurs
letsencrypt	ACCEPT_TERMS		empty, yes	configurer à « yes » pour accepter les termes du service ; si le paramètre est laissé à « empty », la contribution ne fonctionnera pas.
	API	2	1, 2	obsolète, sera toujours v2, car v1 est obsolète depuis juin 2021.
	configure	none	none, all, domains, hosts	cela changera le comportement par défaut sur les domaines ou les hôtes non explicites avec « letsencryptSSLcert enabled ». Par défaut, ne sera pas utilisé : si « hosts » est défini, demandera un certificat pour tous les hôtes ; si « domains » est définis, demandera un certificat pour tous les domaines ; si « all » est défini, demandera un certificat à la fois pour tous les domaines et pour tous les hôtes. Dans toutes les situations, il demandera un certificat pour les domaines/hôtes où « letsencryptSSLcert enabled » est défini et rien si « letsencryptSSLcert disabled » est défini.
	email		email	entrer l'adresse courriel pour créer le compte et recevoir des mises à jour de Let's Encrypt.
	hookScript	disabled	enabled, disabled	déclenchera un script hook avancé s'il est activé, même s'il est désactivé, la partie signal-event ssl-update pour propager le certificat s'exécutera.
	hostOverride	disabled	yes, disabled	désactivé par défaut. S'il est désactivé, il ne demandera que le certificat pour les hôtes (si sélectionné selon la configuration et avec « letsencryptSSLcert enabled ») pour les hôtes avec type=Self. Si défini sur « yes », inclura tous les hôtes répertoriés, qu'ils soient distants ou locaux.
	keysize	4096	base 2 number	longueur de la clé privée de votre certificat si vous ne voulez pas la valeur par défaut de 4096 bits. Ce ne sera pas nécessaire dans la majorité des cas mais, si c'est désiré, utilisez cette commande pour le faire.
	status	test	enabled, disabled, test	par défaut, le statut est désactivé. Dans un premier temps, configurez sur « test » pour se connecter au serveur de test de Let's Encrypt afin de vérifier si votre serveur est bien configuré. Après avoir vérifié que tout va bien, vous pouvez configurer le statut sur « enabled ».

ID	Product	Version	Status	Summary (10 tasks) ⇒
12325	SME Contribs	10.0	CONFIRMED	renewal fails after domain deleted from manager.
11796	SME Contribs	Futur	CONFIRMED	Is the dns-01 Challenge Supported or is it in planing?
11442	SME Contribs	10alpha	CONFIRMED	multiple fragments related to some other bugs
10920	SME Contribs	10alpha	CONFIRMED	move .well-known/acme-challenge out of the Primary ibay
10836	SME Contribs	9.2	CONFIRMED	force migration from acme-v1 to acme-v2
10818	SME Contribs	9.2	CONFIRMED	template does not respect domain-deleted
10656	SME Contribs	9.2	CONFIRMED	No letsencrypt certificate for Internet enable password protected Ibay
10483	SME Contribs	9.2	CONFIRMED	renewal fails with ibay using password
10462	SME Contribs	Futur	CONFIRMED	NFR: implement per certificate / domain
10280	SME Contribs	9.2	CONFIRMED	add test for domain and host to disable the one at least defined in publicly available dns

	Skill level: Medium
	The instructions on this page require a basic knowledge of linux.

	Attention :
	PAGE EN TRAVAUX depuis le 23 août 2022 ! Consulter la page en anglais qui est à jour.

	Note :
	solution pour l'erreur « ID de compte mal formé dans l'URL d'en-tête KeyID » à l'aide de l'API 2, pour les versions de contribution 0.6.13 ou antérieures, voir ~~Bugzilla: 10828~~ ou mettre à jour la contribution.

	Note :
	la création d'un nouveau certificat nécessite que l'API soit définie sur V2, voir l'avertissement ci-dessus.

	Note :
	pour autant que je (ReetP) sache, cette section n'est pas nécessaire. Vous devriez simplement être en mesure de définir un hôte avec « HostType local » et une adresse InternalIP comme activation de letsencryptSSLcert, puis régénérer domains.txt.

Difference between revisions of "Letsencrypt/fr"

Revision as of 19:09, 10 September 2022

Mainteneur

Version

Description

Prérequis

Préparation

Installation de la contribution de Dehydrated letsencrypt

Installation

Ré-actualisation

Configuration

Exemples de démarrage rapide

Configuration étape par étape

Hôtes et domaines du certificat

Activer le mode test

Activer le mode production

Archiver les vieux certificats

Paramètres de configuration

Dépannage

Fonctions avancées

Désinstallation

Accepter les conditions de Let's Encrypt

V2 API

Imposer le SSL

Sauvegarde

Sujets avancés

Obtention de certificats pour d'autres serveurs

Hôtes et domaines

Déploiement du script d'accrochage

Obtenir des certificats pour un serveur KOOZALI SME privé

Bogues

Journal des modifications

Navigation menu

Search