Difference between revisions of "Letsencrypt/fr"

dehydrated

# config show modSSL

modSSL=service
    TCPPort=443
    access=public
    status=enabled

config show modSSL > "/root/db_configuration_modSSL_backup_$(date +%Y%m%d_%H%M%S)"

yum install smeserver-letsencrypt --enablerepo=smecontribs

config setprop letsencrypt ACCEPT_TERMS yes
signal-event console-save

yum update smeserver-letsencrypt dehydrated --enablerepo=smecontribs

signal-event post-upgrade;  signal-event reboot

signal-event console-save

db domains setprop $DOMAINE letsencryptSSLcert enabled

db domains setprop domaine1.com  letsencryptSSLcert enabled

db hosts setprop $NOM_D_HOTE letsencryptSSLcert enabled

db hosts setprop www.domaine1.com letsencryptSSLcert enabled

config setprop letsencrypt configure domains

config setprop letsencrypt configure hosts

config setprop letsencrypt configure all

config setprop letsencrypt configure none

 config setprop letsencrypt email admin@domaine1.com

config setprop letsencrypt keysize NOMBRE

config setprop letsencrypt ACCEPT_TERMS yes

config setprop letsencrypt status test
signal-event console-save

dehydrated -c

config setprop letsencrypt status enabled
signal-event console-save

dehydrated -c -x

 config setprop letsencrypt ACCEPT_TERMS yes status test
 #pour chacun de vos domaines où vous voulez SSL, faire ce qui suit :
 db domains setprop domaine1.com letsencryptSSLcert enabled
 #pour chacun de vos hôtes (sous-domaines) où vous voulez SSL, faire ce qui suit :
 db hosts setprop www.domaine1.com letsencryptSSLcert enabled
 signal-event console-save
 dehydrated -c

config setprop letsencrypt status enabled email admin@domaine1.com
signal-event console-save
dehydrated -c -x

yum --enablerepo=smecontribs install dehydrated

yum install git

cd /etc
git clone https://github.com/lukas2511/dehydrated
mv dehydrated/dehydrated /usr/local/bin/

cd /etc/dehydrated
mkdir -p /home/e-smith/files/ibays/Primary/html/.well-known/acme-challenge
nano -w domains.txt

domain1.com www.domain1.com mail.domain1.com domain2.net www.domain2.net domain3.org ftp.domain3.org

nano -w config

#!/bin/bash
# config
# CA="https://acme-staging.api.letsencrypt.org/directory"
WELLKNOWN="/home/e-smith/files/ibays/Primary/html/.well-known/acme-challenge"
HOOK="/usr/local/bin/dehydrated-hook"
# E-mail to use during the registration (default: <unset>)
CONTACT_EMAIL="admin@yourdomain.com"

nano /usr/local/bin/dehydrated-hook

#!/bin/bash

if [ $1 = "deploy_cert" ]; then
  KEY=$3
  CERT=$4
  CHAIN=$6
  /sbin/e-smith/db configuration setprop modSSL key $KEY
  /sbin/e-smith/db configuration setprop modSSL crt $CERT
  /sbin/e-smith/db configuration setprop modSSL CertificateChainFile $CHAIN
  /sbin/e-smith/signal-event ssl-update
fi

chmod +x /usr/local/bin/dehydrated-hook

mkdir -p /etc/e-smith/templates-custom/etc/httpd/conf/httpd.conf
nano -w /etc/e-smith/templates-custom/etc/httpd/conf/httpd.conf/VirtualHosts40ACME

# Alias for letsencrypt
Alias /.well-known/acme-challenge /home/e-smith/files/ibays/Primary/html/.well-known/acme-challenge

expand-template /etc/httpd/conf/httpd.conf
service httpd-e-smith restart

dehydrated -c

config show modSSL

dehydrated -c -x

nano -w /etc/cron.daily/call-dehydrated

#!/bin/bash
/usr/bin/dehydrated -c
Ctrl-X pour quitter, Y pour sauvegarder. Ensuite, rendez-le exécutable :
chmod +x /etc/cron.daily/call-dehydrated

db accounts setprop {accountname} SSL enabled

db accounts setprop Primary SSL enabled

Include=/etc/dehydrated

config setprop modSSL crt (old value)
config setprop modSSL key (old value)
config setprop modSSL CertificateChainFile (old value--if this property was empty, delete it using the command line below)

config delprop modSSL crt
config delprop modSSL key
config delprop modSSL CertificateChainFile 

signal-event post-upgrade
signal-event reboot

/etc/dehydrated/config
/etc/dehydrated/domains.txt

db configuration setprop letsencrypt status test

rm /etc/dehydrated/certs/* -rf
rm /etc/dehydrated/accounts/* -rf

dehydrated -c

config delprop modSSL CertificateChainFile
config delprop modSSL crt
config delprop modSSL key

signal-event console-save

{"type":"urn:acme:error:unauthorized","detail":"No registration exists matching provided key","status":403}

{"type":"urn:acme:error:rateLimited","detail":"Error creating new authz :: Too many currently pending authorizations.","status":429}

config setprop letsencrypt configure all

config setprop letsencrypt configure none

db domains setprop domain1.com letsencryptSSLcert enabled

db hosts setprop www.domain1.com letsencryptSSLcert enabled

db hosts setprop mail.domain1.com letsencryptSSLcert enabled

signal-event console-save

ERROR: Challenge is invalid! (returned: invalid) (result: {
 "type": "http-01",
 "status": "invalid",
 "error": {
   "type": "urn:acme:error:unauthorized",
   "detail": "Invalid response from http://www.your-domain.com/.well-known/acme-challenge/<redacted text>
   "status": 403

(13)Permission denied: access to /.well-known/acme-challenge/<redacted> denied
(13)Permission denied: access to /.well-known/acme-challenge/<redacted> denied
(13)Permission denied: access to /.well-known/acme-challenge/<redacted> denied

cd /home/e-smith/files/ibays

ls -l

total 4
drwxr-xr-x 5 root root 4096 Jul 25  2016 Primary

chown root:root Primary

chmod 0755 Primary

cd /home/e-smith/files/ibays/Primary

ls -l

[root@backupserver Primary]# ls -l
total 12
drwxr-s--- 2 admin shared 4096 Jul 25  2016 cgi-bin
drwxr-s--- 2 admin shared 4096 Jul 25  2016 files
drwxr-s--- 3 admin shared 4096 Jun 11 08:06 html

chown admin:shared html

chmod 2750 html

dehydrated -c

mkdir -p /etc/e-smith/templates-custom/etc/dehydrated/domains.txt
nano -w /etc/e-smith/templates-custom/etc/dehydrated/domains.txt/15Hostname

nom_d_hote.domaine

mkdir -p /etc/e-smith/templates-custom/usr/bin/hook-script.sh/
nano -w 05deploy_cert_hostname

{
    use strict;
    use warnings;
    use esmith::ConfigDB;

    my $configDB = esmith::ConfigDB->open_ro or die("can't open Config DB");

    my $letsencryptStatus = $configDB->get_prop( 'letsencrypt', 'status' )     || 'disabled';

    if ( $letsencryptStatus ne 'disabled' ) {

    $OUT .=<<'_EOF';
if [ $1 = "deploy_cert" ] && [ $2 = "hostname.domain.tld" ]; then
 echo "$2 certificate renewed" | mail -s "Certificate renewal" admin@yourdomain.com
 exit 0
fi
_EOF

    }
}

{
    use strict;
    use warnings;
    use esmith::ConfigDB;

    my $configDB = esmith::ConfigDB->open_ro or die("can't open Config DB");

    my $letsencryptStatus = $configDB->get_prop( 'letsencrypt', 'status' )     || 'disabled';

    if ( $letsencryptStatus ne 'disabled' ) {

    $OUT .=<<'_EOF';
if [ $1 = "deploy_cert" ] && [ $2 = "hostname.domain.tld" ]; then
  KEY=$3
  CERT=$4
  CHAIN=$6
  scp $CERT root@hostname:/etc/pki/tls/certs/pbx.familybrown.org.crt
  scp $KEY root@hostname:/etc/pki/tls/private/pbx.familybrown.org.key
  scp $CHAIN root@hostname:/etc/pki/tls/certs/server-chain.crt
  ssh root@pbx "/sbin/service httpd reload"
  echo "$2 certificate renewed" | mail -s "Certificate renewal" admin@domain.tld
  exit 0
fi
_EOF

    }
}

{
    use strict;
    use warnings;
    use esmith::ConfigDB;

    my $configDB = esmith::ConfigDB->open_ro or die("can't open Config DB");

    my $letsencryptStatus = $configDB->get_prop( 'letsencrypt', 'status' )     || 'disabled';

    if ( $letsencryptStatus ne 'disabled' ) {

    $OUT .=<<'_EOF';
if [ $1 = "deploy_cert" ] && [ $2 = "pve.domain.tld" ]; then
  KEY=$3
  CHAIN=$5
  scp $KEY root@pve:/etc/pve/nodes/pve/pveproxy-ssl.key
  scp $CHAIN root@pve:/etc/pve/nodes/pve/pveproxy-ssl.pem
  ssh root@pve "systemctl restart pveproxy"
  echo "$2 certificate renewed" | mail -s "Certificate renewal" admin@domain.tld
  exit 0
fi
_EOF

    }
}

signal-event console-save
dehydrated -c

config setprop letsencrypt hookScript enabled
config setprop letsencrypt host external.mydomain.tld
config setprop letsencrypt user root
config setprop letsencrypt path /home/e-smith/files/ibays/Primary/html/.well-known/acme-challenge
signal-event console-save

@@ Line 464: / Line 464: @@
 https://forums.contribs.org/index.php/topic,53147.0.html
-==Advanced Topics==
+==Sujets avancés==
-===Obtaining certificates for other servers===
+===Obtention de certificats pour d'autres serveurs===
-The dehydrated client can be used to obtain certificates for other servers on your network, if the hostnames resolve (from outside your network) to your SME Server.  Here's how to do this using the smeserver-letsencrypt contrib.
+Le client « dehydrated » peut être utilisé pour obtenir des certificats pour d'autres serveurs de votre réseau, si les noms d'hôte sont résolus (depuis l'extérieur de votre réseau) vers votre serveur SME. Voici comment procéder en utilisant la contribution smeserver-letsencrypt.
-You'll need to create two template fragments: one to add your hostname to /etc/dehydrated/domains.txt, and the second to handle the certificate once it's generated.  To create the first, do
+Vous devrez créer deux fragments de modèle : un pour ajouter votre nom d'hôte à /etc/dehydrated/domains.txt, et le second pour gérer le certificat une fois qu'il est généré. Pour créer le premier, faites :
   mkdir -p /etc/e-smith/templates-custom/etc/dehydrated/domains.txt
   nano -w /etc/e-smith/templates-custom/etc/dehydrated/domains.txt/15Hostname
-You can replace "Hostname" in "15Hostname" with something that's descriptive of the host you're obtaining a certificate for.  If you want more than one additional certificate, create separate fragments for each one.  In the file, just enter the fully-qualified domain name of the system:
+Vous pouvez remplacer «Hostname» dans «15Hostname» par un élément descriptif de l'hôte pour lequel vous voulez obtenir un certificat. Si vous souhaitez plusieurs certificats supplémentaires, créez des fragments distincts pour chacun. Dans le fichier, entrez simplement le nom de domaine complet du système :
-  hostname.domain.tld
+  nom_d_hote.domaine
-Then Ctrl-X to exit, Y to save.
+Puis Ctrl-X pour quitter, Y pour sauvegarder.
-The second template fragment will be a portion of the hook script, so the dehydrated client knows what to do with this certificate.  This must be present, otherwise dehydrated will configure your SME server to use this certificate rather than the certificate for the SME Server.
+Le deuxième fragment de modèle sera une partie du script de « hook », donc le client « dehydrated » sait quoi faire avec ce certificat. Cela doit être présent, sinon « dehydrated » configurera votre serveur SME pour utiliser ce certificat plutôt que le certificat pour le serveur SME.
   mkdir -p /etc/e-smith/templates-custom/usr/bin/hook-script.sh/
   nano -w 05deploy_cert_hostname
-As above, replace "hostname" with something that describes the host that this script will apply to.  The numeric portion can be changed, but MUST be less than 10.
+Comme ci-dessus, remplacez « hostname » par quelque chose qui décrit l'hôte auquel ce script s'appliquera. La partie numérique peut être modifiée, mais DOIT être inférieure à 10.
-At a minimum, this fragment will need to recognize that it's being called for a certificate other than the main server certificate, and exit in order to prevent later portions of the script from installing that certificate as the main server certificate.  The minimal form of this fragment would be:
+Au minimum, ce fragment devra reconnaître qu'il est appelé pour un certificat autre que le certificat du serveur principal et s'arrêter afin d'empêcher les parties ultérieures du script d'installer ce certificat en tant que certificat du serveur principal. La forme minimale de ce fragment serait :
   {
@@ Line 508: / Line 508: @@
       }
   }
+Selon les caractéristiques de l'autre système, ce script peut cependant installer le certificat sur ce système. Le fragment suivant copiera les fichiers du certificat sur un système Linux distant exécutant Apache pour le serveur Web et rechargera Apache pour qu'il commence à utiliser le nouveau certificat :
 Depending on the characteristics of the other system, though, this script may be able to install the certificate on that system.  The following fragment would copy the certificate files to a remote Linux system running Apache for the web server, and reload Apache to get it to begin using the new certificate:

ID	Product	Version	Status	Summary (10 tasks) ⇒
12325	SME Contribs	10.0	CONFIRMED	renewal fails after domain deleted from manager.
11796	SME Contribs	Futur	CONFIRMED	Is the dns-01 Challenge Supported or is it in planing?
11442	SME Contribs	10alpha	CONFIRMED	multiple fragments related to some other bugs
10920	SME Contribs	10alpha	CONFIRMED	move .well-known/acme-challenge out of the Primary ibay
10836	SME Contribs	9.2	CONFIRMED	force migration from acme-v1 to acme-v2
10818	SME Contribs	9.2	CONFIRMED	template does not respect domain-deleted
10656	SME Contribs	9.2	CONFIRMED	No letsencrypt certificate for Internet enable password protected Ibay
10483	SME Contribs	9.2	CONFIRMED	renewal fails with ibay using password
10462	SME Contribs	Futur	CONFIRMED	NFR: implement per certificate / domain
10280	SME Contribs	9.2	CONFIRMED	add test for domain and host to disable the one at least defined in publicly available dns

	Skill level: Medium
	The instructions on this page require a basic knowledge of linux.

	Attention :
	les éléments suivants ne doivent pas être exécutés si vous avez installé le paquet de la contribution smeserver-letsencrypt car cela est déjà géré par la contribution.

	Attention :
	fin de l'installation et de la configuration manuelles de «dehydrated» sans la contribution smeserver-letsencrypt.

Difference between revisions of "Letsencrypt/fr"

Revision as of 15:06, 16 September 2018

Introduction

Version

Prérequis

Préparation

Installation de la contribution de Dehydrated

Installation

Mises à jour

Ré-actualisation

Configuration

Hôtes et domaines du certificat

Autres paramètres de configuration

Accepter les conditions de Let's Encrypt

Activer le mode test

Activer le mode production

Exemples de démarrage rapide

Installation manuelle de « Dehydrated »

Installation du paquet «dehydrated» à partir du dépôt smecontrib

Installation de la dernière version de git

Configuration manuelle de «Dehydrated»

Renouvellement

Imposer le SSL

Sauvegarde

Troubleshooting

Certificate Errors

Authorization Errors

Errors

No registration exists matching provided key

rateLimited, Too many currently pending Authorizations

Some challenges complete successfully but some hostnames fail

Challenge fails with unauthorized 403 error

Sujets avancés

Obtention de certificats pour d'autres serveurs

Obtaining certificates for a private SME Server

Bugs

Changelog

Navigation menu

Search