147
edits
Changes
Jump to navigation
Jump to search
Line 106:
Line 106: + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Added section on generating certificates for internal server
Your certificate, private key, and other important information are stored in /etc/letsencrypt, which is not included in the standard SME Server backup routines. Make sure to add this directory to your backups. See, e.g., [[Backup with dar#Adding files and directories|Backup with dar]] if you're using the workstation backup feature.
Your certificate, private key, and other important information are stored in /etc/letsencrypt, which is not included in the standard SME Server backup routines. Make sure to add this directory to your backups. See, e.g., [[Backup with dar#Adding files and directories|Backup with dar]] if you're using the workstation backup feature.
== Creating certificates for internal servers ==
You may have one or more internal servers on your network for which you want or need trusted TLS certificates, but which aren't directly accessible from the outside. The Letsencrypt service can handle this too, although the process isn't quite as simple as shown above.
Assumptions:
* You've followed the instructions above to install the Letsencrypt client, and it's working
* The hostname for which you need a certificate resolves, from the outside, to your SME Server. For example, you've registered yourdomain.tld, and a DNS record for *.yourdomain.tld points to your SME Server. You want to create a certificate for privateserver.yourdomain.tld
* Port 80 on your SME Server is open to the Internet--you aren't behind a firewall, or some ISP filtering, that would block it.
You can either create the certificate on your SME Server, and then copy it to the internal server using whatever means that server provides; or (if the internal server is able to run the Letsencrypt client) you can generate the certificate on the internal server.
=== Generate the certificate on the SME Server ===
You could simply follow the instructions above, using the FQDN of your internal server. However, those instructions require that you take down your web server briefly. If you were generating a new certificate for the SME Server, you'd need to do this anyway, so that the web server would load the new certificate. If you're generating a certificate for a different internal server, though, you may not want (and you do not need) to take down your SME Server's web server.
Follow the instructions above to create the certificate, but replace the letsencrypt command line with:
./letsencrypt-auto certonly --webroot --webroot-path /home/e-smith/files/primary/html --email admin@yourdomain.tld -d privateserver.yourdomain.tld
The Letsencrypt client will run and place the certificate files in /etc/letsencrypt/live/privateserver.yourdomain.tld/ on your SME Server. You can then copy them to your internal server and install them using whatever mechanism that server provides. This will not alter the configuration of your SME Server.
=== Generate the certificate on the internal server ===
If the internal server is Unix-y and otherwise meets the requirements for the Letsencrypt client, you can run the client on the internal server using manual domain authentication. This will require you to create a small file on your SME Server, which you can delete once the certificate is created.
The letsencrypt command would look like:
./letsencrypt-auto certonly --manual --email admin@yourdomain.tld -d privateserver.yourdomain.tld
When the Letsencrypt client runs, it will show you a challenge like the following, with different random strings:
Make sure your web server displays the following content at
http://privateserver.yourdomain.tld/.well-known/acme-challenge/U8AGPrh8wTM9wYpaOGUmfihZezzoLrCAhspJYeO-lsc before continuing:
U8AGPrh8wTM9wYpaOGUmfihZezzoLrCAhspJYeO-lsc.oYz0Q5G7t8oAAhKBGu6Y9InuE1eP2CRhR-RtUVXvloc
At this point, on your SME Server, you'll need to create that file:
# mkdir -p /home/e-smith/files/primary/html/.well-known/acme-challenge
# echo U8AGPrh8wTM9wYpaOGUmfihZezzoLrCAhspJYeO-lsc.oYz0Q5G7t8oAAhKBGu6Y9InuE1eP2CRhR-RtUVXvloc > /home/e-smith/files/primary/html/.well-known/acme-challenge/U8AGPrh8wTM9wYpaOGUmfihZezzoLrCAhspJYeO-lsc
Then press the Enter key on your internal server. As of this writing (10 Dec 2015), the client has a bug which reports that the domain authentication failed, but it will create the certificates anyway (and it will correctly tell you that they're created). Once the client finishes and tells you the certificates are created, you can delete the nonce from your SME Server:
# rm /home/e-smith/files/primary/html/.well-known/acme-challenge/U8AGPrh8wTM9wYpaOGUmfihZezzoLrCAhspJYeO-lsc
The certificate files will be in /etc/letsencrypt/live/privateserver.yourdomain.tld/ on your internal server.
==Source from info==
==Source from info==
Source: http://forums.contribs.org/index.php/topic,51961.msg266680.html#msg266680
Source: http://forums.contribs.org/index.php/topic,51961.msg266680.html#msg266680
[[Category:Howto]] [[Category:Security]] [[Category:Howto]]
[[Category:Howto]] [[Category:Security]] [[Category:Howto]]
[[Category: Administration:Certificates]]
[[Category: Administration:Certificates]]