3,704
edits
Changes
Jump to navigation
Jump to search
Line 42:
Line 42: − + − + − Letsencrypt.sh is a lightweight alternative ACME client which will allow you to retrieve certificates from the Letsencrypt servers without needing to install any additional software on your server, other than git to download and install it. Begin by installing git:+ − + − + − + − + − + Line 62:
Line 62: − + Line 70:
Line 70: − + − + − + Line 100:
Line 100: − + Line 115:
Line 115: − + − letsencrypt.sh -c + − +
→Installation: letsencrypt.sh -> dehydrated
== Installation ==
== Installation ==
Multiple clients are available for the Letsencrypt services. The official client from letsencrypt.org is quite full-featured, but has a number of dependencies that it needs to install. It also requires a newer version of Python than is included with a standard SME Server installation. Due to this complexity, and the lack of compatibility with SME 8.x, this document describes installation and use of letsencrypt.sh, an alternative client implemented as a BASH shell script.
Multiple clients are available for the Letsencrypt services. The official client from letsencrypt.org is quite full-featured, but has a number of dependencies that it needs to install. It also requires a newer version of Python than is included with a standard SME Server installation. Due to this complexity, and the lack of compatibility with SME 8.x, this document describes installation and use of ''[https://github.com/lukas2511/dehydrated dehydrated]'', an alternative client implemented as a BASH shell script.
=== Installation of Letsencrypt.sh ===
=== Installation of Dehydrated ===
Dehydrated is a lightweight alternative ACME client which will allow you to retrieve certificates from the Letsencrypt servers without needing to install any additional software on your server, other than git to download and install it. Begin by installing git:
yum install git
yum install git
Then download the letsencrypt.sh client:
Then download the Dehydrated client:
cd /etc
cd /etc
git clone https://github.com/lukas2511/letsencrypt.sh
git clone https://github.com/lukas2511/dehydrated
mv letsencrypt.sh/letsencrypt.sh /usr/local/bin/
mv dehydrated/dehydrated /usr/local/bin/
You'll need to create two configuration files for letsencrypt.sh.
You'll need to create two configuration files for Dehydrated.
cd letsencrypt.sh
cd dehydrated
mkdir -p /home/e-smith/files/ibays/Primary/html/.well-known/acme-challenge
mkdir -p /home/e-smith/files/ibays/Primary/html/.well-known/acme-challenge
nano -w domains.txt
nano -w domains.txt
Ctrl-X to exit, Y to save.
Ctrl-X to exit, Y to save.
Second, you'll need to create the configuration file:
Second, you'll need to create the configuration file '''config''':
nano -w config
nano -w config
# CA="https://acme-staging.api.letsencrypt.org/directory"
# CA="https://acme-staging.api.letsencrypt.org/directory"
WELLKNOWN="/home/e-smith/files/ibays/Primary/html/.well-known/acme-challenge"
WELLKNOWN="/home/e-smith/files/ibays/Primary/html/.well-known/acme-challenge"
HOOK="/usr/local/bin/letsencrypt-hook.sh"
HOOK="/usr/local/bin/dehydrated-hook"
# E-mail to use during the registration (default: <unset>)
# E-mail to use during the registration (default: <unset>)
CONTACT_EMAIL="admin@yourdomain.com"
CONTACT_EMAIL="admin@yourdomain.com"
Ctrl-X to exit, Y to save.
Ctrl-X to exit, Y to save.
For testing purposes, it's recommended that you uncomment the third line (so it begins with "CA="). Any certificates issued while testing will not be trusted, but they will also not count against your rate limits. Once your configuration is set, you can comment out that line and re-run letsencrypt.sh.
For testing purposes, it's recommended that you uncomment the third line (so it begins with "CA="). Any certificates issued while testing will not be trusted, but they will also not count against your rate limits. Once your configuration is set, you can comment out that line and re-run dehydrated.
You'll need to create a custom "hook" script to set the config database up properly, and to trigger reloads of your system services when a certificate is issued or renewed.
You'll need to create a custom "hook" script to set the config database up properly, and to trigger reloads of your system services when a certificate is issued or renewed.
nano /usr/local/bin/letsencrypt-hook.sh
nano /usr/local/bin/dehydrated-hook
Its contents should look like this:
Its contents should look like this:
Ctrl-X to exit, Y to save. Then make it executable:
Ctrl-X to exit, Y to save. Then make it executable:
chmod +x /usr/local/bin/letsencrypt-hook.sh
chmod +x /usr/local/bin/dehydrated-hook
You'll also need to create a custom template fragment for Apache:
You'll also need to create a custom template fragment for Apache:
service httpd-e-smith restart
service httpd-e-smith restart
Now you're ready to run letsencrypt.sh and get your certificate.
Now you're ready to run dehydrated and get your certificate.
dehydrated -c
The script will run for a moment and should report success. If it does, look in /etc/letsencrypt.sh/certs/YOURDOMAIN and see if you have your files there. You should see a number of .pem files, at least one .csr file, and five symbolic links (chain.pem, cert.csr, cert.pem, fullchain.pem, and privkey.pem). If you do, congratulations! You've successfully obtained your certificate. The hook script should have also configured your server to use the new certificate. To make sure, run
The script will run for a moment and should report success. If it does, look in /etc/dehydrated/certs/YOURDOMAIN and see if you have your files there. You should see a number of .pem files, at least one .csr file, and five symbolic links (chain.pem, cert.csr, cert.pem, fullchain.pem, and privkey.pem). If you do, congratulations! You've successfully obtained your certificate. The hook script should have also configured your server to use the new certificate. To make sure, run
config show modSSL
config show modSSL
and make sure there are values set for crt, key, and CertificateChainFile.
and make sure there are values set for crt, key, and CertificateChainFile.