A Solution for Getting Proper Certs - Revision history

Tinker: /* If you're running certbot on the PVE server itself */

2022-07-02T01:59:18Z

If you're running certbot on the PVE server itself

← Older revision		Revision as of 21:59, 1 July 2022
Line 90:		Line 90:
	</syntaxhighlight>		</syntaxhighlight>
	* Replace "''schizox.tinkernet.ca''" with your actual servers FQDN... then call the script from roots crontab		* Replace "''schizox.tinkernet.ca''" with your actual servers FQDN... then call the script from roots crontab
			* <code>sudo crontab -e</code>
	* <code>0 0 2 * * /root/certrenew.sh</code>		* <code>0 0 2 * * /root/certrenew.sh</code>

Tinker: /* If you're running certbot on the PVE server itself & want to use cron to do the updates with minimal fuss... */

2022-07-02T01:41:16Z

If you're running certbot on the PVE server itself & want to use cron to do the updates with minimal fuss...

← Older revision		Revision as of 21:41, 1 July 2022
Line 77:		Line 77:
	** Copy '''fullchain.pem''' to '''/etc/pve/local/pveproxy-ssl.pem'''		** Copy '''fullchain.pem''' to '''/etc/pve/local/pveproxy-ssl.pem'''

	=== If you're running certbot on the PVE server itself & want to use cron to do the updates with minimal fuss... ~~===~~		=== If you're running certbot on the PVE server itself ===
			and you want to use cron to do the updates with minimal fuss...

	* Create a script in roots home directory ('''/root''') called '''certrenew.sh'''		* Create a script in roots home directory ('''/root''') called '''certrenew.sh'''
	<syntaxhighlight lang="bash">		<syntaxhighlight lang="bash">

Tinker: /* If you're running certbot on the PVE server itself & want to use cron to do the updates with minimal fuss... */

2022-07-02T01:37:30Z

If you're running certbot on the PVE server itself & want to use cron to do the updates with minimal fuss...

← Older revision		Revision as of 21:37, 1 July 2022
Line 87:		Line 87:

	</syntaxhighlight>		</syntaxhighlight>
	* then call the script from roots crontab		* Replace "''schizox.tinkernet.ca''" with your actual servers FQDN... then call the script from roots crontab
			* <code>0 0 2 * * /root/certrenew.sh</code>

	== ESXi ==		== ESXi ==

Tinker: /* Proxmox */

2022-07-02T01:31:08Z

Proxmox

← Older revision		Revision as of 21:31, 1 July 2022
Line 79:		Line 79:
	=== If you're running certbot on the PVE server itself & want to use cron to do the updates with minimal fuss... ===		=== If you're running certbot on the PVE server itself & want to use cron to do the updates with minimal fuss... ===
	* Create a script in roots home directory ('''/root''') called '''certrenew.sh'''		* Create a script in roots home directory ('''/root''') called '''certrenew.sh'''
	* fffff		<syntaxhighlight lang="bash">
			#!/bin/bash

			/usr/bin/certbot renew
			cp /etc/letsencrypt/live/schizox.tinkernet.ca/privkey.pem /etc/pve/local/pveproxy-ssl.key
			cp /etc/letsencrypt/live/schizox.tinkernet.ca/fullchain.pem /etc/pve/local/pveproxy-ssl.pem

			</syntaxhighlight>
	* then call the script from roots crontab		* then call the script from roots crontab

Tinker: /* Proxmox */

2022-07-02T01:29:57Z

Proxmox

← Older revision		Revision as of 21:29, 1 July 2022
Line 76:		Line 76:
	** Copy '''privkey.pem''' to '''/etc/pve/local/pveproxy-ssl.key'''		** Copy '''privkey.pem''' to '''/etc/pve/local/pveproxy-ssl.key'''
	** Copy '''fullchain.pem''' to '''/etc/pve/local/pveproxy-ssl.pem'''		** Copy '''fullchain.pem''' to '''/etc/pve/local/pveproxy-ssl.pem'''

			=== If you're running certbot on the PVE server itself & want to use cron to do the updates with minimal fuss... ===
			* Create a script in roots home directory ('''/root''') called '''certrenew.sh'''
			* fffff
			* then call the script from roots crontab

	== ESXi ==		== ESXi ==
	* Using the Web UI		* Using the Web UI

Tinker: /* Putting the Certs where they Actually Belong */

2022-07-02T01:24:39Z

Putting the Certs where they Actually Belong

← Older revision		Revision as of 21:24, 1 July 2022
Line 66:		Line 66:

	= Putting the Certs where they Actually Belong =		= Putting the Certs where they Actually Belong =
	* Normal Linux Stuff (Apache in particular...)		== Normal Linux Stuff (Apache in particular...) ==
	** Just leave it in '''/etc/letsencrypt/live/'''		* Just leave it in '''/etc/letsencrypt/live/'''
	** Of course, if you're working on a web server & it's accessible from the Internet, you can run certbot directly on the machine & do the whole --auto thing...		* Of course, if you're working on a web server & it's accessible from the Internet, you can run certbot directly on the machine & do the whole --auto thing...
	* Proxmox		== Proxmox ==
	** Using the Web UI:		* Using the Web UI:
	*** Upload '''privkey.pem''' as the '''Private Key''' & '''fullchain.pem''' as the '''Certificate Chain'''.		** Upload '''privkey.pem''' as the '''Private Key''' & '''fullchain.pem''' as the '''Certificate Chain'''.
	*** You can either just copy the content or SCP them to someplace you can use your graphical file browser to upload from.		** You can either just copy the content or SCP them to someplace you can use your graphical file browser to upload from.
	** Using SCP:		* Using SCP:
	*** Copy '''privkey.pem''' to '''/etc/pve/local/pveproxy-ssl.key'''		** Copy '''privkey.pem''' to '''/etc/pve/local/pveproxy-ssl.key'''
	*** Copy '''fullchain.pem''' to '''/etc/pve/local/pveproxy-ssl.pem'''		** Copy '''fullchain.pem''' to '''/etc/pve/local/pveproxy-ssl.pem'''
	* ESXi		== ESXi ==
	** Using the Web UI		* Using the Web UI
	*** Upload by pasting the content of fullchain.pem		** Upload by pasting the content of fullchain.pem
	** Using SCP		* Using SCP
	*** Copy '''privkey.pem''' to '''/etc/vmware/ssl/rui.key'''		** Copy '''privkey.pem''' to '''/etc/vmware/ssl/rui.key'''
	*** Copy '''fullchain.pem''' to '''/etc/vmware/ssl/rui.crt'''		** Copy '''fullchain.pem''' to '''/etc/vmware/ssl/rui.crt'''
	*** then restart ESXis HTTP:		** then restart ESXis HTTP:
	*** <code>/etc/init.d/rhttpproxy restart</code>		** <code>/etc/init.d/rhttpproxy restart</code>
	* pfSense		== pfSense ==
	** ???		* ???
	* Node-Red		== Node-Red ==
	** ???		* ???
	* Grafana		== Grafana ==
	** ???		* ???
	* Shinobi		== Shinobi ==
	** ???		* ???

Tinker: /* First Method: Working from the machine with certbot installed on it */

2022-07-02T01:05:57Z

First Method: Working from the machine with certbot installed on it

← Older revision		Revision as of 21:05, 1 July 2022
Line 53:		Line 53:
	== First Method: Working from the '''machine with certbot''' installed on it ==		== First Method: Working from the '''machine with certbot''' installed on it ==
	* <code>certbot renew</code>		* <code>certbot renew</code>
	** '''Option:''' Monthly renewal attempt using cron:		* <code>scp -R /etc/letsencrypt/live/server0.mydomain.net/ server0:/etc/letsencrypt/live/</code>
	*** <code>sudo crontab -e</code>
	*** & add in the line:		* '''Option:''' Monthly renewal attempt using cron:
	*** <code>0 0 2 * * /usr/bin/certbot renew~~</code>~~		** <code>sudo crontab -e</code>
	* <code>scp -R /etc/letsencrypt/live/server0.mydomain.net/ server0:/etc/letsencrypt/live/</code>~~<br>~~		** & add in the line:
			** <code>0 0 2 * * /usr/bin/certbot renew ; scp -R /etc/letsencrypt/live/server0.mydomain.net/ server0:/etc/letsencrypt/live/</code>
			** (Passwordless SSH will be required...)

	== Second Method: Working from the '''machine being certified''' ==		== Second Method: Working from the '''machine being certified''' ==

Tinker: /* First Method: Working from the machine with certbot installed on it */

2022-07-02T01:03:27Z

First Method: Working from the machine with certbot installed on it

← Older revision		Revision as of 21:03, 1 July 2022
Line 53:		Line 53:
	== First Method: Working from the '''machine with certbot''' installed on it ==		== First Method: Working from the '''machine with certbot''' installed on it ==
	* <code>certbot renew</code>		* <code>certbot renew</code>
			** '''Option:''' Monthly renewal attempt using cron:
			*** <code>sudo crontab -e</code>
			*** & add in the line:
			*** <code>0 0 2 * * /usr/bin/certbot renew</code>
	* <code>scp -R /etc/letsencrypt/live/server0.mydomain.net/ server0:/etc/letsencrypt/live/</code><br>		* <code>scp -R /etc/letsencrypt/live/server0.mydomain.net/ server0:/etc/letsencrypt/live/</code><br>

Tinker: /* Putting the Certs where they Actually Belong */

2022-07-01T04:39:24Z

Putting the Certs where they Actually Belong

← Older revision		Revision as of 00:39, 1 July 2022
Line 71:		Line 71:
	*** Copy '''fullchain.pem''' to '''/etc/pve/local/pveproxy-ssl.pem'''		*** Copy '''fullchain.pem''' to '''/etc/pve/local/pveproxy-ssl.pem'''
	* ESXi		* ESXi
	** ~~use~~ the Web UI ~~to upload~~ by pasting the content of fullchain.pem		** Using the Web UI
	** ~~or...~~  ~~SCP~~ '''privkey.pem''' to '''/etc/vmware/ssl/rui.key''' & '''fullchain.pem''' to '''/etc/vmware/ssl/rui.crt'''		*** Upload by pasting the content of fullchain.pem
	** then restart ESXis HTTP:		** Using SCP
			*** Copy '''privkey.pem''' to '''/etc/vmware/ssl/rui.key'''
			*** Copy '''fullchain.pem''' to '''/etc/vmware/ssl/rui.crt'''
			*** then restart ESXis HTTP:
	*** <code>/etc/init.d/rhttpproxy restart</code>		*** <code>/etc/init.d/rhttpproxy restart</code>
	* pfSense		* pfSense

Tinker: /* Putting the Certs where they Actually Belong */

2022-07-01T04:20:41Z

Putting the Certs where they Actually Belong

← Older revision		Revision as of 00:20, 1 July 2022
Line 64:		Line 64:
	** Of course, if you're working on a web server & it's accessible from the Internet, you can run certbot directly on the machine & do the whole --auto thing...		** Of course, if you're working on a web server & it's accessible from the Internet, you can run certbot directly on the machine & do the whole --auto thing...
	* Proxmox		* Proxmox
	** ~~use~~ the Web UI ~~to upload~~ '''privkey.pem'''  as the '''Private Key''' & '''fullchain.pem''' as the '''Certificate Chain'''.		** Using the Web UI:
	** You can either just copy the content or SCP them to someplace you can use your graphical file browser to upload from.		*** Upload '''privkey.pem''' as the '''Private Key''' & '''fullchain.pem''' as the '''Certificate Chain'''.
			*** You can either just copy the content or SCP them to someplace you can use your graphical file browser to upload from.
			** Using SCP:
			*** Copy '''privkey.pem''' to '''/etc/pve/local/pveproxy-ssl.key'''
			*** Copy '''fullchain.pem''' to '''/etc/pve/local/pveproxy-ssl.pem'''
	* ESXi		* ESXi
	** use the Web UI to upload by pasting the content of fullchain.pem		** use the Web UI to upload by pasting the content of fullchain.pem