SSL Certs - Revision history

Guruofnothing at 03:23, 27 November 2023

2023-11-27T03:23:27Z

← Older revision		Revision as of 23:23, 26 November 2023
Line 4:		Line 4:
	<span style="color: rgb(132, 63, 161);">''''''</span>		<span style="color: rgb(132, 63, 161);">''''''</span>
	== Installing Certbot on your machine ==		== Installing Certbot on your machine ==
	Certbot now requires that you install it from SNAP. <pre>sudo apt update		Certbot now requires that you install it from SNAP.<pre>sudo apt update
	sudo apt upgrade		sudo apt upgrade
	</pre><p>Install SNAP</p><pre>sudo apt install snapd		</pre><p>Install SNAP</p>
			<pre>sudo apt install snapd
	sudo snap install core; sudo snap refresh core		sudo snap install core; sudo snap refresh core
	</pre><p>Install Certbot</p><pre>sudo snap install --classic certbot		</pre><p>Install Certbot</p>
			<pre>sudo snap install --classic certbot
	sudo ln -s /snap/bin/certbot /usr/bin/certbot		sudo ln -s /snap/bin/certbot /usr/bin/certbot
	</pre>		</pre>
Line 16:		Line 18:
	* <code>sudo certbot certonly -d '''MACHINE.DOMAIN.TLD'''</code>		* <code>sudo certbot certonly -d '''MACHINE.DOMAIN.TLD'''</code>
	** when it asks... choose option '''1: Apache Web Server plugin'''		** when it asks... choose option '''1: Apache Web Server plugin'''
	** Copy your shiny new cert into place		** Copy your shiny new cert into place<br>

	=== Using DNS challenge ===		=== Using DNS challenge ===
Line 32:		Line 34:
	* cron job to manage it all		* cron job to manage it all

			==== If getting certs for a proxied site... ====
			You will need to copy the cert files that you acquired over to the proxied site. You do not need Certbot installed on the proxy VM as it isn't required but you will need to create the appropriate folders to copy the certs into. '''SSH into the proxy machine - '''<br><pre>cd /etc
			sudo mkdir letsencrypt
			cd /letsencrypt
			sudo mkdir live
			cd /etc<br></pre><p class="mwt-heading" >Now exit back out to your web server and SCP your cert files from /etc/letsencrypt/live to the folder you created on the proxy machine.</p>
	== Certs on an Apache based server ==		== Certs on an Apache based server ==
	From /usr/share/doc/apache2/README.Debian.gz		From /usr/share/doc/apache2/README.Debian.gz
Line 46:		Line 54:

	==== Getting proper certificates onto the machine ====		==== Getting proper certificates onto the machine ====
	Using the instructions at the top of the page, Install SNAP, Install Certbot and grab the certs for your machines that need them.<br>		Using the instructions at the top of the page, Install SNAP, Install Certbot and grab the certs for your machines that need them.<br>The old way to do this is still on [[TinkerWiki:NetMan - SSL Certs#Getting proper certificates onto the machine{{!}}the TinkerNet Wiki]].

	The old way to do this is still on [[TinkerWiki:NetMan - SSL Certs#Getting proper certificates onto the machine{{!}}the TinkerNet Wiki]].

	<span style="color: rgb(255, 0, 0);">'''[[Now Do A Backup!{{!}}Now Do A Backup!]]'''</span>		<span style="color: rgb(255, 0, 0);">'''[[Now Do A Backup!{{!}}Now Do A Backup!]]'''</span>

Guruofnothing at 03:02, 27 November 2023

2023-11-27T03:02:35Z

← Older revision		Revision as of 23:02, 26 November 2023
Line 1:		Line 1:
	== Upcoming fun stuff ==		== Upcoming fun stuff ==
	SSL certs via ClouDNS' <span style="color: rgb(132, 63, 161);" >'''"Free SSL Certificates"'''</span>		SSL certs via ClouDNS' <span style="color: rgb(132, 63, 161);">'''"Free SSL Certificates"'''</span>

			<span style="color: rgb(132, 63, 161);">''''''</span>
			== Installing Certbot on your machine ==
			Certbot now requires that you install it from SNAP. <pre>sudo apt update
			sudo apt upgrade
			</pre><p>Install SNAP</p><pre>sudo apt install snapd
			sudo snap install core; sudo snap refresh core
			</pre><p>Install Certbot</p><pre>sudo snap install --classic certbot
			sudo ln -s /snap/bin/certbot /usr/bin/certbot
			</pre>
	== Certs for Devices not Actually Accessible on the Internet ==		== Certs for Devices not Actually Accessible on the Internet ==
	=== Using HTTP challenge ===		=== Using HTTP challenge ===
	(Do this on your primary web/proxy server)		(Do this on your primary web/proxy server)
	* <code>sudo apt install certbot</code>
	* Then, for each machine
	* <code>sudo certbot certonly -d '''MACHINE.DOMAIN.TLD'''</code>		* <code>sudo certbot certonly -d '''MACHINE.DOMAIN.TLD'''</code>
	** when it asks... choose option '''1: Apache Web Server plugin'''		** when it asks... choose option '''1: Apache Web Server plugin'''
Line 11:		Line 19:

	=== Using DNS challenge ===		=== Using DNS challenge ===
	* ~~Build a minimal Linux VM~~		* For each machine
	* <code>sudo apt install certbot</code>
	* Then, for each machine
	* <code>sudo certbot -d '''MACHINE.DOMAIN.TLD''' --manual --preferred-challenges dns certonly</code>		* <code>sudo certbot -d '''MACHINE.DOMAIN.TLD''' --manual --preferred-challenges dns certonly</code>
	** Follow the directions about setting up the DNS record & then hit enter		** Follow the directions about setting up the DNS record & then hit enter
Line 40:		Line 46:

	==== Getting proper certificates onto the machine ====		==== Getting proper certificates onto the machine ====
	~~Sadly...~~		Using the instructions at the top of the page, Install SNAP, Install Certbot and grab the certs for your machines that need them.<br>

	~~Between~~ the ~~time I wrote this up on~~ the ~~[https://wiki.tinkernet.ca/ TinkerNet Wiki] and now~~, ~~[https://letsencrypt.org/ Let's Encrypt] has drastically changed things~~ and ~~[https://certbot.eff.org/ certbot] is now only supported if you want to deal with snapd...~~

	~~Give me time & I'll work out new instructions~~.

	~~For now... ~~ The old ~~version~~ is still on [[TinkerWiki:NetMan - SSL Certs#Getting proper certificates onto the machine{{!}}the TinkerNet Wiki]].		The old way to do this is still on [[TinkerWiki:NetMan - SSL Certs#Getting proper certificates onto the machine{{!}}the TinkerNet Wiki]].

	<span style="color: rgb(255, 0, 0);">'''[[Now Do A Backup!{{!}}Now Do A Backup!]]'''</span>		<span style="color: rgb(255, 0, 0);">'''[[Now Do A Backup!{{!}}Now Do A Backup!]]'''</span>

Tinker at 17:26, 12 August 2023

2023-08-12T17:26:49Z

← Older revision		Revision as of 13:26, 12 August 2023
Line 1:		Line 1:
			== Upcoming fun stuff ==
			SSL certs via ClouDNS' <span style="color: rgb(132, 63, 161);" >'''"Free SSL Certificates"'''</span>
	== Certs for Devices not Actually Accessible on the Internet ==		== Certs for Devices not Actually Accessible on the Internet ==
	=== Using HTTP challenge ===		=== Using HTTP challenge ===
Line 5:		Line 7:
	* Then, for each machine		* Then, for each machine
	* <code>sudo certbot certonly -d '''MACHINE.DOMAIN.TLD'''</code>		* <code>sudo certbot certonly -d '''MACHINE.DOMAIN.TLD'''</code>
	** when it asks... choose option '''1: Apache Web Server plugin'''		** when it asks... choose option '''1: Apache Web Server plugin'''
	** Copy your shiny new cert into place		** Copy your shiny new cert into place

Tinker: /* Stuff still being worked out... */

2023-01-30T05:30:59Z

Stuff still being worked out...

← Older revision		Revision as of 01:30, 30 January 2023
Line 16:		Line 16:
	** Copy your shiny new cert into place		** Copy your shiny new cert into place

	=== Stuff still being worked out... ===		==== Stuff still being worked out... ====
	* Problem:  Renewal is potentially problematic		* Problem:  Renewal is potentially problematic
	** Tho... Apparently, renewal of a manual cert involves [https://community.letsencrypt.org/t/certbot-manual-renew/17789/2 just running the original command again].		** Tho... Apparently, renewal of a manual cert involves [https://community.letsencrypt.org/t/certbot-manual-renew/17789/2 just running the original command again].

Tinker: /* Certs for Devices not Actually Accessible on the Internet */

2023-01-30T05:02:29Z

Certs for Devices not Actually Accessible on the Internet

← Older revision		Revision as of 01:02, 30 January 2023
Line 1:		Line 1:
	== Certs for Devices not Actually Accessible on the Internet ==		== Certs for Devices not Actually Accessible on the Internet ==
	* Build a minimal Linux VM
	* <code>sudo apt install certbot</code>

	~~<span style="text-decoration: underline; font-size: 18pt;" >'''For each machine:'''</span>~~

	=== Using HTTP challenge ===		=== Using HTTP challenge ===
	(Do this on your primary web/proxy server)		(Do this on your primary web/proxy server)
			* <code>sudo apt install certbot</code>
			* Then, for each machine
	* <code>sudo certbot certonly -d '''MACHINE.DOMAIN.TLD'''</code>		* <code>sudo certbot certonly -d '''MACHINE.DOMAIN.TLD'''</code>
	** when it asks... choose option '''1: Apache Web Server plugin'''		** when it asks... choose option '''1: Apache Web Server plugin'''
Line 12:		Line 9:

	=== Using DNS challenge ===		=== Using DNS challenge ===
			* Build a minimal Linux VM
			* <code>sudo apt install certbot</code>
			* Then, for each machine
	* <code>sudo certbot -d '''MACHINE.DOMAIN.TLD''' --manual --preferred-challenges dns certonly</code>		* <code>sudo certbot -d '''MACHINE.DOMAIN.TLD''' --manual --preferred-challenges dns certonly</code>
	** Follow the directions about setting up the DNS record & then hit enter		** Follow the directions about setting up the DNS record & then hit enter

Tinker: /* Using HTTP challenge */

2023-01-30T04:59:44Z

Using HTTP challenge

← Older revision		Revision as of 00:59, 30 January 2023
Line 6:		Line 6:

	=== Using HTTP challenge ===		=== Using HTTP challenge ===
			(Do this on your primary web/proxy server)
	* <code>sudo certbot certonly -d '''MACHINE.DOMAIN.TLD'''</code>		* <code>sudo certbot certonly -d '''MACHINE.DOMAIN.TLD'''</code>
	** when it asks... choose option '''1: Apache Web Server plugin'''		** when it asks... choose option '''1: Apache Web Server plugin'''

Tinker: /* Using HTTP challenge */

2023-01-30T04:58:46Z

Using HTTP challenge

← Older revision		Revision as of 00:58, 30 January 2023
Line 10:		Line 10:
	** Copy your shiny new cert into place		** Copy your shiny new cert into place

	=== Using ~~HTTP~~ challenge ===		=== Using DNS challenge ===
	* <code>sudo certbot -d '''MACHINE.DOMAIN.TLD''' --manual --preferred-challenges dns certonly</code>		* <code>sudo certbot -d '''MACHINE.DOMAIN.TLD''' --manual --preferred-challenges dns certonly</code>
	** Follow the directions about setting up the DNS record & then hit enter		** Follow the directions about setting up the DNS record & then hit enter

Tinker: /* Certs for Devices not Actually Accessible on the Internet */

2023-01-30T04:58:30Z

Certs for Devices not Actually Accessible on the Internet

← Older revision		Revision as of 00:58, 30 January 2023
Line 2:		Line 2:
	* Build a minimal Linux VM		* Build a minimal Linux VM
	* <code>sudo apt install certbot</code>		* <code>sudo apt install certbot</code>

	<span style="text-decoration: underline; font-size: 18pt;" >'''For each machine:'''</span>		<span style="text-decoration: underline; font-size: 18pt;" >'''For each machine:'''</span>

	=== Using HTTP challenge ===		=== Using HTTP challenge ===
	* <code>sudo certbot certonly -d '''MACHINE.DOMAIN.TLD'''</code>sudo certbot -d '''MACHINE.DOMAIN.TLD''' --manual --preferred-challenges dns certonly		* <code>sudo certbot certonly -d '''MACHINE.DOMAIN.TLD'''</code>
			** when it asks... choose option '''1: Apache Web Server plugin'''
			** Copy your shiny new cert into place

			=== Using HTTP challenge ===
			* <code>sudo certbot -d '''MACHINE.DOMAIN.TLD''' --manual --preferred-challenges dns certonly</code>
	** Follow the directions about setting up the DNS record & then hit enter		** Follow the directions about setting up the DNS record & then hit enter
	** Copy your shiny new cert into place		** Copy your shiny new cert into place

Tinker: /* Certs for Devices not Actually Accessible on the Internet */

2023-01-30T04:56:12Z

Certs for Devices not Actually Accessible on the Internet

← Older revision		Revision as of 00:56, 30 January 2023
Line 2:		Line 2:
	* Build a minimal Linux VM		* Build a minimal Linux VM
	* <code>sudo apt install certbot</code>		* <code>sudo apt install certbot</code>
			<span style="text-decoration: underline; font-size: 18pt;" >'''For each machine:'''</span>
	For each machine:

	=== Using HTTP challenge ===		=== Using HTTP challenge ===
	* <code>sudo certbot certonly -d '''MACHINE.DOMAIN.TLD'''</~~code~~		* <code>sudo certbot certonly -d '''MACHINE.DOMAIN.TLD'''</code>sudo certbot -d '''MACHINE.DOMAIN.TLD''' --manual --preferred-challenges dns certonly
	** when it asks... choose option '''1: Apache Web Server plugin'''

	~~=== Using DNS challenge ===~~
	* <code>sudo certbot -d '''MACHINE.DOMAIN.TLD''' --manual --preferred-challenges dns certonly~~</code>~~
	** Follow the directions about setting up the DNS record & then hit enter		** Follow the directions about setting up the DNS record & then hit enter
	** Copy your shiny new cert into place		** Copy your shiny new cert into place

Tinker: /* Certs for Devices not Actually Accessible on the Internet */

2023-01-30T04:55:26Z

Certs for Devices not Actually Accessible on the Internet

← Older revision		Revision as of 00:55, 30 January 2023
Line 2:		Line 2:
	* Build a minimal Linux VM		* Build a minimal Linux VM
	* <code>sudo apt install certbot</code>		* <code>sudo apt install certbot</code>
	* For each machine:
			For each machine:

	=== Using HTTP challenge ===		=== Using HTTP challenge ===