Difference between revisions of "CERTBOT - http challenge"
From wiki.1001solutions.net
Line 79: | Line 79: | ||
} | } | ||
</nowiki> | </nowiki> | ||
+ | |||
+ | |||
+ | |||
+ | = Cerbot Quick Help = | ||
+ | |||
+ | <nowiki> | ||
+ | # certbot --help | ||
+ | |||
+ | - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - | ||
+ | |||
+ | certbot [SUBCOMMAND] [options] [-d DOMAIN] [-d DOMAIN] ... | ||
+ | |||
+ | Certbot can obtain and install HTTPS/TLS/SSL certificates. By default, | ||
+ | it will attempt to use a webserver both for obtaining and installing the | ||
+ | certificate. The most common SUBCOMMANDS and flags are: | ||
+ | |||
+ | obtain, install, and renew certificates: | ||
+ | (default) run Obtain & install a certificate in your current webserver | ||
+ | certonly Obtain or renew a certificate, but do not install it | ||
+ | renew Renew all previously obtained certificates that are near | ||
+ | expiry | ||
+ | enhance Add security enhancements to your existing configuration | ||
+ | -d DOMAINS Comma-separated list of domains to obtain a certificate for | ||
+ | |||
+ | (the certbot apache plugin is not installed) | ||
+ | --standalone Run a standalone webserver for authentication | ||
+ | --nginx Use the Nginx plugin for authentication & installation | ||
+ | --webroot Place files in a server's webroot folder for authentication | ||
+ | --manual Obtain certificates interactively, or using shell script | ||
+ | hooks | ||
+ | |||
+ | -n Run non-interactively | ||
+ | --test-cert Obtain a test certificate from a staging server | ||
+ | --dry-run Test "renew" or "certonly" without saving any certificates | ||
+ | to disk | ||
+ | |||
+ | manage certificates: | ||
+ | certificates Display information about certificates you have from Certbot | ||
+ | revoke Revoke a certificate (supply --cert-path or --cert-name) | ||
+ | delete Delete a certificate | ||
+ | |||
+ | manage your account with Let's Encrypt: | ||
+ | register Create a Let's Encrypt ACME account | ||
+ | update_account Update a Let's Encrypt ACME account | ||
+ | --agree-tos Agree to the ACME server's Subscriber Agreement | ||
+ | -m EMAIL Email address for important account notifications | ||
+ | |||
+ | More detailed help: | ||
+ | |||
+ | -h, --help [TOPIC] print this message, or detailed help on a topic; | ||
+ | the available TOPICS are: | ||
+ | |||
+ | all, automation, commands, paths, security, testing, or any of the | ||
+ | subcommands or plugins (certonly, renew, install, register, nginx, | ||
+ | apache, standalone, webroot, etc.) | ||
+ | - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -</nowiki> | ||
Latest revision as of 21:54, 13 April 2020
Contents
Command
certbot certonly --dry-run --webroot -w /var/www/acme-challenge -d example.org
Vhost
server { listen W.X.Y.Z:80; server_name _; # Let's encrypt snippet include /etc/nginx/snippets/letsencrypt.conf; root /var/www/acme-challenge; index index.html; location / { return 301 https://$server_name$request_uri; } }
Snippet
############################################################################# # /etc/nginx/snippets/letsencrypt.conf # # Configuration file for Let's Encrypt ACME Challenge location # This file is already included in listen_xxx.conf files. # Do NOT include it separately! ############################################################################# # # This config enables to access /.well-known/acme-challenge/xxxxxxxxxxx # on all our sites (HTTP), including all subdomains. # This is required by ACME Challenge (webroot authentication). # You can check that this location is working by placing ping.txt here: # /var/www/letsencrypt/.well-known/acme-challenge/ping.txt # And pointing your browser to: # http://xxx.domain.tld/.well-known/acme-challenge/ping.txt # # Sources: # https://community.letsencrypt.org/t/howto-easy-cert-generation-and-renewal-with-nginx/3491 # ############################################################################# # Rule for legitimate ACME Challenge requests (like /.well-known/acme-challenge/xxxxxxxxx) # We use ^~ here, so that we don't check other regexes (for speed-up). We actually MUST cancel # other regex checks, because in our other config files have regex rule that denies access to files with dotted names. location ^~ /.well-known/acme-challenge/ { # Set correct content type. According to this: # https://community.letsencrypt.org/t/using-the-webroot-domain-verification-method/1445/29 # Current specification requires "text/plain" or no content header at all. # It seems that "text/plain" is a safe option. default_type "text/plain"; # This directory must be the same as in /etc/letsencrypt/cli.ini # as "webroot-path" parameter. Also don't forget to set "authenticator" parameter # there to "webroot". # Do NOT use alias, use root! Target directory is located here: # /var/www/common/letsencrypt/.well-known/acme-challenge/ root /var/www/letsencrypt; } # Hide /acme-challenge subdirectory and return 404 on all requests. # It is somewhat more secure than letting Nginx return 403. # Ending slash is important! location = /.well-known/acme-challenge/ { return 404; }
Cerbot Quick Help
# certbot --help - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - certbot [SUBCOMMAND] [options] [-d DOMAIN] [-d DOMAIN] ... Certbot can obtain and install HTTPS/TLS/SSL certificates. By default, it will attempt to use a webserver both for obtaining and installing the certificate. The most common SUBCOMMANDS and flags are: obtain, install, and renew certificates: (default) run Obtain & install a certificate in your current webserver certonly Obtain or renew a certificate, but do not install it renew Renew all previously obtained certificates that are near expiry enhance Add security enhancements to your existing configuration -d DOMAINS Comma-separated list of domains to obtain a certificate for (the certbot apache plugin is not installed) --standalone Run a standalone webserver for authentication --nginx Use the Nginx plugin for authentication & installation --webroot Place files in a server's webroot folder for authentication --manual Obtain certificates interactively, or using shell script hooks -n Run non-interactively --test-cert Obtain a test certificate from a staging server --dry-run Test "renew" or "certonly" without saving any certificates to disk manage certificates: certificates Display information about certificates you have from Certbot revoke Revoke a certificate (supply --cert-path or --cert-name) delete Delete a certificate manage your account with Let's Encrypt: register Create a Let's Encrypt ACME account update_account Update a Let's Encrypt ACME account --agree-tos Agree to the ACME server's Subscriber Agreement -m EMAIL Email address for important account notifications More detailed help: -h, --help [TOPIC] print this message, or detailed help on a topic; the available TOPICS are: all, automation, commands, paths, security, testing, or any of the subcommands or plugins (certonly, renew, install, register, nginx, apache, standalone, webroot, etc.) - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Source