tips:ssl
Differences
This shows you the differences between two versions of the page.
| Both sides previous revisionPrevious revisionNext revision | Previous revision | ||
| tips:ssl [2017/04/19 14:31] – scipio | tips:ssl [2025/11/21 09:11] (current) – sscipioni | ||
|---|---|---|---|
| Line 5: | Line 5: | ||
| [[https:// | [[https:// | ||
| + | ===== letsencrypt staging ===== | ||
| + | |||
| + | get ca certificate and use with curl | ||
| + | <code | download> | ||
| + | API_HOST=sso.csgalileo.org | ||
| + | echo quit | openssl s_client -showcerts -servername " | ||
| + | curl --cacert cacert.pem https:// | ||
| + | </ | ||
| + | |||
| + | in browser import this [[https:// | ||
| + | ===== certbot ====== | ||
| + | |||
| + | < | ||
| + | snap install --classic certbot | ||
| + | |||
| + | # or for focal pre | ||
| + | add-apt-repository ppa: | ||
| + | apt-get update | ||
| + | apt-get install -y certbot python-certbot-nginx | ||
| + | </ | ||
| + | |||
| + | < | ||
| + | certbot certonly --webroot -w / | ||
| + | </ | ||
| + | |||
| + | wildcard | ||
| + | < | ||
| + | certbot certonly \ | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | </ | ||
| + | ==== nginx ==== | ||
| + | |||
| + | < | ||
| + | server { | ||
| + | listen 80; | ||
| + | server_name nextcloud.csgalileo.org; | ||
| + | server_tokens off; | ||
| + | |||
| + | location / | ||
| + | root /var/www; | ||
| + | allow all; | ||
| + | } | ||
| + | |||
| + | location / { | ||
| + | return 301 https:// | ||
| + | } | ||
| + | } | ||
| + | |||
| + | |||
| + | |||
| + | server { | ||
| + | listen 443; | ||
| + | server_name nnextcloud.csgalileo.org; | ||
| + | | ||
| + | ssl_certificate / | ||
| + | ssl_certificate_key / | ||
| + | | ||
| + | } | ||
| + | </ | ||
| + | |||
| + | renew | ||
| + | < | ||
| + | certbot renew [--dry-run] | ||
| + | </ | ||
| + | |||
| + | automatic renew | ||
| + | < | ||
| + | systemctl status certbot.service | ||
| + | </ | ||
| + | |||
| + | / | ||
| + | < | ||
| + | max-log-backups = 0 | ||
| + | deploy-hook = systemctl reload nginx | ||
| + | </ | ||
| ===== acme.sh integration for letsencrypt ===== | ===== acme.sh integration for letsencrypt ===== | ||
| Line 94: | Line 173: | ||
| RewriteCond %{REQUEST_URI} !^/ | RewriteCond %{REQUEST_URI} !^/ | ||
| RewriteRule ^/?(.*) https:// | RewriteRule ^/?(.*) https:// | ||
| - | Redirect permanent / https:// | + | |
| </ | </ | ||
| Line 191: | Line 270: | ||
| 3 - this solution sits very nicely if you are using ansible, since the certs will live on the controller machine and can be copied across to all slave machines with a single command | 3 - this solution sits very nicely if you are using ansible, since the certs will live on the controller machine and can be copied across to all slave machines with a single command | ||
| + | |||
| + | |||
| + | |||
| + | {{ : | ||
tips/ssl.1492605110.txt.gz · Last modified: by scipio
