tips:ssl
Differences
This shows you the differences between two versions of the page.
| Both sides previous revisionPrevious revisionNext revision | Previous revision | ||
| tips:ssl [2019/02/22 14:46] – [acme.sh integration for letsencrypt] scipio | tips:ssl [2025/11/21 09:11] (current) – sscipioni | ||
|---|---|---|---|
| Line 5: | Line 5: | ||
| [[https:// | [[https:// | ||
| + | ===== letsencrypt staging ===== | ||
| + | |||
| + | get ca certificate and use with curl | ||
| + | <code | download> | ||
| + | API_HOST=sso.csgalileo.org | ||
| + | echo quit | openssl s_client -showcerts -servername " | ||
| + | curl --cacert cacert.pem https:// | ||
| + | </ | ||
| + | |||
| + | in browser import this [[https:// | ||
| ===== certbot ====== | ===== certbot ====== | ||
| < | < | ||
| + | snap install --classic certbot | ||
| + | |||
| + | # or for focal pre | ||
| add-apt-repository ppa: | add-apt-repository ppa: | ||
| apt-get update | apt-get update | ||
| Line 17: | Line 30: | ||
| </ | </ | ||
| + | wildcard | ||
| + | < | ||
| + | certbot certonly \ | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | </ | ||
| + | ==== nginx ==== | ||
| + | < | ||
| + | server { | ||
| + | listen 80; | ||
| + | server_name nextcloud.csgalileo.org; | ||
| + | server_tokens off; | ||
| + | location / | ||
| + | root /var/www; | ||
| + | allow all; | ||
| + | } | ||
| + | |||
| + | location / { | ||
| + | return 301 https:// | ||
| + | } | ||
| + | } | ||
| + | |||
| + | |||
| + | |||
| + | server { | ||
| + | listen 443; | ||
| + | server_name nnextcloud.csgalileo.org; | ||
| + | | ||
| + | ssl_certificate / | ||
| + | ssl_certificate_key / | ||
| + | | ||
| + | } | ||
| + | </ | ||
| + | |||
| + | renew | ||
| + | < | ||
| + | certbot renew [--dry-run] | ||
| + | </ | ||
| + | |||
| + | automatic renew | ||
| + | < | ||
| + | systemctl status certbot.service | ||
| + | </ | ||
| + | |||
| + | / | ||
| + | < | ||
| + | max-log-backups = 0 | ||
| + | deploy-hook = systemctl reload nginx | ||
| + | </ | ||
| ===== acme.sh integration for letsencrypt ===== | ===== acme.sh integration for letsencrypt ===== | ||
| Line 205: | Line 270: | ||
| 3 - this solution sits very nicely if you are using ansible, since the certs will live on the controller machine and can be copied across to all slave machines with a single command | 3 - this solution sits very nicely if you are using ansible, since the certs will live on the controller machine and can be copied across to all slave machines with a single command | ||
| + | |||
| + | |||
| + | |||
| + | {{ : | ||
tips/ssl.1550843188.txt.gz · Last modified: by scipio
