"Let's Encrypt Wildcard Certificate Certbot"-ны өөр хувилбарууд
Дусал нэвтэрхий толь-с
(Хуудас үүсгэв: "https://dev.to/nabbisen/let-s-encrypt-wildcard-certificate-with-certbot-plo Introduction Let's Encrypt supports wildcard certificate via ACMEv2 using the DNS-01 cha...") |
|||
| 1-р мөр: | 1-р мөр: | ||
https://dev.to/nabbisen/let-s-encrypt-wildcard-certificate-with-certbot-plo | https://dev.to/nabbisen/let-s-encrypt-wildcard-certificate-with-certbot-plo | ||
| − | Introduction | + | |
| + | == Introduction == | ||
| + | |||
Let's Encrypt supports wildcard certificate via ACMEv2 using the DNS-01 challenge, which began on March 13, 2018. | Let's Encrypt supports wildcard certificate via ACMEv2 using the DNS-01 challenge, which began on March 13, 2018. | ||
| 14-р мөр: | 16-р мөр: | ||
Body | Body | ||
Environment | Environment | ||
| + | Certbot: >0.32.0 | ||
| + | |||
| − | + | == Tutorial == | |
| − | |||
| − | |||
The command is like this: | The command is like this: | ||
| + | <pre> | ||
# certbot certonly --manual --preferred-challenges dns --server https://acme-v02.api.letsencrypt.org/directory --manual-public-ip-logging-ok -d '*.<your.domain>' -d <your.domain> | # certbot certonly --manual --preferred-challenges dns --server https://acme-v02.api.letsencrypt.org/directory --manual-public-ip-logging-ok -d '*.<your.domain>' -d <your.domain> | ||
| + | </pre> | ||
Make sure to quote *.<your.domain> to avoid the error "no matches found: *.<your.domain>". | Make sure to quote *.<your.domain> to avoid the error "no matches found: *.<your.domain>". | ||
| 30-р мөр: | 34-р мөр: | ||
Here is the comparison of certonly options with a single certificate: | Here is the comparison of certonly options with a single certificate: | ||
| + | <pre> | ||
- --webroot -w <dir-path> | - --webroot -w <dir-path> | ||
+ --manual --preferred-challenges dns --server https://acme-v02.api.letsencrypt.org/directory --manual-public-ip-logging-ok | + --manual --preferred-challenges dns --server https://acme-v02.api.letsencrypt.org/directory --manual-public-ip-logging-ok | ||
| + | </pre> | ||
Besides, the detail of its command line options is here. | Besides, the detail of its command line options is here. | ||
| 37-р мөр: | 43-р мөр: | ||
Then, the command replies: | Then, the command replies: | ||
| + | <pre> | ||
Saving debug log to /var/log/letsencrypt/letsencrypt.log | Saving debug log to /var/log/letsencrypt/letsencrypt.log | ||
Plugins selected: Authenticator manual, Installer None | Plugins selected: Authenticator manual, Installer None | ||
| 59-р мөр: | 66-р мөр: | ||
Name _acme-challenge | Name _acme-challenge | ||
Value <acme-challenge-value> the command shows above | Value <acme-challenge-value> the command shows above | ||
| + | </pre> | ||
| − | * | + | * Анхаарах: DNS тохиргоо идэвхжих хүртэл хэдэн минут хүлээсний дараа Enter дарах хэрэгтэй. |
| − | |||
| + | <pre> | ||
Waiting for verification... | Waiting for verification... | ||
Cleaning up challenges | Cleaning up challenges | ||
| 82-р мөр: | 90-р мөр: | ||
Done : ) | Done : ) | ||
| − | + | </pre> | |
[[Ангилал:Сисадмин]] | [[Ангилал:Сисадмин]] | ||
[[Ангилал:Linux]] | [[Ангилал:Linux]] | ||
11:49, 8 Зургаадугаар сар 2019-ий байдлаарх засвар
https://dev.to/nabbisen/let-s-encrypt-wildcard-certificate-with-certbot-plo
Introduction
Let's Encrypt supports wildcard certificate via ACMEv2 using the DNS-01 challenge, which began on March 13, 2018. Certbot, its client, provides --manual option to carry it out. I sincerely appreciate them.
I write how I generated my wildcard certificate with Certbot. It was a very simple task : ) All what was necessary in addition is to add a TXT record specified by Certbot to the DNS server.
- Caution: As it is necessary to update Let's Encrypt's certificate every 90 days, a new TXT record is required at every renewal.
Body Environment
Certbot: >0.32.0
Tutorial
The command is like this:
# certbot certonly --manual --preferred-challenges dns --server https://acme-v02.api.letsencrypt.org/directory --manual-public-ip-logging-ok -d '*.<your.domain>' -d <your.domain>
Make sure to quote *.<your.domain> to avoid the error "no matches found: *.<your.domain>".
- Note: the order of -d *.<your.domain> and -d <your.domain> didn't seem to matter.
Here is the comparison of certonly options with a single certificate:
- --webroot -w <dir-path> + --manual --preferred-challenges dns --server https://acme-v02.api.letsencrypt.org/directory --manual-public-ip-logging-ok
Besides, the detail of its command line options is here.
Then, the command replies:
Saving debug log to /var/log/letsencrypt/letsencrypt.log Plugins selected: Authenticator manual, Installer None Obtaining a new certificate Performing the following challenges: dns-01 challenge for <your.domain> - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Please deploy a DNS TXT record under the name _acme-challenge.<your.domain> with the following value: <acme-challenge-value> Before continuing, verify the record is deployed. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Press Enter to Continue Configure the DNS server to add a record to your domain. The record is like this: Where What Type TXT Name _acme-challenge Value <acme-challenge-value> the command shows above
- Анхаарах: DNS тохиргоо идэвхжих хүртэл хэдэн минут хүлээсний дараа Enter дарах хэрэгтэй.
Waiting for verification... Cleaning up challenges IMPORTANT NOTES: - Congratulations! Your certificate and chain have been saved at: /etc/letsencrypt/live/<your.domain>/fullchain.pem Your key file has been saved at: /etc/letsencrypt/live/<your.domain>/privkey.pem Your cert will expire on 2019-08-01. To obtain a new or tweaked version of this certificate in the future, simply run certbot again. To non-interactively renew *all* of your certificates, run "certbot renew" - If you like Certbot, please consider supporting our work by: Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate Donating to EFF: https://eff.org/donate-le Done : )
