Hi friends, On a VPS (debian Jessie) where I would set up Postfix, Dovecot and Apache2, in order to fully automate the certificate creation process, I would like to pass to certbot myself generated 4096 bit csr and private key, Is it a practice recommended or overcomed by certbot, and/or this sto…

certbot doesn’t need the private key. And you can use the --csr option to feed it your CSR (which is signed with your private key, hence certbot/Boulder doesn’t need the latter). There are some quirks with using --csr, such as it just puts the certificate and chain in the current folder certbot is …

[image] danjde: in order to fully automate the certificate creation process Hi @danjde . Can you elaborate a little bit on what aspects of the certificate you are trying to customize for automation by creating the private key & CSR yourself? Supporting automation is definitely one of the goal…

[image] cpu: Hi @danjde . Can you elaborate a little bit on what aspects of the certificate you are trying to customize for automation by creating the private key & CSR yourself? Yes, you're absolutely right! :slight_smile: I was planning to use the certificate for these reasons: I would li…

I’m actually not quite sure if there’s any reason to use an explicit seperate CSR for the four reasons you’re giving :slight_smile: certbot would be able to do everything you need by itself.

[image] Osiris: I'm actually not quite sure if there's any reason to use an explicit seperate CSR for the four reasons [...] Well Osiris! But then when I should use "--csr" option? And secondly to include the FQDN just use the "-d" option? Thanks again for your dear help!

[image] danjde: But then when I should use "--csr" option? About "--csr" option I found this very clear explanation :wink: Thanks!

The --csr option is useful when the TLS service that the certificate is intended for has DANE TLSA records. This is most common with SMTP for now. See: [image] Please avoid "3 0 1" and "3 0 2" DANE TLSA records with LE certificates Server E… [image] N…

P.S. Among DANE TLSA SMTP servers there are at least ~800 distinct LE-issued certificates (my survey cannot achieve 100% coverage). These are MX hosts for at least ~2400 Email domains. These ~800 certificates are of course a very small fraction of the overall LE certificate count, but do constitut…

[image] ietf-dane: The --csr option is useful when the TLS service that the certificate is intended for has DANE TLSA records. ...it opens up a world! :slight_smile: Very very interesting! Now I have finally clarified what is the "--csr" option! And for the moment seems not my case! I'm d…

Certbot using csr and private key Apache and Postfix/Dovecot

Server

danjde September 11, 2016, 8:31pm 7

About "--csr" option I found this very clear explanation

Thanks!

Topic		Replies	Views
Use existing private key? Server	17	7251	May 23, 2018
Using certbot with --csr Help	3	12762	July 1, 2016
Is the private key generated by certbot? Help	5	1299	July 12, 2023
New "certbot" client and ``--csr`` option? Help	3	14050	June 13, 2016
How to use existing private key with certbot? Help	9	7997	July 15, 2016

Certbot using csr and private key Apache and Postfix/Dovecot

Related topics