I manage webservers for multiple domain and also need to renew certs for them. Those domain provided by different CA provider such go daddy,sectigo etc.
I am looking for solution to automate cert renew without manual interaction for these CA provider on webserver.
Do these CAs even provide ACME endpoints? What have you found yourself so far?
yes those CA provider does have Acme endpoints. However i am not sure how to integrate with cerbot to renew cert on my apache servers so that it auto renew once it is due for ssl renewal
Why are you using certbot rather than mod_md? Using the solution that's integrated with your web server seems like a cleaner course of action than using a third-party tool like certbot.
4 Likes
@danb35 , There is no support of mod_md for Apache traffic server ATS. hence need to explore option using certbot(acme). However i am still figuring out on how to integrate it with apache traffic server
like how may webserver apache foundation have? httpd, tomcat, traffic, what else?
think you'd have to use DNS challenge or config proxy to somewhere and use standalone challenge with --http-01-port option for certbot
I have more than 200 apache traffic server in active/backup mode. Also those has different CA provider such go daddy , sectigo, digi cert. So i was looking if i could renew cert on one active node at a time vi cert bots.
Do you have any use case where it is implemented.
backup node won't able to renew itself by http-01 challenge (because they currently doesn't host that website) what you do currently doing to renew certificate for those servers?
1 Like
Backup node also has same certs however traffic is going on active node currently. backup node will gets active when original active node fails.
Currently i am doing ssl cert renewal one at a time by manual copying certs on those ndoes.
I want to automate ssl renewal so that these nodes gets certs on its own.
What you do to get that certificate files?
For installing part I would just put cert in central place and node download it by cron script
Getting a cert is different can though