After playing with the letsencrypt client, I found a nice way to automate certificates generation and renewal. I am using nginx here, but any webserver can work. This method does not involve any proxying to the letsencrypt command or automated nginx config modification, so it is quite safe. Latest …

thanks for that, i also did something similar for webroot authentication as it's only way to get multi-domain SAN ssl certificates via webroot https://community.centminmod.com/posts/20018/ [image] renchap: You can also get a duplicate certificate by using the same command again, with a --duplic…

A duplicate allows you to use use a different private key, and be able to revoke this specific key if needed. A common use-case is to provide a duplicate to an external party / server that handles one of your domains (sub-domains usually with a wildcard), or if you need to use your certificate in d…

nice didn’t know you could do that with letsencrypt client, so you duplicate ssl certificate for CDN https custom SSL usage :slight_smile: oh will duplicate rewrite that symlink to live domain ssl ? or it gets it’s own symlink separate files ?

Yes, this would be a valid use-case. So you can revoke your CDN cert if they get breached, and not the other certificates you use for this domain. A duplicate creates a brand new certificate, named for example “example.net-0001” and not example.net

thanks @renchap for clarification :slight_smile:

Renaud, you mention that we need to have the cli tool installed. Is this what you get when you clone into the GitHub repo? letsencrypt-auto??

I am using FreeBSD, so I only needed to run pkg install py27-letsencrypt Here is an (untested by me) repository with install scripts for various systems : https://github.com/kennwhite/install-letsencrypt

Thank you for all the help Renaud, I did end up being successful using the standalone installation. I prefer this for the time being until it’s automated. I did post details on the my original post, if it can help others. Once again thank you!

to make this a complete guide I would like to add how you could setup your https server as well: server { listen 443 ssl; root /var/www/yourpath; index index.php index.html index.htm; # Make site accessible from http://localhost/ server_name yourdomain.com …

see also https://github.com/letsencrypt/letsencrypt/issues/1566 to fully automate command

Howto: easy cert generation and renewal with nginx

Server

eva2000 November 10, 2015, 4:59pm 6

thanks @renchap for clarification

NGINX Installation

Topic		Replies	Views
Lets Encrypt Certificates Help	12	1148	April 28, 2021
NGINX Installation Server	12	22149	January 5, 2016
Nginx auto renewal Server	13	41715	April 25, 2017
Auto Renewal with Nginx without downtime Server	6	6612	December 29, 2015
Renew a cert with webroot plugin which was generated with standalone plugin Help	14	12928	October 5, 2018

Howto: easy cert generation and renewal with nginx

Related topics