I ran the below command on CentOS Linux release 7.9.2009 (Core) to generate Let's Encrypt SSL certificate using DNS challenge. The Let's Encrypt SSL certificate got generated and is valid for 90 days.
certbot -d apihub.mydomain.io --manual --preferred-challenges dns certonly
Please advise me if the above approach is correct to renew the Let's Encrypt SSL certificate for the FQDN apihub.mydomain.io after 90 days? Any port number to be opened inbound and outbound in the firewall to renew the Let's Encrypt SSL certificate?
certbot renew won't work with certs obtained using the --manual flag--the renew command is for automatic renewal, and the --manual flag, by definition, requires manual intervention. Remaining points assume you come up with a way to automate this.
The syntax of the command is incorrect; if you wanted to stop nginx before obtaining the cert (which you shouldn't; see below), you're missing --pre-hook before the "service nginx stop".
As noted above, there's no reason to be stopping and starting nginx; that would only be necessary if you were using standalone (which wouldn't seem to make much--if any--sense if you're running nginx). Instead, run service nginx reload as a post-hook.
Is that the correctly typed domain name? I am ask since I do not see any issued certificates for that domain name spelling here: crt.sh | apihub.mydomain.io
Just want to make sure I have not created a typo.
I'm sure that mydomain.io is another placeholder domain from a yet another user who thinks that, despite what we say in the post template, we don't really need the true domain name.
@rg305 I am trying to invoke certbot using DNS challenge for a new domain. I am facing the below issue
# **certbot**
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Certbot doesn't know how to automatically configure the web server on this system. However, it can still get a certificate for you. Please run "certbot certonly" to do so. You'll need to manually configure your web server to use the resulting certificate.
# **certbot certonly**
Saving debug log to /var/log/letsencrypt/letsencrypt.log
How would you like to authenticate with the ACME CA?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
1: Obtain certificates using a DNS TXT record (if you are using BIND for DNS).
(dns-rfc2136)
2: Spin up a temporary webserver (standalone)
3: Place files in webroot directory (webroot)
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Select the appropriate number [1-3] then [enter] (press 'c' to cancel):
certbot -h
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
certbot [SUBCOMMAND] [options] [-d DOMAIN] [-d DOMAIN] ...
Certbot can obtain and install HTTPS/TLS/SSL certificates. By default,
it will attempt to use a webserver both for obtaining and installing the
certificate. The most common SUBCOMMANDS and flags are:
obtain, install, and renew certificates:
(default) run Obtain & install a certificate in your current webserver
certonly Obtain or renew a certificate, but do not install it
renew Renew all previously obtained certificates that are near
expiry
enhance Add security enhancements to your existing configuration
-d DOMAINS Comma-separated list of domains to obtain a certificate for
(the certbot apache plugin is not installed)
--standalone Run a standalone webserver for authentication
(the certbot nginx plugin is not installed)
--webroot Place files in a server's webroot folder for authentication
--manual Obtain certificates interactively, or using shell script
hooks
-n Run non-interactively
--test-cert Obtain a test certificate from a staging server
--dry-run Test "renew" or "certonly" without saving any certificates
to disk
manage certificates:
certificates Display information about certificates you have from Certbot
revoke Revoke a certificate (supply --cert-name or --cert-path)
delete Delete a certificate (supply --cert-name)
manage your account:
register Create an ACME account
unregister Deactivate an ACME account
update_account Update an ACME account
--agree-tos Agree to the ACME server's Subscriber Agreement
-m EMAIL Email address for important account notifications
More detailed help:
-h, --help [TOPIC] print this message, or detailed help on a topic;
the available TOPICS are:
all, automation, commands, paths, security, testing, or any of the
subcommands or plugins (certonly, renew, install, register, nginx,
apache, standalone, webroot, etc.)
-h all print a detailed help page including all topics
--version print the version number
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
#cat /etc/redhat-release
CentOS Linux release 7.9.2009 (Core)
I'm pretty sure GoDaddy doesn't use RFC2136 to update the DNS records.
From the beginning of this thread you've used the dns-01 challenge, but is that really necessary? No possibility for the way more easy (usually) http-01 challenge?
