Thought I renewed correctly through dns. Still shows as expired

Help
61

@eddwinn

sudo certbot run --cert-name tipvote -a manual --preferred-challenges dns -d "tipvote.com,www.tipvote.com" -i nginx

62

will this mess with my current certification or number of trials i noticed not dry run

63

@griffin You don't need DNS for this.

@eddwinn Perhaps I missed it, but what's the exact setup? I assume there's a load balancer in front of your three VMs?

64

It's a DO load balancer

with three independent ACME accounts on 3 vms

I already gave him a reference to the DO doc

65

How does that work? 

66

@Osiris

67

Yeah, was just reading it.. Would it that hard to let DO set up the SSL termination?:

To configure SSL termination, you need to add an SSL termination rule and choose or create an SSL certificate to use.

If you added your domain to DigitalOcean, you can use our Let's Encrypt integration to create a fully managed SSL certificate.

Would be ideal I think.

68

@eddwinn

Osiris has been doing this longer than me and has much more experience, so I'm curious as to how he might do this. I have a solid plan for now, but it's probably more intensive than might need be.

69

Ok I let the masters teach me there ways

70

I agree. He's got a few messy things with certbot, but maybe that can be avoided entirely by having DO take over the process.

71

I didnt even think of letting DO do it i see the option to add it there now

72
  • Every VM gets its own hostname
  • Select one VM as distinct "ACME-VM"
  • Have every non-ACME-VM redirect requests for /.well-known/acme-challenge/ to the hostname of the ACME-VM
  • Note: you might want to have a distinct hostname such as acme-server.example.com pointing to the distinct ACME-VM and use that for the redirect
  • Run the ACME client (such as certbot) on the ACME-VM
  • Get one certificate for all VMs
  • Script a redistribution script so after every renewal the certificate (and private key if --reuse-key isn't used) is (securely if private keys are involved) distributed among the VMs
  • Script something on the VMs which will detect the availability of a new certificate, so it can install it and reload the webserver
73

If you go the SSL termination at LB route, you need to be careful of your backend traffic being unencrypted. It also puts the TLS burden on the LB.

74

That was mostly what I had in mind. With some added cleanup steps for the existing certificates and debris.

The DO route might make it much easier though.

75

But the above can be done without DNS challenges :slight_smile:

76

them steps are the steps to achieving a better future ssl Osiris?

77

True. Wasn't sure if @eddwinn could (or wanted to) individually expose each vm though. With that done, life becomes very easy. I considered the acme-dns route in the opposite case.

78

@eddwinn

You've already got potential subdomain names for your vms of course:

d01.tipvote.com ...

79

It's just one way of handeling multiple end-points behind a single hostname. There isn't really a golden standard here. But now you've got three VMs.. So you could get 1 cert per VM in theory, no problems there. But what if you had six VMs? In that case you can't get 6 certs because of the rate limit of max 5 certs per week.

Further more, if you can limit the amount of certificates issued, I think you should try. And there's not really a good reason for every VM to have its own certificate. That just stresses the loads on the Let's Encrypt servers (HSM to be exact). And frankly.. Free certificates for all. It's FREE. So please, do everyone a favor and be nice to the servers and HSMs of Let's Encrypt. They deserve our niceness. :wink:

I'm not even sure if it's possible with DO. I have absolutely zero experience with it..

80

Osiris this might sound like a better route then.