Certificate: Difference between revisions
Jump to navigation
Jump to search
No edit summary |
No edit summary |
||
| (One intermediate revision by the same user not shown) | |||
| Line 19: | Line 19: | ||
<syntaxhighlight lang="bash"> | <syntaxhighlight lang="bash"> | ||
_acme-challenge.objclt.ca. IN TXT "d2MbmqrvfiohoavRiquicUZZXCfKda5ApasdaafI" | _acme-challenge.objclt.ca. IN TXT "d2MbmqrvfiohoavRiquicUZZXCfKda5ApasdaafI" | ||
</syntaxhighlight> | |||
=== Inquiry external DNS server === | |||
<syntaxhighlight lang="bash"> | |||
dig -t txt _acme-challenge.objclt.ca. @ns6.gandi.net | |||
</syntaxhighlight> | </syntaxhighlight> | ||
| Line 53: | Line 58: | ||
<syntaxhighlight lang="bash"> | <syntaxhighlight lang="bash"> | ||
certbot revoke --cert-path /etc/letsencrypt/live/<certificate_name>/cert.pem | certbot revoke --cert-path /etc/letsencrypt/live/<certificate_name>/cert.pem | ||
certbot | certbot delete --cert-name <your_domain> | ||
</syntaxhighlight> | </syntaxhighlight> | ||
Latest revision as of 02:19, 20 January 2022
Install certbot
apt-get install certbot
Request a wildcard certificat
certbot certonly --manual --preferred-challenges=dns --email webmaster@objclt.ca --server https://acme-v02.api.letsencrypt.org/directory --agree-tos -d *.objclt.ca
Update your DNS
Please deploy a DNS TXT record under the name _acme-challenge.objclt.ca with the following value:
d2MbmqrvfiohoavRiquicUZZXCfKda5ApasdaafI (DO NOT USE THAT VALUE !!!)
Before continuing, verify the record is deployed.
_acme-challenge.objclt.ca. IN TXT "d2MbmqrvfiohoavRiquicUZZXCfKda5ApasdaafI"
Inquiry external DNS server
dig -t txt _acme-challenge.objclt.ca. @ns6.gandi.net
certificate generated
IMPORTANT NOTES:
- Congratulations! Your certificate and chain have been saved at:
/etc/letsencrypt/live/objclt.ca-0001/fullchain.pem
Your key file has been saved at:
/etc/letsencrypt/live/objclt.ca-0001/privkey.pem
Your cert will expire on 2020-01-10. To obtain a new or tweaked
version of this certificate in the future, simply run certbot
again. To non-interactively renew *all* of your certificates, run
"certbot renew"
- If you like Certbot, please consider supporting our work by:
Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate
Donating to EFF: https://eff.org/donate-le
Validate the certificate
openssl s_client -crlf -connect mail.objclt.ca:993
openssl s_client -connect mail.objclt.ca:[port] -servername mail.objclt.ca
Renew Certificate
certbot renew
Remove certificate
certbot revoke --cert-path /etc/letsencrypt/live/<certificate_name>/cert.pem
certbot delete --cert-name <your_domain>
== Tools to validate configuration