Certificate: Difference between revisions
Jump to navigation
Jump to search
No edit summary |
|||
| (5 intermediate revisions by the same user not shown) | |||
| Line 19: | Line 19: | ||
<syntaxhighlight lang="bash"> | <syntaxhighlight lang="bash"> | ||
_acme-challenge.objclt.ca. IN TXT "d2MbmqrvfiohoavRiquicUZZXCfKda5ApasdaafI" | _acme-challenge.objclt.ca. IN TXT "d2MbmqrvfiohoavRiquicUZZXCfKda5ApasdaafI" | ||
</syntaxhighlight> | |||
=== Inquiry external DNS server === | |||
<syntaxhighlight lang="bash"> | |||
dig -t txt _acme-challenge.objclt.ca. @ns6.gandi.net | |||
</syntaxhighlight> | </syntaxhighlight> | ||
| Line 44: | Line 49: | ||
</syntaxhighlight> | </syntaxhighlight> | ||
== Renew Certificate == | |||
<syntaxhighlight lang="bash"> | |||
certbot renew | |||
</syntaxhighlight> | |||
== Remove certificate == | |||
<syntaxhighlight lang="bash"> | |||
certbot revoke --cert-path /etc/letsencrypt/live/<certificate_name>/cert.pem | |||
certbot delete --cert-name <your_domain> | |||
</syntaxhighlight> | |||
== Tools to validate configuration | |||
** [https://www.ssllabs.com/ssltest/ ssltest] | |||
** [https://ssl-tools.net/mailservers ssl-tools] | ** [https://ssl-tools.net/mailservers ssl-tools] | ||
** [https://www.checktls.com CheckTls] | ** [https://www.checktls.com CheckTls] | ||
** [https://mxtoolbox.com/diagnostic.aspx MxToobox] | ** [https://mxtoolbox.com/diagnostic.aspx MxToobox] | ||
** [https://www.immuniweb.com/ssl/ ImmuniWeb] | ** [https://www.immuniweb.com/ssl/ ImmuniWeb] | ||
Latest revision as of 02:19, 20 January 2022
Install certbot
apt-get install certbot
Request a wildcard certificat
certbot certonly --manual --preferred-challenges=dns --email webmaster@objclt.ca --server https://acme-v02.api.letsencrypt.org/directory --agree-tos -d *.objclt.ca
Update your DNS
Please deploy a DNS TXT record under the name _acme-challenge.objclt.ca with the following value:
d2MbmqrvfiohoavRiquicUZZXCfKda5ApasdaafI (DO NOT USE THAT VALUE !!!)
Before continuing, verify the record is deployed.
_acme-challenge.objclt.ca. IN TXT "d2MbmqrvfiohoavRiquicUZZXCfKda5ApasdaafI"
Inquiry external DNS server
dig -t txt _acme-challenge.objclt.ca. @ns6.gandi.net
certificate generated
IMPORTANT NOTES:
- Congratulations! Your certificate and chain have been saved at:
/etc/letsencrypt/live/objclt.ca-0001/fullchain.pem
Your key file has been saved at:
/etc/letsencrypt/live/objclt.ca-0001/privkey.pem
Your cert will expire on 2020-01-10. To obtain a new or tweaked
version of this certificate in the future, simply run certbot
again. To non-interactively renew *all* of your certificates, run
"certbot renew"
- If you like Certbot, please consider supporting our work by:
Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate
Donating to EFF: https://eff.org/donate-le
Validate the certificate
openssl s_client -crlf -connect mail.objclt.ca:993
openssl s_client -connect mail.objclt.ca:[port] -servername mail.objclt.ca
Renew Certificate
certbot renew
Remove certificate
certbot revoke --cert-path /etc/letsencrypt/live/<certificate_name>/cert.pem
certbot delete --cert-name <your_domain>
== Tools to validate configuration