letsencrypt

a command line utility for managing letsencrypt ssl certificates.

depends

ruby >= 2.4

install

gem install blix-letsencrypt

command options:

Usage: letsencrypt [options]

-c, --create                     Create ACME private key
-k, --key=FILE                   ACME private key file
-e, --email=EMAIL                your contact email
-d, --domain=DOMAIN              domain name for certificate
    --challenge_dir=CDIR         challenge file directory
    --ssl_dir=SSLDIR             ssl certificate file directory
    --ssl_key=SSLKEY             ssl private key file
-t, --test                       enable test mode
    --force                      force update even if not expired
-l, --logfile=LOGFILE            log to file
-h, --hook=HOOK                  script to run on renewal

conventions used

• the private key is called privkey.pem

• the certificate is called cert.pem and is placed in a directory named after the main (first) domain name.

create letsencrypt certificates

• create directory to hold your keys and certificates .. eg:

  mkdir /etc/letsencrypt/account
  mkdir /etc/letsencrypt/ssl
  

• create directory to serve challenges from.. eg:

  mkdir /srv/certbot/.well-known
  

• create a ssl private key if you do not yet have one.. eg:

  openssl genrsa -out /etc/letsencrypt/ssl/privkey.pem 2048
  

• update your webserver to serve the challengefiles eg for nginx..:

  location /.well-known {
   alias /srv/certbot/.well-known;
   add_header "Content-Type" "text/plain";
   break;
  }
  

• now create your certificate

  letsencrypt --key=/etc/letsencrypt/account/key.pem -d"example.com www.example.com" --challenge_dir="/srv/certbot/.well-known" --ssl_dir="/etc/letsencrypt/ssl" --create
  

• hopefully your certificate has be created so update your webserver to use it...

  ssl_certificate /etc/letsencrypt/ssl/example.com/cert.pem;
  ssl_certificate_key /etc/letsencrypt/ssl/privkey.pem;
  

• reload the webserver and check all is well.

auto renew letsencrypt certificates

the letsencrypt certificates are valid for 90 days. it is recommended that you run a script every day to check if the certificates are due for renewal.

• create two shell scrips, one to renew the certificates and another to restart the webserver.

• ensure that both scripts are executable..

• copy the first script to /etc/cron.daily directory.

• link the second script to the --hook option of the letsencrypt command.

eg:

cat /etc/cron.daily/renew_ssl

#!/bin/sh
/opt/ruby-2.6.4/bin/letsencrypt --key=/etc/letsencrypt/account/key.pem \
-d"example.com www.example.com" \
--challenge_dir="/srv/certbot/.well-known" --ssl_dir="/etc/letsencrypt/ssl" \
--logfile=/var/log/letsencrypt.log \
--hook=/root/bin/reload_nginx


cat /root/bin/reload_nginx

#!/bin/sh
/sbin/nginx -t && /sbin/nginx -sreload