From 0da8acf8974c5d51fd84291091d1f7a1fd8c1176 Mon Sep 17 00:00:00 2001 From: Peter Palfrader Date: Thu, 31 Dec 2015 10:22:24 +0100 Subject: letsencrypt-helpers --- letsencrypt-helpers/README | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) create mode 100644 letsencrypt-helpers/README (limited to 'letsencrypt-helpers/README') diff --git a/letsencrypt-helpers/README b/letsencrypt-helpers/README new file mode 100644 index 0000000..f33a31c --- /dev/null +++ b/letsencrypt-helpers/README @@ -0,0 +1,23 @@ + +Requirements: + +o This assume that acme-tiny is cloned to ~/acme-tiny +o Furthermore, that there is a ~/acme-challenge and that is aliased in apache: + | Alias "/.well-known/acme-challenge" "/srv/letsencrypt/acme-challenge" +o Also, we want an account key in ~: + (umask 277 && ! [ -e account.key ] && openssl genrsa 4096 > account.key) +o And you want the letsencrypt chain file letsencryptauthorityx1.pem + in ~/certs/extra +o Optionally, a dh file in ~/certs/extra/dh-4096.pem + openssl dhparam -out ~/certs/extra/dh-4096.pem 4096 +o And you want this bin directory in PATH for your letsencrypt role user. + + +Usage: + o vhost-step-1 creates a new key, a new csr, and creates a .crt file + o After that, enable your new vhost + o vhost-step-2 then does the letsencrypt challenge stuff, and updates the .crt file + +Continued maintenance: + o run renew-as-required from cron, probably using chronic. + -- cgit v1.2.3