blob: f33a31ce205bbc9dc6b7ae65db826fc5c7203902 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
|
Requirements:
o This assume that acme-tiny is cloned to ~/acme-tiny
o Furthermore, that there is a ~/acme-challenge and that is aliased in apache:
| Alias "/.well-known/acme-challenge" "/srv/letsencrypt/acme-challenge"
o Also, we want an account key in ~:
(umask 277 && ! [ -e account.key ] && openssl genrsa 4096 > account.key)
o And you want the letsencrypt chain file letsencryptauthorityx1.pem
in ~/certs/extra
o Optionally, a dh file in ~/certs/extra/dh-4096.pem
openssl dhparam -out ~/certs/extra/dh-4096.pem 4096
o And you want this bin directory in PATH for your letsencrypt role user.
Usage:
o vhost-step-1 creates a new key, a new csr, and creates a .crt file
o After that, enable your new vhost
o vhost-step-2 then does the letsencrypt challenge stuff, and updates the .crt file
Continued maintenance:
o run renew-as-required from cron, probably using chronic.
|
