summaryrefslogtreecommitdiff
path: root/letsencrypt-helpers/README
blob: 6909fcf175a317c7d8155531d544a023ad445432 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
Requirements:

o This assumes that acme-tiny is cloned to ~/acme-tiny
o Furthermore, that there is a ~/acme-challenge and that is aliased in apache:
 | Alias "/.well-known/acme-challenge" "/srv/letsencrypt/acme-challenge"
o Also, we want an account key in ~:
  (umask 277 && ! [ -e account.key ] && openssl genrsa 4096 > account.key)
o Optionally, a dh file in ~/certs/extra/dh-4096.pem
  openssl dhparam -out ~/certs/extra/dh-4096.pem 4096
o And you want this bin directory in PATH for your letsencrypt role user.


Usage:
  o vhost-step-1 creates a new key, a new csr, and creates a .crt file
  o After that, enable your new vhost
  o vhost-step-2 then does the letsencrypt challenge stuff, and updates the .crt file

Continued maintenance:
  o run renew-as-required from cron, probably using chronic.
      SHELL=/bin/bash
      @daily sleep $(( $RANDOM \% 7200 )) && export PATH="$HOME/bin:$PATH" && renew-as-required

-- Peter Palfrader, January 2016