Project LetsEncrypt - Revision history

Joachim: /* Install */

2025-06-01T05:39:34Z

Install

← Older revision		Revision as of 05:39, 1 June 2025
Line 13:		Line 13:
	also install renewal scripts for fritzbox, openwrt, qnap, grafana (see post hooks below, but except apache and fritzbox, direct external access is not usually enabled/used)		also install renewal scripts for fritzbox, openwrt, qnap, grafana (see post hooks below, but except apache and fritzbox, direct external access is not usually enabled/used)

	~~maybe~~ also needed: python311-certbot-apache		also needed: python311-certbot-apache

	=== Configuration ===		=== Configuration ===

Joachim: /* Manual Setup */

2024-09-12T13:50:48Z

Manual Setup

← Older revision		Revision as of 13:50, 12 September 2024
Line 123:		Line 123:
	=== Manual Setup ===		=== Manual Setup ===
	copy cert (cat crt+key in one pem) to /etc/letsencrypt by post hook script		copy cert (cat crt+key in one pem) to /etc/letsencrypt by post hook script

			add host to HOSTS in job4:/etc/letsencrypt/renewal-hooks/post/openwrt-cert-update.sh

	==== nginx ====		==== nginx ====

Joachim: /* Manual Setup */

2024-09-11T16:14:22Z

Manual Setup

← Older revision		Revision as of 16:14, 11 September 2024
Line 124:		Line 124:
	copy cert (cat crt+key in one pem) to /etc/letsencrypt by post hook script		copy cert (cat crt+key in one pem) to /etc/letsencrypt by post hook script

			==== nginx ====
	uci set nginx._lan.ssl_certificate=/etc/letsencrypt/banzhaf.chickenkiller.com.pem		uci set nginx._lan.ssl_certificate=/etc/letsencrypt/banzhaf.chickenkiller.com.pem
	uci set nginx._lan.ssl_certificate_key=/etc/letsencrypt/banzhaf.chickenkiller.com.pem		uci set nginx._lan.ssl_certificate_key=/etc/letsencrypt/banzhaf.chickenkiller.com.pem
	uci set nginx._lan.uci_manage_ssl='my_letsencrypt'		uci set nginx._lan.uci_manage_ssl='my_letsencrypt'

			==== uhttp (default) ====
			uci set uhttpd.main.key='/etc/letsencrypt/banzhaf.chickenkiller.com.pem'
			uci set uhttpd.main.cert='/etc/letsencrypt/banzhaf.chickenkiller.com.pem'

	=== Automatic Renewal ===		=== Automatic Renewal ===

Joachim: /* Install */

2023-11-03T10:08:53Z

Install

← Older revision		Revision as of 10:08, 3 November 2023
Line 11:		Line 11:
	sudo systemctl start certbot-renew.timer		sudo systemctl start certbot-renew.timer

	also install renewal scripts for fritzbox, openwrt, qnap, grafana (see post hooks below, ~~mosquitto~~ not ~~really~~ used)		also install renewal scripts for fritzbox, openwrt, qnap, grafana (see post hooks below, but except apache and fritzbox, direct external access is not usually enabled/used)

	maybe also needed: python311-certbot-apache		maybe also needed: python311-certbot-apache

Joachim: /* Configuration */

2023-11-03T10:06:20Z

Configuration

← Older revision		Revision as of 10:06, 3 November 2023
Line 23:		Line 23:
	-rwxr-xr-x 1 root root 53 Aug 7 2022 grafana-restart.sh		-rwxr-xr-x 1 root root 53 Aug 7 2022 grafana-restart.sh
	lrwxrwxrwx 1 root root 34 Oct 15 2022 qnap-cert-update.sh -> /usr/local/bin/qnap-cert-update.sh		lrwxrwxrwx 1 root root 34 Oct 15 2022 qnap-cert-update.sh -> /usr/local/bin/qnap-cert-update.sh

			* qnap needs /etc/letsencrypt/id_rsa.letsencrypt.pub in qnap:~admin/.ssh/authorized_keys

	=== Check ===		=== Check ===

Joachim: /* Let's Encrypt */

2023-11-03T09:32:36Z

Let's Encrypt

← Older revision		Revision as of 09:32, 3 November 2023
Line 3:		Line 3:
	I replaced my self signed certs of my dyndns domain with official ones from [[https://letsencrypt.org/ Let’s Encrypt]]:		I replaced my self signed certs of my dyndns domain with official ones from [[https://letsencrypt.org/ Let’s Encrypt]]:

	== Current Process		== Current Process ==

	=== Install		=== Install ===

	sudo zypper in certbot-systemd-timer		sudo zypper in certbot-systemd-timer
Line 15:		Line 15:
	maybe also needed: python311-certbot-apache		maybe also needed: python311-certbot-apache

	=== Configuration		=== Configuration ===

	/etc/letsencrypt/renewal-hooks/post:		/etc/letsencrypt/renewal-hooks/post:
Line 24:		Line 24:
	lrwxrwxrwx 1 root root 34 Oct 15 2022 qnap-cert-update.sh -> /usr/local/bin/qnap-cert-update.sh		lrwxrwxrwx 1 root root 34 Oct 15 2022 qnap-cert-update.sh -> /usr/local/bin/qnap-cert-update.sh

	=== Check		=== Check ===

	note: starting the service (directly or via timer) uses a random delay of several minutes		note: starting the service (directly or via timer) uses a random delay of several minutes

	==== Date of cert files		==== Date of cert files ====
	/etc/letsencrypt/live/banzhaf.chickenkiller.com:		/etc/letsencrypt/live/banzhaf.chickenkiller.com:
	-rw-r--r-- 1 root root 682 Aug 4 2018 README		-rw-r--r-- 1 root root 682 Aug 4 2018 README
Line 36:		Line 36:
	lrwxrwxrwx 1 root root 50 Aug 12 11:13 cert.pem -> ../../archive/banzhaf.chickenkiller.com/cert30.pem		lrwxrwxrwx 1 root root 50 Aug 12 11:13 cert.pem -> ../../archive/banzhaf.chickenkiller.com/cert30.pem

	==== Systemd status		==== Systemd status ====

	systemctl status certbot-renew.timer		systemctl status certbot-renew.timer

	==== Journal		==== Journal ====

	journalctl -u certbot-renew.service		journalctl -u certbot-renew.service

Joachim: /* Let's Encrypt */

2023-11-03T09:31:48Z

Let's Encrypt

@@ Line 1: / Line 1: @@
 = Let's Encrypt =
-Today I replaced my self signed certs of my dyndns domain with official ones from [[https://letsencrypt.org/ Let’s Encrypt]]:
+I replaced my self signed certs of my dyndns domain with official ones from [[https://letsencrypt.org/ Let’s Encrypt]]:
 == Request First Cert ==

Joachim: /* Grafana */

2022-08-07T08:14:13Z

Grafana

← Older revision		Revision as of 08:14, 7 August 2022
Line 104:		Line 104:
	== Grafana ==		== Grafana ==

	just needs a restart by putting this to /etc/letsencrypt/renewal-hooks/post		put this into /etc/grafana/grafana.ini

			# https certs & key file
			cert_file = /etc/letsencrypt/live/banzhaf.chickenkiller.com/fullchain.pem
			cert_key = /etc/letsencrypt/live/banzhaf.chickenkiller.com/privkey.pem


			then it just needs a restart on cert renewal by putting this to /etc/letsencrypt/renewal-hooks/post

	#!/bin/bash		#!/bin/bash

Joachim: /* Mosquitto Broker */

2022-08-07T08:11:57Z

Mosquitto Broker

← Older revision		Revision as of 08:11, 7 August 2022
Line 117:		Line 117:

	if [ "${RENEWED_DOMAINS}" = "${MY_DOMAIN}" ]; then		if [ "${RENEWED_DOMAINS}" = "${MY_DOMAIN}" ]; then
	# Copy new certificate to Mosquitto directory		# Copy new certificate to Mosquitto directory
	cp ${RENEWED_LINEAGE}/fullchain.pem ${CERTIFICATE_DIR}/server.pem		cp ${RENEWED_LINEAGE}/fullchain.pem ${CERTIFICATE_DIR}/server.pem
	cp ${RENEWED_LINEAGE}/privkey.pem ${CERTIFICATE_DIR}/server.key		cp ${RENEWED_LINEAGE}/privkey.pem ${CERTIFICATE_DIR}/server.key

	# Set ownership to Mosquitto		# Set ownership to Mosquitto
	chown mosquitto: ${CERTIFICATE_DIR}/server.pem ${CERTIFICATE_DIR}/server.key		chown mosquitto: ${CERTIFICATE_DIR}/server.pem ${CERTIFICATE_DIR}/server.key

	# Ensure permissions are restrictive		# Ensure permissions are restrictive
	chmod 0600 ${CERTIFICATE_DIR}/server.pem ${CERTIFICATE_DIR}/server.key		chmod 0600 ${CERTIFICATE_DIR}/server.pem ${CERTIFICATE_DIR}/server.key

	# Tell Mosquitto to reload certificates and configuration		# Tell Mosquitto to reload certificates and configuration
	pkill -HUP -x mosquitto		pkill -HUP -x mosquitto
	fi		fi

Joachim: /* Mosquitto Broker */

2022-08-07T08:11:30Z

Mosquitto Broker

← Older revision		Revision as of 08:11, 7 August 2022
Line 115:		Line 115:
	MY_DOMAIN=banzhaf.chickenkiller.com		MY_DOMAIN=banzhaf.chickenkiller.com
	CERTIFICATE_DIR=/etc/mosquitto/certs		CERTIFICATE_DIR=/etc/mosquitto/certs

	if [ "${RENEWED_DOMAINS}" = "${MY_DOMAIN}" ]; then		if [ "${RENEWED_DOMAINS}" = "${MY_DOMAIN}" ]; then
	# Copy new certificate to Mosquitto directory		# Copy new certificate to Mosquitto directory
	cp ${RENEWED_LINEAGE}/fullchain.pem ${CERTIFICATE_DIR}/server.pem		cp ${RENEWED_LINEAGE}/fullchain.pem ${CERTIFICATE_DIR}/server.pem
	cp ${RENEWED_LINEAGE}/privkey.pem ${CERTIFICATE_DIR}/server.key		cp ${RENEWED_LINEAGE}/privkey.pem ${CERTIFICATE_DIR}/server.key

	# Set ownership to Mosquitto		# Set ownership to Mosquitto
	chown mosquitto: ${CERTIFICATE_DIR}/server.pem ${CERTIFICATE_DIR}/server.key		chown mosquitto: ${CERTIFICATE_DIR}/server.pem ${CERTIFICATE_DIR}/server.key

	# Ensure permissions are restrictive		# Ensure permissions are restrictive
	chmod 0600 ${CERTIFICATE_DIR}/server.pem ${CERTIFICATE_DIR}/server.key		chmod 0600 ${CERTIFICATE_DIR}/server.pem ${CERTIFICATE_DIR}/server.key

	# Tell Mosquitto to reload certificates and configuration		# Tell Mosquitto to reload certificates and configuration
	pkill -HUP -x mosquitto		pkill -HUP -x mosquitto
	fi		fi