Project LetsEncrypt: Difference between revisions
No edit summary |
|||
Line 89: | Line 89: | ||
#!/bin/bash | #!/bin/bash | ||
# parameters | # parameters | ||
CERT_SRC="/etc/letsencrypt/live/banzhaf.chickenkiller.com" | CERT_SRC="/etc/letsencrypt/live/banzhaf.chickenkiller.com" | ||
Line 96: | Line 96: | ||
SSH_ID="/etc/letsencrypt/id_rsa.letsencrypt" | SSH_ID="/etc/letsencrypt/id_rsa.letsencrypt" | ||
HOSTS="ax1 ax2" | HOSTS="ax1 ax2" | ||
cd "$CERT_SRC" | cd "$CERT_SRC" | ||
for h in $HOSTS; do | for h in $HOSTS; do |
Revision as of 08:10, 7 August 2022
Let's Encrypt
Today I replaced my self signed certs of my dyndns domain with official ones from [Let’s Encrypt]:
Request First Cert
ssh root@job4 cd /usr/local/bin sudo wget https://dl.eff.org/certbot-auto sudo certbot-auto --apache
Apache Config Preparation
At first, this did not work. The script needs a vhost for port 80, so I created one:
/etc/apache2/vhosts.d/vhost-chickenkiller.conf:
<VirtualHost *:80> ServerAdmin joachim.banzhaf@gmail.com ServerName banzhaf.chickenkiller.com ServerAlias banzhaf.chickenkiller.com DocumentRoot /srv/www/htdocs ErrorLog /var/log/apache2/error.log CustomLog /var/log/apache2/access.log combined </VirtualHost>
Then it complained about syntax errors in my apache config that I needed to fix (quotes not closed). Finally the validation failed due to access errors. I had to remove all old style access control and use the new apache 2.4 style, which was more straightforward than I expected:
- remove all "Order deny/allow" stuff that was not ifdefd
- replace all "Allow/Deny from all" by "Require all granted/denied" if not ifdefd
- replace all "Allow from ip/hostname/net" by "Require host ip/hostname/net"
- remove module access_compat from /etc/sysconfig/apache2 variable APACHE_MODULES
- systemctl restart apache2
The script offered to configure forwarding http to https, which I accepted. I think it just added these lines to the virtual host file above:
RewriteEngine on RewriteCond %{SERVER_NAME} =banzhaf.chickenkiller.com RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]
Now the cert was used and validated as safe (although chromium needed some time to accept it)
Automation
The cert is only valid for 90 days. Better automate the renewal. It is enough to create this script
/etc/cron.daily/certbot-auto-renew
#!/bin/sh python -c 'import random; import time; time.sleep(random.random() * 3600)' && /usr/local/bin/certbot-auto renew
No idea why python came into the game. This should work as well...
#!/bin/bash sleep $((RANDOM/9)) && /usr/local/bin/certbot-auto renew
Fritz Box Cert
Automatic Update
This script logs into the fritzbox and updates the cert for you. Just edit the variables at the start (user, pass, certpath). I use a separate fritzbox user for this.
To make it even more easy: Store this script in /etc/letsencrypt/renewal-hooks/post and it gets run on updates (I'll see if that works in 2 months)
Manual Update
To use the cert with the fritz box web interface
ssh root@job4 'cat /etc/letsencrypt/live/banzhaf.chickenkiller.com/[pf]*.pem' >fritz.pem
Then upload this file in the fritz box cert store with the web interface (Internet/Freigaben/Fritzbox Dienste/)
OpenWRT
Manual Setup
copy cert (cat crt+key in one pem) to /etc/letsencrypt by post hook script
uci set nginx._lan.ssl_certificate=/etc/letsencrypt/banzhaf.chickenkiller.com.pem uci set nginx._lan.ssl_certificate_key=/etc/letsencrypt/banzhaf.chickenkiller.com.pem uci set nginx._lan.uci_manage_ssl='my_letsencrypt'
Automatic Renewal
put this in /etc/letsencrypt/renewal-hooks/post (create the id_rsa.letsencrypt ssh key and deploy it to openwrt router /etc/letsencrypt/)
#!/bin/bash # parameters CERT_SRC="/etc/letsencrypt/live/banzhaf.chickenkiller.com" CERT_DST="/etc/letsencrypt" CERT_FILE="banzhaf.chickenkiller.com.pem" SSH_ID="/etc/letsencrypt/id_rsa.letsencrypt" HOSTS="ax1 ax2" cd "$CERT_SRC" for h in $HOSTS; do
cat fullchain.pem privkey.pem | ssh -i "$SSH_ID" root@$h "mkdir -p '$CERT_DST' && cat >'$CERT_DST/$CERT_FILE' && /etc/init.d/uhttpd restart"
done
Grafana
just needs a restart by putting this to /etc/letsencrypt/renewal-hooks/post
#!/bin/bash systemctl restart grafana-server.service
Mosquitto Broker
put this script in /etc/letsencrypt/renewal-hooks/post
MY_DOMAIN=banzhaf.chickenkiller.com CERTIFICATE_DIR=/etc/mosquitto/certs
if [ "${RENEWED_DOMAINS}" = "${MY_DOMAIN}" ]; then
# Copy new certificate to Mosquitto directory cp ${RENEWED_LINEAGE}/fullchain.pem ${CERTIFICATE_DIR}/server.pem cp ${RENEWED_LINEAGE}/privkey.pem ${CERTIFICATE_DIR}/server.key
# Set ownership to Mosquitto chown mosquitto: ${CERTIFICATE_DIR}/server.pem ${CERTIFICATE_DIR}/server.key
# Ensure permissions are restrictive chmod 0600 ${CERTIFICATE_DIR}/server.pem ${CERTIFICATE_DIR}/server.key
# Tell Mosquitto to reload certificates and configuration pkill -HUP -x mosquitto
fi