procedures:certificates
Differences
This shows you the differences between two versions of the page.
| Next revision | Previous revision | ||
| procedures:certificates [2024/03/14 16:55] – created sysadm | procedures:certificates [2026/04/09 13:42] (current) – Cleanup sysadm | ||
|---|---|---|---|
| Line 1: | Line 1: | ||
| - | ====== SSL certs renewal | + | ====== SSL certs renewal ====== |
| === FIRST THING === | === FIRST THING === | ||
| - | **BACKUP THE EXISTENT CERTS** | + | To install certbot |
| - | In case anything goes wrong, you will reuse the old certs. | + | < |
| - | + | yum install -y python3-certbot python3-certbot-nginx | |
| - | \\ | + | </ |
| - | \\ | + | |
| - | To install certbot: | + | To install certbot |
| < | < | ||
| - | yum install -y certbot-nginx | + | apt install -y python3-certbot python3-certbot-nginx |
| </ | </ | ||
| \\ | \\ | ||
| - | === Istances that need certs for operation | + | ==== No acme-challenge ==== |
| + | |||
| + | === Istances that need certs to be renewed manually | ||
| - | * Frankfurt | + | |
| - | - Prod5_Core1 | + | |
| - | - Prod5_Core2 | + | |
| - | - BeCloud5x | + | |
| - | - Monitor | + | |
| - | - Support | + | |
| - | - Be360(s) | + | |
| (There are shared Outlook calendars for all expiring certs) | (There are shared Outlook calendars for all expiring certs) | ||
| Line 30: | Line 26: | ||
| \\ | \\ | ||
| - | === Commands === | + | ==== Commands |
| - | \\ | + | |
| - | ==== Certbot | + | === BeIncontact |
| < | < | ||
| - | certbot certonly --nginx | + | sudo certbot-3 certonly --nginx |
| </ | </ | ||
| \\ | \\ | ||
| - | ==== Certbot clusters | + | === Certbot clusters === |
| - | For clusters, you need to run the command on **both** istances, but first you have to modify the " | + | For clusters, you need to run the command on **both** |
| - | Login to [AWS DNS](https:// | + | Login to [[https:// |
| | | ||
| Clusters have shared domain between two machines (for example, Prod5_Core1 and Prod5_Core2 are both pointed by | Clusters have shared domain between two machines (for example, Prod5_Core1 and Prod5_Core2 are both pointed by | ||
| Line 52: | Line 48: | ||
| the weight and repeat the process for the second server. | the weight and repeat the process for the second server. | ||
| < | < | ||
| - | certbot certonly --nginx -d **domain** | + | sudo certbot-3 certonly --nginx -d **domain**,**domain**,*etc* |
| </ | </ | ||
| + | Copy-paste domains Core1: | ||
| + | < | ||
| + | sudo certbot-3 certonly --nginx -d core1.beincontact.becloudsolutions.com, | ||
| + | </ | ||
| + | |||
| + | Copy-paste domains Core2: | ||
| + | < | ||
| + | sudo certbot-3 certonly --nginx -d core2.beincontact.becloudsolutions.com, | ||
| + | </ | ||
| + | |||
| + | \\ | ||
| \\ | \\ | ||
| - | ==== Certbot not installed | + | |
| + | ==== Acme-challenge | ||
| + | |||
| + | === Istances that need certs for operation === | ||
| + | |||
| + | * Prod5_Core1/ | ||
| + | |||
| + | (There are shared Outlook calendars for all expiring certs) | ||
| + | |||
| + | \\ | ||
| + | |||
| + | ==== Commands ==== | ||
| + | |||
| + | === Acme-challenges clusters === | ||
| + | |||
| + | For clusters, you need to run the command on **both** " | ||
| + | Login to [[https:// | ||
| + | |||
| + | Clusters have shared domain between two machines (for example, Prod5_Core1 and Prod5_Core2 are both pointed by | ||
| + | *beincontact.becloudsolutions.com*), | ||
| + | click "Edit record", | ||
| + | |||
| + | You have to do this for the machine where you are **not** trying to renew the certificates (for example, you want to renew | ||
| + | Prod5_Core1, | ||
| + | the weight and repeat the process for the second server. | ||
| + | |||
| + | Follow the instructions on screen and replace old entries in the DNS, make a copy of the old values in case you need to use the old certs. Do **not** create multiple records for one domain, even if certbot tell you to do it, you can't in AWS. | ||
| + | Be aware that you have to deploy all domains before terminating the script (it will warn you when it's almost done), Certbot check for deployment only in the end, not every time it ask you to deploy a domain. | ||
| < | < | ||
| - | ./certbot-auto certonly --nginx | + | certbot certonly --manual --preferred-challenges dns --key-type rsa -d **domain**, |
| </ | </ | ||
| - | (if you don't find the script you can locate it with '' | ||
| + | Copy-paste domains: | ||
| + | < | ||
| + | certbot certonly --manual --preferred-challenges dns --key-type rsa -d beincontact2.becloudsolutions.com, | ||
| + | </ | ||
| + | |||
| + | \\ | ||
| + | \\ | ||
| Follow the wizard and **read the final output**, you need to '' | Follow the wizard and **read the final output**, you need to '' | ||
| Line 71: | Line 111: | ||
| ==== Certs preparation ==== | ==== Certs preparation ==== | ||
| < | < | ||
| - | cp privkey.pem server.key | + | \cp -b privkey.pem server.key |
| cat fullchain.pem | cat - privkey.pem > server.pem | cat fullchain.pem | cat - privkey.pem > server.pem | ||
| \cp -b server.key / | \cp -b server.key / | ||
| Line 81: | Line 121: | ||
| ==== Restart services ==== | ==== Restart services ==== | ||
| < | < | ||
| - | systemctl restart nginx | + | systemctl restart nginx && |
| - | systemctl restart agentserver | + | |
| </ | </ | ||
| - | --- // | + | \\ |
| + | |||
| + | --- // | ||
procedures/certificates.1710435358.txt.gz · Last modified: by sysadm