procedures:certificates
Differences
This shows you the differences between two versions of the page.
| Both sides previous revisionPrevious revisionNext revision | Previous revision | ||
| procedures:certificates [2024/03/22 20:06] – [Restart services] 93.66.33.147 | procedures:certificates [2026/04/09 13:42] (current) – Cleanup sysadm | ||
|---|---|---|---|
| Line 1: | Line 1: | ||
| - | ====== SSL certs renewal | + | ====== SSL certs renewal ====== |
| === FIRST THING === | === FIRST THING === | ||
| - | **BACKUP THE EXISTENT CERTS** | + | To install certbot |
| - | In case anything goes wrong, you will reuse the old certs. | + | < |
| - | + | yum install -y python3-certbot python3-certbot-nginx | |
| - | \\ | + | </ |
| - | \\ | + | |
| - | To install certbot: | + | To install certbot |
| < | < | ||
| - | yum install -y certbot-nginx | + | apt install -y python3-certbot python3-certbot-nginx |
| </ | </ | ||
| \\ | \\ | ||
| - | === Istances that need certs for operation | + | ==== No acme-challenge ==== |
| + | |||
| + | === Istances that need certs to be renewed manually | ||
| - | * Frankfurt | + | |
| - | - Prod5_Core1 | + | |
| - | - Prod5_Core2 | + | |
| - | - BeCloud5x | + | |
| - | - Monitor | + | |
| - | - Support | + | |
| - | - Be360(s) | + | |
| (There are shared Outlook calendars for all expiring certs) | (There are shared Outlook calendars for all expiring certs) | ||
| Line 30: | Line 26: | ||
| \\ | \\ | ||
| - | === Commands === | + | ==== Commands |
| - | \\ | + | |
| - | ==== Certbot | + | === BeIncontact |
| < | < | ||
| - | certbot certonly --nginx | + | sudo certbot-3 certonly --nginx |
| </ | </ | ||
| \\ | \\ | ||
| - | ==== Certbot clusters | + | === Certbot clusters === |
| - | For clusters, you need to run the command on **both** istances, but first you have to modify the " | + | For clusters, you need to run the command on **both** |
| - | Login to [AWS DNS](https:// | + | Login to [[https:// |
| | | ||
| Clusters have shared domain between two machines (for example, Prod5_Core1 and Prod5_Core2 are both pointed by | Clusters have shared domain between two machines (for example, Prod5_Core1 and Prod5_Core2 are both pointed by | ||
| Line 52: | Line 48: | ||
| the weight and repeat the process for the second server. | the weight and repeat the process for the second server. | ||
| < | < | ||
| - | certbot certonly --nginx -d **domain** | + | sudo certbot-3 certonly --nginx -d **domain**,**domain**,*etc* |
| + | </ | ||
| + | |||
| + | Copy-paste domains Core1: | ||
| + | < | ||
| + | sudo certbot-3 certonly --nginx -d core1.beincontact.becloudsolutions.com, | ||
| + | </ | ||
| + | |||
| + | Copy-paste domains Core2: | ||
| + | < | ||
| + | sudo certbot-3 certonly --nginx -d core2.beincontact.becloudsolutions.com, | ||
| </ | </ | ||
| \\ | \\ | ||
| + | \\ | ||
| + | |||
| + | |||
| + | ==== Acme-challenge ==== | ||
| + | |||
| + | === Istances that need certs for operation === | ||
| + | |||
| + | * Prod5_Core1/ | ||
| + | |||
| + | (There are shared Outlook calendars for all expiring certs) | ||
| + | |||
| + | \\ | ||
| + | |||
| + | ==== Commands ==== | ||
| + | |||
| + | === Acme-challenges clusters === | ||
| + | |||
| + | For clusters, you need to run the command on **both** " | ||
| + | Login to [[https:// | ||
| + | | ||
| + | Clusters have shared domain between two machines (for example, Prod5_Core1 and Prod5_Core2 are both pointed by | ||
| + | *beincontact.becloudsolutions.com*), | ||
| + | click "Edit record", | ||
| + | | ||
| + | You have to do this for the machine where you are **not** trying to renew the certificates (for example, you want to renew | ||
| + | Prod5_Core1, | ||
| + | the weight and repeat the process for the second server. | ||
| - | ==== Certbot not installed ==== | + | Follow the instructions on screen and replace old entries in the DNS, make a copy of the old values in case you need to use the old certs. Do **not** create multiple records for one domain, even if certbot tell you to do it, you can't in AWS. |
| + | Be aware that you have to deploy all domains before terminating the script (it will warn you when it's almost done), | ||
| < | < | ||
| - | ./certbot-auto certonly --nginx | + | certbot certonly --manual --preferred-challenges dns --key-type rsa -d **domain**, |
| </ | </ | ||
| - | (if you don't find the script you can locate it with '' | ||
| + | Copy-paste domains: | ||
| + | < | ||
| + | certbot certonly --manual --preferred-challenges dns --key-type rsa -d beincontact2.becloudsolutions.com, | ||
| + | </ | ||
| + | |||
| + | \\ | ||
| + | \\ | ||
| Follow the wizard and **read the final output**, you need to '' | Follow the wizard and **read the final output**, you need to '' | ||
| Line 71: | Line 111: | ||
| ==== Certs preparation ==== | ==== Certs preparation ==== | ||
| < | < | ||
| - | cp privkey.pem server.key | + | \cp -b privkey.pem server.key |
| cat fullchain.pem | cat - privkey.pem > server.pem | cat fullchain.pem | cat - privkey.pem > server.pem | ||
| \cp -b server.key / | \cp -b server.key / | ||
| Line 84: | Line 124: | ||
| </ | </ | ||
| - | --- // | + | \\ |
| + | |||
| + | --- // | ||
procedures/certificates.1711137961.txt.gz · Last modified: by 93.66.33.147