procedures:certificates
Differences
This shows you the differences between two versions of the page.
| Both sides previous revisionPrevious revisionNext revision | Previous revision | ||
| procedures:certificates [2024/08/28 15:51] – Fixed link sysadm | procedures:certificates [2025/11/28 20:18] (current) – Added Sonova and CFT domains sysadm | ||
|---|---|---|---|
| Line 1: | Line 1: | ||
| - | ====== SSL certs renewal | + | ====== SSL certs renewal ====== |
| === FIRST THING === | === FIRST THING === | ||
| Line 6: | Line 6: | ||
| In case anything goes wrong, you will reuse the old certs. | In case anything goes wrong, you will reuse the old certs. | ||
| - | \\ | ||
| \\ | \\ | ||
| To install certbot: | To install certbot: | ||
| < | < | ||
| - | yum install -y certbot-nginx | + | yum install -y certbot |
| </ | </ | ||
| + | \\ | ||
| \\ | \\ | ||
| + | |||
| + | ==== No acme-challenge ==== | ||
| === Istances that need certs for operation === | === Istances that need certs for operation === | ||
| - | * Frankfurt | + | |
| - | - Prod5_Core1 | + | |
| - | - Prod5_Core2 | + | |
| - | | + | |
| - | | + | |
| - | - Support | + | |
| - | - Be360(s) | + | |
| (There are shared Outlook calendars for all expiring certs) | (There are shared Outlook calendars for all expiring certs) | ||
| Line 30: | Line 30: | ||
| \\ | \\ | ||
| - | === Commands === | + | ==== Commands |
| - | \\ | + | |
| - | ==== Certbot single istances | + | === Certbot single istances === |
| < | < | ||
| - | certbot certonly --nginx | + | sudo certbot-3 certonly --nginx |
| + | OR | ||
| + | sudo certbot certonly --nginx | ||
| </ | </ | ||
| \\ | \\ | ||
| - | ==== Certbot clusters | + | === Certbot clusters === |
| - | For clusters, you need to run the command on **both** istances, but first you have to modify the " | + | For clusters, you need to run the command on **both** |
| Login to [[https:// | Login to [[https:// | ||
| | | ||
| Line 52: | Line 54: | ||
| the weight and repeat the process for the second server. | the weight and repeat the process for the second server. | ||
| < | < | ||
| - | certbot certonly --nginx -d **domain** | + | sudo certbot-3 certonly --nginx -d **domain**,**domain**,*etc* |
| + | </ | ||
| + | |||
| + | Copy-paste domains Core1: | ||
| + | < | ||
| + | -d core1.beincontact.becloudsolutions.com, | ||
| + | </ | ||
| + | |||
| + | Copy-paste domains Core2: | ||
| + | < | ||
| + | -d core2.beincontact.becloudsolutions.com, | ||
| </ | </ | ||
| \\ | \\ | ||
| - | ==== Certbot not installed | + | === Certbot not installed === |
| < | < | ||
| ./ | ./ | ||
| Line 63: | Line 75: | ||
| (if you don't find the script you can locate it with '' | (if you don't find the script you can locate it with '' | ||
| + | |||
| + | Follow the wizard and **read the final output**, you need to '' | ||
| + | the commands to preare the certs (will be in / | ||
| + | |||
| + | \\ | ||
| + | \\ | ||
| + | |||
| + | ==== Acme-challenge ==== | ||
| + | |||
| + | === Istances that need certs for operation === | ||
| + | |||
| + | * Prod5_Core1(Sydney) | ||
| + | * Prod5_Core2(Sydney) | ||
| + | |||
| + | (There are shared Outlook calendars for all expiring certs) | ||
| + | |||
| + | \\ | ||
| + | |||
| + | ==== Commands ==== | ||
| + | |||
| + | === Acme-challenges clusters === | ||
| + | |||
| + | For clusters, you need to run the command on **both** " | ||
| + | Login to [[https:// | ||
| + | | ||
| + | Clusters have shared domain between two machines (for example, Prod5_Core1 and Prod5_Core2 are both pointed by | ||
| + | *beincontact.becloudsolutions.com*), | ||
| + | click "Edit record", | ||
| + | | ||
| + | You have to do this for the machine where you are **not** trying to renew the certificates (for example, you want to renew | ||
| + | Prod5_Core1, | ||
| + | the weight and repeat the process for the second server. | ||
| + | |||
| + | Follow the instructions on screen and replace old entries in the DNS, make a copy of the old values in case you need to use the old certs. Do **not** create multiple records for one domain, even if certbot tell you to do it, you can't in AWS. | ||
| + | < | ||
| + | certbot certonly --manual --preferred-challenges dns --key-type rsa -d **domain**, | ||
| + | </ | ||
| + | |||
| + | Copy-paste domains: | ||
| + | < | ||
| + | -d beincontact2.becloudsolutions.com, | ||
| + | </ | ||
| + | |||
| + | \\ | ||
| Follow the wizard and **read the final output**, you need to '' | Follow the wizard and **read the final output**, you need to '' | ||
| Line 84: | Line 140: | ||
| </ | </ | ||
| - | --- // | + | \\ |
| + | |||
| + | --- // | ||
procedures/certificates.1724860279.txt.gz · Last modified: by sysadm