procedures:certificates
Differences
This shows you the differences between two versions of the page.
| Both sides previous revisionPrevious revisionNext revision | Previous revision | ||
| procedures:certificates [2025/01/13 20:44] – sysadm | procedures:certificates [2026/04/09 13:42] (current) – Cleanup sysadm | ||
|---|---|---|---|
| Line 3: | Line 3: | ||
| === FIRST THING === | === FIRST THING === | ||
| - | **BACKUP THE EXISTENT CERTS** | + | To install certbot |
| - | In case anything goes wrong, you will reuse the old certs. | + | < |
| + | yum install -y python3-certbot python3-certbot-nginx | ||
| + | </ | ||
| - | \\ | + | To install certbot |
| - | + | ||
| - | To install certbot: | + | |
| < | < | ||
| - | yum install -y certbot-nginx | + | apt install -y python3-certbot python3-certbot-nginx |
| </ | </ | ||
| - | \\ | ||
| \\ | \\ | ||
| ==== No acme-challenge ==== | ==== No acme-challenge ==== | ||
| - | === Istances that need certs for operation | + | === Istances that need certs to be renewed manually |
| - | * Prod5_Core1(Frankfurt) | + | * Prod5_Core1/2(Frankfurt) |
| - | * Prod5_Core2(Frankfurt) | + | |
| * BeCloud5x | * BeCloud5x | ||
| - | * Monitor | ||
| - | * Be360(s) | ||
| (There are shared Outlook calendars for all expiring certs) | (There are shared Outlook calendars for all expiring certs) | ||
| Line 32: | Line 28: | ||
| ==== Commands ==== | ==== Commands ==== | ||
| - | === Certbot | + | === BeIncontact |
| < | < | ||
| - | certbot certonly --nginx | + | sudo certbot-3 certonly --nginx |
| </ | </ | ||
| Line 52: | Line 48: | ||
| the weight and repeat the process for the second server. | the weight and repeat the process for the second server. | ||
| < | < | ||
| - | certbot certonly --nginx -d **domain**, | + | sudo certbot-3 certonly --nginx -d **domain**, |
| </ | </ | ||
| Copy-paste domains Core1: | Copy-paste domains Core1: | ||
| < | < | ||
| - | -d core1.beincontact.becloudsolutions.com, | + | sudo certbot-3 certonly --nginx |
| </ | </ | ||
| Copy-paste domains Core2: | Copy-paste domains Core2: | ||
| < | < | ||
| - | -d core2.beincontact.becloudsolutions.com, | + | sudo certbot-3 certonly --nginx |
| </ | </ | ||
| + | \\ | ||
| \\ | \\ | ||
| - | === Certbot not installed === | ||
| - | < | ||
| - | ./ | ||
| - | </ | ||
| - | (if you don't find the script you can locate it with '' | ||
| - | |||
| - | |||
| - | Follow the wizard and **read the final output**, you need to '' | ||
| - | the commands to preare the certs (will be in / | ||
| - | |||
| - | \\ | ||
| - | \\ | ||
| ==== Acme-challenge ==== | ==== Acme-challenge ==== | ||
| Line 84: | Line 69: | ||
| === Istances that need certs for operation === | === Istances that need certs for operation === | ||
| - | * Prod5_Core1(Sydney) | + | * Prod5_Core1/2(Sydney) |
| - | * Prod5_Core2(Sydney) | + | |
| (There are shared Outlook calendars for all expiring certs) | (There are shared Outlook calendars for all expiring certs) | ||
| Line 107: | Line 91: | ||
| Follow the instructions on screen and replace old entries in the DNS, make a copy of the old values in case you need to use the old certs. Do **not** create multiple records for one domain, even if certbot tell you to do it, you can't in AWS. | Follow the instructions on screen and replace old entries in the DNS, make a copy of the old values in case you need to use the old certs. Do **not** create multiple records for one domain, even if certbot tell you to do it, you can't in AWS. | ||
| + | Be aware that you have to deploy all domains before terminating the script (it will warn you when it's almost done), Certbot check for deployment only in the end, not every time it ask you to deploy a domain. | ||
| < | < | ||
| certbot certonly --manual --preferred-challenges dns --key-type rsa -d **domain**, | certbot certonly --manual --preferred-challenges dns --key-type rsa -d **domain**, | ||
| Line 113: | Line 98: | ||
| Copy-paste domains: | Copy-paste domains: | ||
| < | < | ||
| - | -d beincontact2.becloudsolutions.com, | + | certbot certonly --manual --preferred-challenges dns --key-type rsa -d beincontact2.becloudsolutions.com, |
| </ | </ | ||
| + | \\ | ||
| \\ | \\ | ||
| Line 125: | Line 111: | ||
| ==== Certs preparation ==== | ==== Certs preparation ==== | ||
| < | < | ||
| - | cp privkey.pem server.key | + | \cp -b privkey.pem server.key |
| cat fullchain.pem | cat - privkey.pem > server.pem | cat fullchain.pem | cat - privkey.pem > server.pem | ||
| \cp -b server.key / | \cp -b server.key / | ||
| Line 140: | Line 126: | ||
| \\ | \\ | ||
| - | --- // | + | --- // |
procedures/certificates.1736801083.txt.gz · Last modified: by sysadm