mirror of
https://github.com/muerwre/muerwre.github.io.git
synced 2025-04-25 10:56:40 +07:00
31 lines
No EOL
1,022 B
Markdown
31 lines
No EOL
1,022 B
Markdown
This is translation of article from [clsv.ru](https://clsv.ru/linux/lets_encrypt_eto_legko_i_prosto_60), which explains how to automate certbot's well-known, also known as HTTP challenge for wildcard certs renewal.
|
|
|
|
You'll need 4 scripts:
|
|
|
|
1. Authentication script, which will write authentication file:
|
|
```shell
|
|
#!/bin/bash
|
|
echo $CERTBOT_VALIDATION > /var/www/html/.well-known/$CERTBOT_TOKEN
|
|
```
|
|
2. Cleanup script, that will delete that
|
|
```shell
|
|
#!/bin/bash
|
|
rm -f /var/www/html/.well-known/$CERTBOT_TOKEN
|
|
```
|
|
3. Initial cert acquiring script:
|
|
```shell
|
|
certbot certonly \
|
|
--preferred-challenges=http --manual \
|
|
--manual-auth-hook /path/to/auth.sh \
|
|
--manual-cleanup-hook /oath/to/clean.sh
|
|
-d "vault48.org,*.vault48.org" \
|
|
--manual-public-ip-logging-ok
|
|
```
|
|
1. Renewal script itself to put it in crontab
|
|
```shell
|
|
certbot renew --manual-public-ip-logging-ok \
|
|
--manual-auth-hook /path/to/auth.sh \
|
|
--manual-cleanup-hook /path/to/clean.sh
|
|
```
|
|
|
|
Don't forget to configure your http server to serve `.well-known`. |