Changes

1,316 bytes added , 11:49, 15 May 2023

Fixed certbot

{{Feature

|image=Electronic Frontier Foundation video conferencing background certbot-logo-1 (28343180089).png

|imgdesc=Certbot

|title=

}}

{{#set:feature title = {{PAGENAME}} }}

{{#set:feature description = Certbot, from the Let's Encrypt project of the EFF, provides free and automated SSL certificates for QualityBox. }}

{{#set:feature notes = For non-public sites, we can still generate certificates using DNS }}

{{#set:feature tests = [https://www.ssllabs.com/ssltest/analyze.html?d={{SERVERNAME}} Test on SSL Labs.com] }}

Certbot is a tool that allows you to manage the Transport Layer Security ([[TLS]]) of your Webserver.

{{ambox|

|type = content

|text = auto renewal stripped some important params from the configuration in <tt>/etc/letsencrypt/renewal/wiki.freephile.org</tt>, so I had to add them back:

[renewalparams]

-authenticator = webroot

+authenticator = standalone

account = 3b0dcc96ceabfb4cf56597fe14ddee7a

server = https://acme-v02.api.letsencrypt.org/directory

manual_public_ip_logging_ok = None

+http01_port = 54321

+installer = None

+pref_challs = http-01

</syntaxhighlight>

The '''real''' solution is to upgrade Certbot, which will happen anyway when we upgrade the host, which will happen anyway when we move to [[Canasta]], so '''get 'er done!'''

Then, update this page content to reflect current usage.

[[User:Admin|freephile]] ([[User talk:Admin|talk]]) 11:49, 15 May 2023 (EDT)

<br />

}}

== Let's Encrypt ==

We used to run certificates from StartSSL because they offer free one-year certificates. However, today we upgraded to using 'LetsEncrypt' and our certificates are both more secure and easier to manage. Instead of a "B" grade, we now have "A" grade security. <ref>https://www.ssllabs.com/ssltest/analyze.html</ref>

[[File:~~AGrade~~Certificate grade.png|left~~|500px]] [[File:BGrade.png|right~~|500px]]

'''Certbot''' ([https://github.com/certbot/certbot code]) is a fully-featured, extensible client for the Let's Encrypt CA (or any other CA that speaks the ACME protocol) that can automate the tasks of obtaining certificates and configuring web servers to use them. This client runs on Unix-based operating systems. It '''requires''' root access and is '''beta''' software.

# stop HAProxy to make sure the host is accessible, but don't install into Apache, just use standalone

systemctl stop haproxy

~~<strike>~~certbot certonly --~~webroot -w /opt/htdocs/~~ standalone -d demo.qualitybox.us~~</strike>~~ ~~certbot certonly --standalone -d fswiki.familysearch.org~~

# then run meza deploy to concatenate the cert files into a .pem file installed into HAproxy

# or if you have to do it manually

Admin

Image-reviewer, Bureaucrats, Check users, confirmed, Interface administrators, Administrators (Semantic MediaWiki), Curators (Semantic MediaWiki), Editors (Semantic MediaWiki), staff, Suppressors, sysadmin, Administrators, uploadaccess, Upload Wizard campaign editors, Widget editors

1,495

edits

Changes

Certbot (view source)

Revision as of 11:49, 15 May 2023