98 lines
No EOL
2.6 KiB
Markdown
98 lines
No EOL
2.6 KiB
Markdown
# acme.sh TLS Certificates
|
|
|
|
## Install acme.sh
|
|
|
|
Add separate user acmeuser.
|
|
|
|
```bash
|
|
adduser --disabled-login acmeuser
|
|
```
|
|
|
|
Install acme.sh as separate user acmeuser
|
|
|
|
```bash
|
|
mkdir /etc/acmesh
|
|
chown acmeuser /etc/acmesh
|
|
sudo -su acmeuser
|
|
|
|
# Run these commands as user acmeuser
|
|
cd ~
|
|
git clone https://github.com/acmesh-official/acme.sh.git
|
|
cd acme.sh
|
|
./acme.sh --install \
|
|
--home /etc/acmesh \
|
|
--accountemail "hostmaster@domain.tld"
|
|
cd ~ && rm -r acme.sh
|
|
source ~/.bashrc
|
|
acme.sh --set-default-ca --server letsencrypt
|
|
```
|
|
|
|
Allow user acmeuser to reload nginx, etc.
|
|
|
|
```bash
|
|
# Uncomment "includedir /etc/sudoers.d" in /etc/sudoers
|
|
sed -e '/includedir/ s/^##*/#/g' -i /etc/sudoers
|
|
cat >/etc/sudoers.d/acmeuser <<EOL
|
|
acmeuser ALL=NOPASSWD: /usr/bin/systemctl reload nginx.service
|
|
EOL
|
|
```
|
|
|
|
## Set up DNS validation with knsupdate (Knot)
|
|
|
|
Specify the DNS server which hosts your zone and the TSIG key which can update the zone via dynamic updates.
|
|
|
|
```bash
|
|
apt install -y knot-dnsutils
|
|
|
|
export KNOT_SERVER="dns.domain.tld"
|
|
export KNOT_KEY=hmac-sha512:sub.domain.tld:SuperSecretKey==
|
|
```
|
|
|
|
## Issue a certificate
|
|
|
|
```bash
|
|
DOMAINLE=sub.domain.tld; acme.sh --issue -d $DOMAINLE --dns dns_knot --ecc -k ec-384
|
|
```
|
|
|
|
## Install a certificate
|
|
|
|
```bash
|
|
# --cert-file <file> Path to copy the cert file to after issue/renew.
|
|
# --key-file <file> Path to copy the key file to after issue/renew.
|
|
# --ca-file <file> Path to copy the intermediate cert file to after issue/renew.
|
|
# --fullchain-file <file> Path to copy the fullchain cert file to after issue/renew.
|
|
# --reloadcmd <command> Command to execute after issue/renew to reload the server.
|
|
|
|
DOMAINLE=sub.domain.tld
|
|
CERTPATH=/etc/ssl/private/$DOMAINLE
|
|
mkdir -p $CERTPATH
|
|
acme.sh --install-cert -d $DOMAINLE --ecc \
|
|
--fullchain-file $CERTPATH/fullchain.pem \
|
|
--key-file $CERTPATH/privkey.pem \
|
|
--ca-file $CERTPATH/chain.pem \
|
|
--reloadcmd "sudo /usr/bin/systemctl reload nginx.service"
|
|
```
|
|
|
|
## Set up notifications
|
|
|
|
Follow instructions for [gotify notifications](https://code.strobeto.de/strobeltobias/acme.sh-notify-hooks#set-notification-for-gotify-webhooks) first.
|
|
|
|
Enable notifications via mail (requires local MTA set up for sending mails) and gotify.
|
|
|
|
```bash
|
|
acme.sh --set-notify \
|
|
--notify-hook mail \
|
|
--notify-hook gotify \
|
|
--notify-level 2 \
|
|
--notify-mode 0
|
|
```
|
|
|
|
## Set correct permissions
|
|
|
|
```bash
|
|
usermod -a -G www-data acmeuser
|
|
chown -R acmeuser:ssl-cert /etc/ssl/private
|
|
chown root:ssl-cert /etc/ssl/private/ssl-cert-snakeoil.key
|
|
chmod -R 750 /etc/ssl/private
|
|
find /etc/ssl/private/ -type f -print0 | xargs -0 chmod 0640
|
|
``` |