Certbot - Revision history

Pigs: /* DNS challenge using a plugin */Use current channel for search.nixos.org link

2025-05-07T16:23:58Z

DNS challenge using a plugin: Use current channel for search.nixos.org link

← Older revision		Revision as of 16:23, 7 May 2025
Line 29:		Line 29:
	=== DNS challenge using a plugin ===		=== DNS challenge using a plugin ===

	Currently there are several ''certbot'' plugins [https://search.nixos.org/packages?~~channel=24.05&from=0&size=50&sort=relevance&type=packages&~~query=certbot-dns already packaged]. While the plugin usage should be similar for most of them, you should look up upstream documentation on how to use them. In this example we're going to configure and use [https://github.com/oGGy990/certbot-dns-inwx the plugin] for the hosting provider [https://www.inwx.com/en INWX].		Currently there are several ''certbot'' plugins [https://search.nixos.org/packages?query=certbot-dns already packaged]. While the plugin usage should be similar for most of them, you should look up upstream documentation on how to use them. In this example we're going to configure and use [https://github.com/oGGy990/certbot-dns-inwx the plugin] for the hosting provider [https://www.inwx.com/en INWX].

	{{warning\|1=Do not use a plaintext password in production, this is for demonstration only}}		{{warning\|1=Do not use a plaintext password in production, this is for demonstration only}}

WoutSwinkels: /* DNS challenge using a plugin */ Fix typo thim to them.

2024-10-07T07:48:30Z

DNS challenge using a plugin: Fix typo thim to them.

← Older revision		Revision as of 07:48, 7 October 2024
Line 29:		Line 29:
	=== DNS challenge using a plugin ===		=== DNS challenge using a plugin ===

	Currently there are several ''certbot'' plugins [https://search.nixos.org/packages?channel=24.05&from=0&size=50&sort=relevance&type=packages&query=certbot-dns already packaged]. While the plugin usage should be similar for most of them, you should look up upstream documentation on how to use ~~thim~~. In this example we're going to configure and use [https://github.com/oGGy990/certbot-dns-inwx the plugin] for the hosting provider [https://www.inwx.com/en INWX].		Currently there are several ''certbot'' plugins [https://search.nixos.org/packages?channel=24.05&from=0&size=50&sort=relevance&type=packages&query=certbot-dns already packaged]. While the plugin usage should be similar for most of them, you should look up upstream documentation on how to use them. In this example we're going to configure and use [https://github.com/oGGy990/certbot-dns-inwx the plugin] for the hosting provider [https://www.inwx.com/en INWX].

	{{warning\|1=Do not use a plaintext password in production, this is for demonstration only}}		{{warning\|1=Do not use a plaintext password in production, this is for demonstration only}}

WoutSwinkels: Update the 'already packaged' url under the 'DNS challenge using a plugin' section

2024-10-03T14:14:27Z

Update the 'already packaged' url under the 'DNS challenge using a plugin' section

← Older revision		Revision as of 14:14, 3 October 2024
Line 29:		Line 29:
	=== DNS challenge using a plugin ===		=== DNS challenge using a plugin ===

	Currently there are several ''certbot'' plugins [https://search.nixos.org/packages?channel=22.05&from=0&size=50&sort=relevance&type=packages&query=certbot-dns already packaged]. While the plugin usage should be similar for most of them, you should look up upstream documentation on how to use thim. In this example we're going to configure and use [https://github.com/oGGy990/certbot-dns-inwx the plugin] for the hosting provider [https://www.inwx.com/en INWX].		Currently there are several ''certbot'' plugins [https://search.nixos.org/packages?channel=24.05&from=0&size=50&sort=relevance&type=packages&query=certbot-dns already packaged]. While the plugin usage should be similar for most of them, you should look up upstream documentation on how to use thim. In this example we're going to configure and use [https://github.com/oGGy990/certbot-dns-inwx the plugin] for the hosting provider [https://www.inwx.com/en INWX].

	{{warning\|1=Do not use a plaintext password in production, this is for demonstration only}}		{{warning\|1=Do not use a plaintext password in production, this is for demonstration only}}

Klinger: Category:Server Category:Applications

2024-04-19T17:42:46Z

Category:Server Category:Applications

← Older revision		Revision as of 17:42, 19 April 2024
Line 61:		Line 61:

	Now that a specific domain is configured to get renewed using the plugin, the ''systemd-timer'' of the ''certbot'' module will automatically renew it after expiration.		Now that a specific domain is configured to get renewed using the plugin, the ''systemd-timer'' of the ''certbot'' module will automatically renew it after expiration.

			[[Category:Server]]
			[[Category:Applications]]

Mic92: fix links

2024-04-01T13:53:55Z

fix links

← Older revision		Revision as of 13:53, 1 April 2024
Line 1:		Line 1:
	[https://github.com/certbot/certbot Certbot] is [https://www.eff.org/ Electronic Frontier Foundation]'s [[ACME]] client, which is written in Python and provides conveniences like automatic web server configuration and a built-in webserver for the HTTP challenge. Certbot is recommended by [https://letsencrypt.org/ Let's Encrypt].		[https://github.com/certbot/certbot Certbot] is [https://www.eff.org/ Electronic Frontier Foundation]'s [[ACME]] client, which is written in Python and provides conveniences like automatic web server configuration and a built-in webserver for the HTTP challenge. Certbot is recommended by [https://letsencrypt.org/ Let's Encrypt].

	{{Note\|It is recommended to use the the ACME service module, available through <code>security.acme</code>, instead of ''certbot''. Please consult the [~~https://nixos.wiki/wiki/~~ACME ACME page] on how to use it.}}		{{Note\|It is recommended to use the the ACME service module, available through <code>security.acme</code>, instead of ''certbot''. Please consult the [[ACME \| ACME page]] on how to use it.}}

	== Installation ==		== Installation ==

imported>Devraza: Redo the change of giving a direct link to the ACME page

2023-12-24T20:16:20Z

Redo the change of giving a direct link to the ACME page

← Older revision		Revision as of 20:16, 24 December 2023
Line 1:		Line 1:
	[https://github.com/certbot/certbot Certbot] is [https://www.eff.org/ Electronic Frontier Foundation]'s [[ACME]] client, which is written in Python and provides conveniences like automatic web server configuration and a built-in webserver for the HTTP challenge. Certbot is recommended by [https://letsencrypt.org/ Let's Encrypt].		[https://github.com/certbot/certbot Certbot] is [https://www.eff.org/ Electronic Frontier Foundation]'s [[ACME]] client, which is written in Python and provides conveniences like automatic web server configuration and a built-in webserver for the HTTP challenge. Certbot is recommended by [https://letsencrypt.org/ Let's Encrypt].

	{{Note\|It is recommended to use the the ACME service module, available through <code>security.acme</code>, instead of ''certbot''. Please consult the ~~documentation~~ on how to use it.}}		{{Note\|It is recommended to use the the ACME service module, available through <code>security.acme</code>, instead of ''certbot''. Please consult the [https://nixos.wiki/wiki/ACME ACME page] on how to use it.}}

	== Installation ==		== Installation ==

imported>Devraza: Give a direct link to the ACME page in the certbot note

2023-12-24T14:35:15Z

Give a direct link to the ACME page in the certbot note

← Older revision		Revision as of 14:35, 24 December 2023
Line 1:		Line 1:
	[https://github.com/certbot/certbot Certbot] is [https://www.eff.org/ Electronic Frontier Foundation]'s [[ACME]] client, which is written in Python and provides conveniences like automatic web server configuration and a built-in webserver for the HTTP challenge. Certbot is recommended by [https://letsencrypt.org/ Let's Encrypt].		[https://github.com/certbot/certbot Certbot] is [https://www.eff.org/ Electronic Frontier Foundation]'s [[ACME]] client, which is written in Python and provides conveniences like automatic web server configuration and a built-in webserver for the HTTP challenge. Certbot is recommended by [https://letsencrypt.org/ Let's Encrypt].

	{{Note\|It is recommended to use the the ACME service module, available through <code>security.acme</code>, instead of ''certbot''. Please consult ~~[https://nixos.wiki/wiki/ACME~~ the ~~ACME page]~~ on how to use it.}}		{{Note\|It is recommended to use the the ACME service module, available through <code>security.acme</code>, instead of ''certbot''. Please consult the documentation on how to use it.}}

	== Installation ==		== Installation ==

imported>Devraza: Give a direct link to the ACME page in the certbot note

2023-12-24T14:34:36Z

Give a direct link to the ACME page in the certbot note

← Older revision		Revision as of 14:34, 24 December 2023
Line 1:		Line 1:
	[https://github.com/certbot/certbot Certbot] is [https://www.eff.org/ Electronic Frontier Foundation]'s [[ACME]] client, which is written in Python and provides conveniences like automatic web server configuration and a built-in webserver for the HTTP challenge. Certbot is recommended by [https://letsencrypt.org/ Let's Encrypt].		[https://github.com/certbot/certbot Certbot] is [https://www.eff.org/ Electronic Frontier Foundation]'s [[ACME]] client, which is written in Python and provides conveniences like automatic web server configuration and a built-in webserver for the HTTP challenge. Certbot is recommended by [https://letsencrypt.org/ Let's Encrypt].

	{{Note\|It is recommended to use the the ACME service module, available through <code>security.acme</code>, instead of ''certbot''. Please consult the ~~documentation~~ on how to use it.}}		{{Note\|It is recommended to use the the ACME service module, available through <code>security.acme</code>, instead of ''certbot''. Please consult [https://nixos.wiki/wiki/ACME the ACME page] on how to use it.}}

	== Installation ==		== Installation ==

imported>Onny: Add infos about read permissions for acme group

2022-09-12T15:47:40Z

Add infos about read permissions for acme group

← Older revision		Revision as of 15:47, 12 September 2022
Line 17:		Line 17:
	It is possible to use several different methods to generate and configure certificates. Verification is done manually, via web servers or DNS records. Not all methods are covered here, for more information please consult the [https://eff-certbot.readthedocs.io/en/stable/ upstream documentation].		It is possible to use several different methods to generate and configure certificates. Verification is done manually, via web servers or DNS records. Not all methods are covered here, for more information please consult the [https://eff-certbot.readthedocs.io/en/stable/ upstream documentation].

	Generated certificates and keys by using the commands below will be stored as <code>/etc/letsencrypt/live/example.org/fullchain.pem</code> and <code>/etc/letsencrypt/live/example.org/privkey.pem</code>.		Generated certificates and keys by using the commands below will be stored as <code>/etc/letsencrypt/live/example.org/fullchain.pem</code> and <code>/etc/letsencrypt/live/example.org/privkey.pem</code>, readable by the <code>acme</code> group.

	~~To make the keys~~ readable by ~~a third party user or application, you could set custom ACL permissions. In this example we grant~~ the ~~user~~ <code>~~maddy~~</code> ~~read permissions for the certificate folder:~~

	~~<syntaxhighlight lang="console">~~
	~~# sudo setfacl -R -m u:maddy:rX /etc/letsencrypt/{live,archive}~~
	~~</syntaxhighlight>~~

	=== Manual DNS challenge ===		=== Manual DNS challenge ===

imported>Onny: Add module agreeTerms option

2022-09-12T15:32:15Z

Add module agreeTerms option

← Older revision		Revision as of 15:32, 12 September 2022
Line 8:		Line 8:
	Install ''certbot'' application and enable ''systemd-timer'' for automated renewal of certificates		Install ''certbot'' application and enable ''systemd-timer'' for automated renewal of certificates
	{{file\|/etc/nixos/configuration.nix\|nix\|<nowiki>		{{file\|/etc/nixos/configuration.nix\|nix\|<nowiki>
	services.certbot.enable = true;		services.certbot = {
			enable = true;
			agreeTerms = true;
			};
	</nowiki>}}		</nowiki>}}
	== Usage ==		== Usage ==
Line 50:		Line 53:
	services.certbot = {		services.certbot = {
	enable = true;		enable = true;
			agreeTerms = true;
	package = pkgs.certbot.withPlugins (ps: with ps; [ certbot-dns-inwx ]);		package = pkgs.certbot.withPlugins (ps: with ps; [ certbot-dns-inwx ]);
	}		}