Certbot: Difference between revisions

(10 intermediate revisions by 5 users not shown)

Line 1:

[https://github.com/certbot/certbot Certbot] is [https://www.eff.org/ Electronic Frontier Foundation]'s [[ACME]] client, which is written in Python and provides conveniences like automatic web server configuration and a built-in webserver for the HTTP challenge. Certbot is recommended by [https://letsencrypt.org/ Let's Encrypt].

{{Note|It is recommended to use the the ACME service module, available through <code>security.acme</code>, instead of ''certbot''. Please consult the [[ACME | ACME page]] on how to use it.}}

== Installation ==

Line 6:

Line 8:

Install ''certbot'' application and enable ''systemd-timer'' for automated renewal of certificates

{{file|/etc/nixos/configuration.nix|nix|<nowiki>

services.certbot.enable = true;

services.certbot = {

enable = true;

agreeTerms = true;

};

</nowiki>}}

== Usage ==

Line 12:

Line 17:

It is possible to use several different methods to generate and configure certificates. Verification is done manually, via web servers or DNS records. Not all methods are covered here, for more information please consult the [https://eff-certbot.readthedocs.io/en/stable/ upstream documentation].

Generated certificates and keys by using the commands below will be stored as <code>/etc/letsencrypt/live/example.org/fullchain.pem</code> and <code>/etc/letsencrypt/live/example.org/privkey.pem</code>.

Generated certificates and keys by using the commands below will be stored as <code>/etc/letsencrypt/live/example.org/fullchain.pem</code> and <code>/etc/letsencrypt/live/example.org/privkey.pem</code>, readable by the <code>acme</code> group.

~~To make the keys~~ readable by ~~a third party user or application, you could set custom ACL permissions. In this example we grant~~ the ~~user~~ <code>~~maddy~~</code> ~~read permissions for the certificate folder:~~

~~<syntaxhighlight lang="console">~~

~~# sudo setfacl -R -m u:maddy:rX /etc/letsencrypt/{live,archive}~~

~~</syntaxhighlight>~~

=== Manual DNS challenge ===

Line 30:

Line 29:

=== DNS challenge using a plugin ===

Currently there are several ''certbot'' plugins [https://search.nixos.org/packages?~~channel=22.05&from=0&size=50&sort=relevance&type=packages&~~query=certbot-dns already packaged]. While the plugin usage should be similar for most of them, you should look up upstream documentation on how to use ~~thim~~. In this example we're going to configure and use [https://github.com/oGGy990/certbot-dns-inwx the plugin] for the hosting provider [https://www.inwx.com/en INWX].

Currently there are several ''certbot'' plugins [https://search.nixos.org/packages?query=certbot-dns already packaged]. While the plugin usage should be similar for most of them, you should look up upstream documentation on how to use them. In this example we're going to configure and use [https://github.com/oGGy990/certbot-dns-inwx the plugin] for the hosting provider [https://www.inwx.com/en INWX].

{{warning|1=Do not use a plaintext password in production, this is for demonstration only}}

Line 48:

Line 47:

services.certbot = {

enable = true;

agreeTerms = true;

package = pkgs.certbot.withPlugins (ps: with ps; [ certbot-dns-inwx ]);

}

Line 61:

Now that a specific domain is configured to get renewed using the plugin, the ''systemd-timer'' of the ''certbot'' module will automatically renew it after expiration.

[[Category:Server]]

[[Category:Applications]]

@@ Line 1: / Line 1: @@
 [https://github.com/certbot/certbot Certbot] is [https://www.eff.org/ Electronic Frontier Foundation]'s [[ACME]] client, which is written in Python and provides conveniences like automatic web server configuration and a built-in webserver for the HTTP challenge. Certbot is recommended by [https://letsencrypt.org/ Let's Encrypt].
+{{Note|It is recommended to use the the ACME service module, available through <code>security.acme</code>, instead of ''certbot''. Please consult the [[ACME | ACME page]] on how to use it.}}
 == Installation ==
@@ Line 6: / Line 8: @@
 Install ''certbot'' application and enable ''systemd-timer'' for automated renewal of certificates
 {{file|/etc/nixos/configuration.nix|nix|<nowiki>
-services.certbot.enable = true;
+services.certbot = {
+  enable = true;
+  agreeTerms = true;
+};
 </nowiki>}}
 == Usage ==
@@ Line 12: / Line 17: @@
 It is possible to use several different methods to generate and configure certificates. Verification is done manually, via web servers or DNS records. Not all methods are covered here, for more information please consult the [https://eff-certbot.readthedocs.io/en/stable/ upstream documentation].
-Generated certificates and keys by using the commands below will be stored as <code>/etc/letsencrypt/live/example.org/fullchain.pem</code> and <code>/etc/letsencrypt/live/example.org/privkey.pem</code>.
+Generated certificates and keys by using the commands below will be stored as <code>/etc/letsencrypt/live/example.org/fullchain.pem</code> and <code>/etc/letsencrypt/live/example.org/privkey.pem</code>, readable by the <code>acme</code> group.
-To make the keys readable by a third party user or application, you could set custom ACL permissions. In this example we grant the user <code>maddy</code> read permissions for the certificate folder:
-<syntaxhighlight lang="console">
-# sudo setfacl -R -m u:maddy:rX /etc/letsencrypt/{live,archive}
-</syntaxhighlight>
 === Manual DNS challenge ===
@@ Line 30: / Line 29: @@
 === DNS challenge using a plugin ===
-Currently there are several ''certbot'' plugins [https://search.nixos.org/packages?channel=22.05&from=0&size=50&sort=relevance&type=packages&query=certbot-dns already packaged]. While the plugin usage should be similar for most of them, you should look up upstream documentation on how to use thim. In this example we're going to configure and use [https://github.com/oGGy990/certbot-dns-inwx the plugin] for the hosting provider [https://www.inwx.com/en INWX].
+Currently there are several ''certbot'' plugins [https://search.nixos.org/packages?query=certbot-dns already packaged]. While the plugin usage should be similar for most of them, you should look up upstream documentation on how to use them. In this example we're going to configure and use [https://github.com/oGGy990/certbot-dns-inwx the plugin] for the hosting provider [https://www.inwx.com/en INWX].
 {{warning|1=Do not use a plaintext password in production, this is for demonstration only}}
@@ Line 48: / Line 47: @@
 services.certbot = {
    enable = true;
+  agreeTerms = true;
    package = pkgs.certbot.withPlugins (ps: with ps; [ certbot-dns-inwx ]);
 }
@@ Line 61: / Line 61: @@
 Now that a specific domain is configured to get renewed using the plugin, the ''systemd-timer'' of the ''certbot'' module will automatically renew it after expiration.
+[[Category:Server]]
+[[Category:Applications]]