letsencrypt

a command line utility for managing letsencrypt ssl certificates.

depends

ruby >= 2.4

install

gem install blix-letsencrypt

command options:

Usage: letsencrypt [options]

-c, --create                     Create ACME private key
-k, --key=FILE                   ACME private key file
-e, --email=EMAIL                your contact email
-d, --domain=DOMAIN              domain name for certificate
    --challenge_dir=CDIR         challenge file directory
    --ssl_dir=SSLDIR             ssl certificate file directory
    --ssl_key=SSLKEY             ssl private key file
-t, --test                       enable test mode
    --force                      force update even if not expired
-l, --logfile=LOGFILE            log to file
-h, --hook=HOOK                  script to run on renewal

conventions used

the private key is called privkey.pem
the certificate is called cert.pem and is placed in a directory named after the main (first) domain name.

create letsencrypt certificates

create directory to hold your keys and certificates .. eg:

mkdir /etc/letsencrypt/account
mkdir /etc/letsencrypt/ssl

create directory to serve challenges from.. eg:
```
mkdir /srv/certbot/.well-known
```

create a ssl private key if you do not yet have one.. eg:

openssl genrsa -out /etc/letsencrypt/ssl/privkey.pem 2048

update your webserver to serve the challengefiles eg for nginx..:

location /.well-known {
 alias /srv/certbot/.well-known;
 add_header "Content-Type" "text/plain";
 break;
}

now create your certificate

letsencrypt --key=/etc/letsencrypt/account/key.pem -d"example.com www.example.com" --challenge_dir="/srv/certbot/.well-known" --ssl_dir="/etc/letsencrypt/ssl" --create

hopefully your certificate has be created so update your webserver to use it...

ssl_certificate /etc/letsencrypt/ssl/example.com/cert.pem;
ssl_certificate_key /etc/letsencrypt/ssl/privkey.pem;

reload the webserver and check all is well.

auto renew letsencrypt certificates

the letsencrypt certificates are valid for 90 days. it is recommended that you run a script every day to check if the certificates are due for renewal.

create two shell scrips, one to renew the certificates and another to restart the webserver.
ensure that both scripts are executable..
copy the first script to /etc/cron.daily directory.
link the second script to the --hook option of the letsencrypt command.

eg:

cat /etc/cron.daily/renew_ssl

#!/bin/sh
/opt/ruby-2.6.4/bin/letsencrypt --key=/etc/letsencrypt/account/key.pem \
-d"example.com www.example.com" \
--challenge_dir="/srv/certbot/.well-known" --ssl_dir="/etc/letsencrypt/ssl" \
--logfile=/var/log/letsencrypt.log \
--hook=/root/bin/reload_nginx


cat /root/bin/reload_nginx

#!/bin/sh
/sbin/nginx -t && /sbin/nginx -sreload

blix-letsencrypt

Development