= !Letsencrypt/Certbot activeren op SYN-3 = Via [https://letsencrypt.org/ Let's Encrypt] is het mogelijk om automatisch en veilig een SSL certificaat te verkrijgen. Nadat u dit eenmaal opgezet heeft heeft u er geen omkijken meer aan. * U heeft minimaal SYN-3 versie 5.1 nodig == Activeren == * Stel de gewenste dominen in in `/etc/webint/SSL_DOMAINS`. 1 domein per regel: {{{ [Syn-3] root@test.datux.nl ~# mcedit /etc/webint/SSL_DOMAINS test.datux.nl }}} * Vraag het initiele certificaat aan met het `syn3-acme-issue` commando: {{{ [Syn-3] root@test.datux.nl ~# syn3-acme-issue SYN-3: Issueing TEST certificate Stopping /service/apache2/ ...OK [Wed Mar 25 14:11:07 CET 2020] Using stage ACME_DIRECTORY: https://acme-staging-v02.api.letsencrypt.org/directory [Wed Mar 25 14:11:08 CET 2020] Standalone mode. [Wed Mar 25 14:11:08 CET 2020] Create account key ok. [Wed Mar 25 14:11:08 CET 2020] Registering account [Wed Mar 25 14:11:10 CET 2020] Registered [Wed Mar 25 14:11:10 CET 2020] ACCOUNT_THUMBPRINT='EdyZNMe80AOVAZMsAFqRk2Np4ay3mUWnPKNaJq2xSZE' [Wed Mar 25 14:11:10 CET 2020] Creating domain key [Wed Mar 25 14:11:10 CET 2020] The domain key is here: /etc/acme/test/test.datux.nl/test.datux.nl.key [Wed Mar 25 14:11:10 CET 2020] Single domain='test.datux.nl' [Wed Mar 25 14:11:11 CET 2020] Getting domain auth token for each domain [Wed Mar 25 14:11:12 CET 2020] Getting webroot for domain='test.datux.nl' [Wed Mar 25 14:11:12 CET 2020] Verifying: test.datux.nl [Wed Mar 25 14:11:12 CET 2020] Standalone mode server [Wed Mar 25 14:11:16 CET 2020] Success [Wed Mar 25 14:11:16 CET 2020] Verify finished, start to sign. [Wed Mar 25 14:11:16 CET 2020] Lets finalize the order, Le_OrderFinalize: https://acme-staging-v02.api.letsencrypt.org/acme/finalize/12897409/81101479 [Wed Mar 25 14:11:18 CET 2020] Download cert, Le_LinkCert: https://acme-staging-v02.api.letsencrypt.org/acme/cert/fae2710c15cfa0f9b3bf829dc7456eb2de9e [Wed Mar 25 14:11:19 CET 2020] Cert success. -----BEGIN CERTIFICATE----- MIIFNjCCBB6gAwIBAgITAPricQwVz6D5s7+CncdFbrLenjANBgkqhkiG9w0BAQsF ADAiMSAwHgYDVQQDDBdGYWtlIExFIEludGVybWVkaWF0ZSBYMTAeFw0yMDAzMjUx ... y/E8JgQOITv+3DPndSb/kEr+rf4E8ZO9a8JJIAtEwLuyOjHSxYIySFea21Kyk4If b+8rz8+czgNDIDq1T866I4EyfbI6U0F4Eh5pqzW82rhxoB0+62Vox6KZhhh54/45 IzwzVe1d9fYnnDDFpFfSfxKe+TGaIuK1p6BYgl5yoO5dGUAJnpslU2Wd -----END CERTIFICATE----- [Wed Mar 25 14:11:19 CET 2020] Your cert is in /etc/acme/test/test.datux.nl/test.datux.nl.cer [Wed Mar 25 14:11:19 CET 2020] Your cert key is in /etc/acme/test/test.datux.nl/test.datux.nl.key [Wed Mar 25 14:11:19 CET 2020] The intermediate CA cert is in /etc/acme/test/test.datux.nl/ca.cer [Wed Mar 25 14:11:19 CET 2020] And the full chain certs is there: /etc/acme/test/test.datux.nl/fullchain.cer Starting /service/apache2/ ...DONE SYN-3: Issueing LIVE certificate Stopping /service/apache2/ ....OK [Wed Mar 25 14:11:20 CET 2020] Standalone mode. [Wed Mar 25 14:11:21 CET 2020] Create account key ok. [Wed Mar 25 14:11:21 CET 2020] Registering account [Wed Mar 25 14:11:22 CET 2020] Registered [Wed Mar 25 14:11:22 CET 2020] ACCOUNT_THUMBPRINT='FdPrS_aYthE1QzCudmNH9cq42dOo2TV4ur2rpnOgI5o' [Wed Mar 25 14:11:22 CET 2020] Creating domain key [Wed Mar 25 14:11:22 CET 2020] The domain key is here: /etc/acme/live/test.datux.nl/test.datux.nl.key [Wed Mar 25 14:11:22 CET 2020] Single domain='test.datux.nl' [Wed Mar 25 14:11:22 CET 2020] Getting domain auth token for each domain [Wed Mar 25 14:11:24 CET 2020] Getting webroot for domain='test.datux.nl' [Wed Mar 25 14:11:24 CET 2020] Verifying: test.datux.nl [Wed Mar 25 14:11:24 CET 2020] Standalone mode server [Wed Mar 25 14:11:28 CET 2020] Success [Wed Mar 25 14:11:28 CET 2020] Verify finished, start to sign. [Wed Mar 25 14:11:28 CET 2020] Lets finalize the order, Le_OrderFinalize: https://acme-v02.api.letsencrypt.org/acme/finalize/81553945/2775105307 [Wed Mar 25 14:11:30 CET 2020] Download cert, Le_LinkCert: https://acme-v02.api.letsencrypt.org/acme/cert/041ac68861d3d4feb7030d1aafb8c13a0595 [Wed Mar 25 14:11:31 CET 2020] Cert success. -----BEGIN CERTIFICATE----- MIIFVDCCBDygAwIBAgISBBrGiGHT1P63Aw0ar7jBOgWVMA0GCSqGSIb3DQEBCwUA MEoxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MSMwIQYDVQQD ... 7uY3aEZ+bfp8NH7xIkD/jpjoSUKYadvg86ZcoVc5bnFL7ekC8uBnogO2j29Y7Pb4 glRCWdfbjGBxuOCLL7HAwHes7NxsQlDN -----END CERTIFICATE----- [Wed Mar 25 14:11:31 CET 2020] Your cert is in /etc/acme/live/test.datux.nl/test.datux.nl.cer [Wed Mar 25 14:11:31 CET 2020] Your cert key is in /etc/acme/live/test.datux.nl/test.datux.nl.key [Wed Mar 25 14:11:31 CET 2020] The intermediate CA cert is in /etc/acme/live/test.datux.nl/ca.cer [Wed Mar 25 14:11:31 CET 2020] And the full chain certs is there: /etc/acme/live/test.datux.nl/fullchain.cer [Wed Mar 25 14:11:31 CET 2020] Installing key to:/usr/webint/ssl/server.pem [Wed Mar 25 14:11:31 CET 2020] Installing full chain to:/usr/webint/ssl/server.crt Starting /service/apache2/ ...DONE }}} Er word eerst een test certificaat aangevraagd en daarna een echt certificaat. Hierna is het certificaat actief. === Vernieuwen === Het vernieuwen gebeurd wekelijks automatisch door een cronjob. U kunt in de SYN-3 montoring zien of dit goed gegaan is. Als er wat mis gaat kunt u handmatig vernieuwen via `syn3-acme-renew` om te zien wat er gebeurd: {{{ [Syn-3] root@test.datux.nl ~# syn3-acme-renew SYN-3: Renewing live certificate Stopping /service/apache2/ ...OK [Wed Mar 25 14:11:42 CET 2020] ===Starting cron=== [Wed Mar 25 14:11:42 CET 2020] Renew: 'test.datux.nl' [Wed Mar 25 14:11:42 CET 2020] Skip, Next renewal time is: Sun May 24 15:11:31 2020 [Wed Mar 25 14:11:42 CET 2020] Add '--force' to force to renew. [Wed Mar 25 14:11:42 CET 2020] Skipped test.datux.nl [Wed Mar 25 14:11:42 CET 2020] ===End cron=== Starting /service/apache2/ ...DONE [Syn-3] root@test.datux.nl ~# }}}