0

I asked a question earlier about Let's Encrypt details at How can I use Let's Encrypt (letsencrypt.org) as a free SSL certificate provider?, and @warren answered, saying:

I have written a pair of how-tos for running Let's Encrypt SSL certs on CentOS: initial setup & cronning it.

Based on that, I had a weekly crontab entry that called a script: 

#!/bin/bash
cd ~/letsencrypt
git pull
apachectl stop
~/letsencrypt/letsencrypt-auto --agree-tos --keep --rsa-key-size 2048 --standalone certonly -m root@firstdomain.tld -d firstdomain.tld -d seconddomain.tld -d jobhunttracker.com -d thirddomain.tld -d subdomain.firstdomain.tld -d fourthdomain.tld
apachectl start

I see one discrepancy with cronning it, namely that I specified four second level domains and one subdomain of the first domain, where the sample code specifies one second level domain and leaves a door open to 0 or more subdomains of the initial domain. Beyond that, I thought I was following the crontab article.

I received one or two notices by email stating that I needed to update my Let's Encrypt certificates; puzzled, I ran the crontab by hand, and after it said everything was up-to-date.

When it wasn't updating things, I renamed /etc/letsencrypt, and found that that was not a solution; it wanted some things kept in place. The eventual solution I had found involved renaming /etc/letsencrypt/archive and /etc/letsencrypt/live and then running letsencrypt-auto one time per -d domain.tld because letsencrypt-auto only seemed to see the first top-level domain specified. And then manually editing the VirtualHosts under /etc/sites-enabled because existing code referenced certificates etc. under /etc/letsencrypt/live/domain.tld/ but the new certificates were installed under /etc/letsencrypt/live/domain.tld-0001/.

Now my sites seem to be live without a certificate error, but so far as I can tell the initial setup article was a hit, while the cronning it post was a miss.

How can I set things up for a smoother update process next year?

Community
  • 1
Christos Hayward
  • 1,162
  • 3
  • 16
  • 35
  • 2
    _Both_ of his articles are out of date and should not be used as-is. Not to mention that stopping the web server is completely unnecessary. – Michael Hampton Jul 05 '16 at 18:04
  • Thanks for the heads up, @MichaelHampton! Are you able to point me to any articles that are current? – Christos Hayward Jul 05 '16 at 18:05
  • I don't have one handy. There's some good info in some previous [tag:lets-encrypt] questions. I will try to write something later if I get time. – Michael Hampton Jul 05 '16 at 18:07
  • That looks very useful. – Christos Hayward Jul 06 '16 at 18:59
  • @MichaelHampton, I'm coming back several later with a new site where I want to enable Let's Encrypt. A search for [lets-encrypt](http://serverfault.com/questions/tagged/lets-encrypt) turns up a big head of questions that are about integrating Let's Encrypt with XYZ other technology. Could you point me to, or possibly write, an answer that documents current ways of plain vanilla Let's Encrypt addition of an additional secure site? – Christos Hayward Dec 22 '16 at 22:12

0 Answers0