Wildcard Certificates with acme.sh - Revision history

320x200: /* Request a wildcard cert for lurk.org */

2025-08-17T15:05:45Z

Request a wildcard cert for lurk.org

← Older revision		Revision as of 15:05, 17 August 2025
Line 26:		Line 26:

	acme.sh --issue --dns dns_porkbun -d lurk.org -d *.lurk.org		acme.sh --issue --dns dns_porkbun -d lurk.org -d *.lurk.org

			<span style="background:#00FF00">Should be set and forget. Do not run the issue command again to force renew a cert, see maintenance section above.</span>

	result:		result:

2025-08-17T15:04:32Z

Install the certs for nginx

← Older revision		Revision as of 15:04, 17 August 2025
Line 35:		Line 35:

	== Install the certs for nginx ==		== Install the certs for nginx ==
	The following command will install the certs for nginx, assuming there is a <code>/etc/nginx/certs/</code> directory. Should be set and forget.		The following command will install the certs for nginx, assuming there is a <code>/etc/nginx/certs/</code> directory. <span style="background:#00FF00">Should be set and forget. Do not run this command to force renew a cert, see maintenance section above.</span>
			mkdir /etc/nginx/certs
	acme.sh --install-cert -d lurk.org -d *.lurk.org --key-file /etc/nginx/certs/key.pem --fullchain-file /etc/nginx/certs/cert.pem --reloadcmd "systemctl force-reload nginx"		acme.sh --install-cert -d lurk.org -d *.lurk.org --key-file /etc/nginx/certs/key.pem --fullchain-file /etc/nginx/certs/cert.pem --reloadcmd "systemctl force-reload nginx"

2025-08-17T15:03:07Z

Deployment for other services

← Older revision		Revision as of 15:03, 17 August 2025
Line 39:		Line 39:

	== Deployment for other services ==		== Deployment for other services ==
			=== Configuration ===
	<code>acme.sh</code> can also support custom installs of the certificates. They call this deployment, and all the scripts provided by the project can be found in <code>/root/.acme.sh/deploy</code>.		<code>acme.sh</code> can also support custom installs of the certificates. They call this deployment, and all the scripts provided by the project can be found in <code>/root/.acme.sh/deploy</code>.

Line 79:		Line 80:
	To enable the deployment at every cert renewal:		To enable the deployment at every cert renewal:
	acme.sh --deploy -d lurk.org -d *.lurk.org --deploy-hook cooldaemon		acme.sh --deploy -d lurk.org -d *.lurk.org --deploy-hook cooldaemon

			=== Fine tuning ===
			The configured hook can be found listed in the domain name conf file (for instance <code>lurk.org.conf</code>): <code>Le_DeployHook='cooldaemon,anothercooldaemon,'</code>.

	== Old Stuff ==		== Old Stuff ==

2025-08-17T15:00:05Z

Old Stuff

← Older revision		Revision as of 15:00, 17 August 2025
Line 81:		Line 81:

	== Old Stuff ==		== Old Stuff ==
	Left for future ref in case we need this again in the future. Otherwise, please ignore and do not use		<span style="background:#00FF00">Left for future ref in case we need this again in the future. Otherwise, please ignore and do not use</span>

	=== set up a cron job ===		=== set up a cron job ===

2025-08-17T14:58:17Z

← Older revision		Revision as of 14:58, 17 August 2025
Line 1:		Line 1:
	<code>acme.sh</code> is a lightweight shell script based tool to handle Let's Encrypt certificates, etc.		<code>acme.sh</code> is a lightweight shell script based tool to handle Let's Encrypt certificates, etc.

	== Install ~~the bash script~~ ==		== Installation and maintenance ==
			All commands are for <code>root</code>.
			=== Install ===
	wget https://get.acme.sh		wget https://get.acme.sh
			sh acme.sh

	As root:		This will install the script to <code>/root/.acme</code> and add it to path by sourcing a script from root's <code>.bashrc</code>

	sh acme.sh

	~~This will install the script to~~ <code>~~/root/~~.~~acme~~</code> ~~and add it to path by sourcing a script from~~ root~~'s <code>~~.~~bashrc<~~/~~code>~~		=== Maintenance ===
			* upgrade
			acme.sh --uprade
			* force renew already configured/installed certs
			acme.sh --renew-all --force
			* what is wrong? (requires enabling logging in <code>account.conf</code>)
			less /root/.acme.sh/acme.sh.log

	== Request a wildcard cert for lurk.org ==		== Request a wildcard cert for lurk.org ==

2025-08-17T14:47:31Z

set up a cron job

← Older revision		Revision as of 14:47, 17 August 2025
Line 73:		Line 73:
	acme.sh --deploy -d lurk.org -d *.lurk.org --deploy-hook cooldaemon		acme.sh --deploy -d lurk.org -d *.lurk.org --deploy-hook cooldaemon

	== set up a cron job ==		== Old Stuff ==
			Left for future ref in case we need this again in the future. Otherwise, please ignore and do not use

			=== set up a cron job ===
	24 3 * * * "/root/.acme.sh"/acme.sh --cron --home "/root/.acme.sh" --reloadcmd "systemctl force-reload nginx" --renew-hook "/root/icecast_certs.sh"		24 3 * * * "/root/.acme.sh"/acme.sh --cron --home "/root/.acme.sh" --reloadcmd "systemctl force-reload nginx" --renew-hook "/root/icecast_certs.sh"

2025-03-05T10:31:28Z

add cron and icecast stuff

@@ Line 72: / Line 72: @@
 To enable the deployment at every cert renewal:
   acme.sh --deploy -d lurk.org -d *.lurk.org --deploy-hook cooldaemon
 [[Category:Certificates]]

2024-10-12T23:06:31Z

Deployment for other services

← Older revision		Revision as of 23:06, 12 October 2024
Line 32:		Line 32:

	== Deployment for other services ==		== Deployment for other services ==
			<code>acme.sh</code> can also support custom installs of the certificates. They call this deployment, and all the scripts provided by the project can be found in <code>/root/.acme.sh/deploy</code>.

			It's possible to make new deploy scripts quite easily, here is an example for <code>cooldaemon.sh</code>:
			<pre>
			# this makes accessible as variables all the necessary paths and files
			cooldaemon_deploy() {
			_cdomain="$1"
			_ckey="$2"
			_ccert="$3"
			_cca="$4"
			_cfullchain="$5"

			_debug _cdomain "$_cdomain"
			_debug _ckey "$_ckey"
			_debug _ccert "$_ccert"
			_debug _cca "$_cca"
			_debug _cfullchain "$_cfullchain"

			# make a var for the target location
			_ssl_path="/etc/cooldaemon/certs/"

			# cooldaemon only needs the fullchain perm and the key so
			# we only copy these
			cp $_ckey $_ssl_path
			cp $_cfullchain $_ssl_path

			# any extra commands can be added here for instance
			# maybe cooldaemon is picky about cert ownership
			chown -R cooldaemon:cooldaemon $_ssl_path

			# last but not least we reload cool daemon
			# please note that some other daemons may need a restart instead
			systemctl reload mumble-server

			return 0
			}
			</pre>

			To enable the deployment at every cert renewal:
			acme.sh --deploy -d lurk.org -d *.lurk.org --deploy-hook cooldaemon


	[[Category:Certificates]]		[[Category:Certificates]]

2024-10-12T22:55:42Z

Install the certs for nginx

← Older revision		Revision as of 22:55, 12 October 2024
Line 28:		Line 28:

	== Install the certs for nginx ==		== Install the certs for nginx ==
			The following command will install the certs for nginx, assuming there is a <code>/etc/nginx/certs/</code> directory. Should be set and forget.
	acme.sh --install-cert -d lurk.org -d *.lurk.org --key-file /etc/nginx/certs/key.pem --fullchain-file /etc/nginx/certs/cert.pem --reloadcmd "systemctl force-reload nginx"		acme.sh --install-cert -d lurk.org -d *.lurk.org --key-file /etc/nginx/certs/key.pem --fullchain-file /etc/nginx/certs/cert.pem --reloadcmd "systemctl force-reload nginx"

2024-10-12T22:39:17Z

Install the certs for nginx

← Older revision		Revision as of 22:39, 12 October 2024
Line 28:		Line 28:

	== Install the certs for nginx ==		== Install the certs for nginx ==
			acme.sh --install-cert -d lurk.org -d *.lurk.org --key-file /etc/nginx/certs/key.pem --fullchain-file /etc/nginx/certs/cert.pem --reloadcmd "systemctl force-reload nginx"

	== Deployment for other services ==		== Deployment for other services ==