{"id":477,"date":"2015-12-30T09:35:40","date_gmt":"2015-12-30T14:35:40","guid":{"rendered":"http:\/\/muthii.com\/blog\/?p=477"},"modified":"2016-01-11T21:58:59","modified_gmt":"2016-01-12T02:58:59","slug":"automate-letsencrypt-certificate-renewal","status":"publish","type":"post","link":"https:\/\/muthii.com\/blog\/?p=477","title":{"rendered":"Automate letsencrypt certificate renewal"},"content":{"rendered":"

I recently switched from self signed certs to free SSL certs from letsencrypt <\/a>and for the first time I could load my https url without getting the annoying prompt from chrome due to self signed certificates. The only problem is the certs expire pretty fast in about 90 days as of this writing, while this is nothing to complain about since the certs are free handling the renewal each time manually would be a pain and also leave me in a bind in case I forgot to do it.
\nI decided to automate the renewal process to save myself the hassle of having to do it manually and found two resources here<\/a> and here<\/a> on how to do it, I went with a combination of the two methods as my requirements were different.
\nI wanted the renewal to be run from a script to support email notification on success or failures which is similar to the first source and use the webroot plugin to perform renewal as it has lesser steps to perform renewal reducing any failure points during the process like the second source. The script needed to be able to run everyday and check cert expiration I didn’t want to hard code the cron job to run based on how long the certs are valid that way if letsencrypt changes the life of the certs no change is required on my side.
\nLet’s get started I won’t cover the install as that’s covered by letsencrypt<\/a> site, I would advise you to read the different install methods and choose the one that best fits your needs.
\nAfter performing the install
\nCreate your config file which will contain the arguments submitted to letsencrypt api I named mine “muthii.com.ini”
\n
\nrsa-key-size = 4096
\nserver = https:\/\/acme-v01.api.letsencrypt.org\/directory
\ntext = True
\nauthenticator = webroot
\nagree-tos = True
\nrenew-by-default = True
\nemail = root@domain.com
\nwebroot-path = \/your\/webserver\/path
\n<\/code><\/p>\n

Run the command used to create\/renew your certs, which creates the certs for you and shows you the path to find them.
\n[cc lang=”bash”]\/root\/.local\/share\/letsencrypt\/bin\/letsencrypt -c \/path\/muthii.com.ini -d muthii.com -d www.muthii.com auth[\/cc]<\/p>\n

Only run the above command if you haven’t created your certs or are ready to renew your current certs, otherwise just grab the script file<\/a> and add it to your cron. Make sure to change the emails and file paths based on your setup. I have commented out the echo statements and only enable then for testing<\/p>\n

For someone doing this for the first time locate your ssl.conf file used by your server and set the paths to the new certs<\/p>\n

SSLCertificateFile \/etc\/letsencrypt\/live\/domain.com\/cert.pem
\nSSLCertificateKeyFile \/etc\/letsencrypt\/live\/domain.com\/privkey.pem
\nSSLCertificateChainFile \/etc\/letsencrypt\/live\/domain.com\/fullchain.pem<\/p>\n

Once you are done setting up head over to SSLLabs<\/a> and test your certificate is recognized as expected, then setup a cron job to run the script daily .<\/p>\n

0 2 * * * sh \/path\/SSLRenew.sh<\/code><\/p>\n","protected":false},"excerpt":{"rendered":"

I recently switched from self signed certs to free SSL certs from letsencrypt and for the first time I could load my https url without getting the annoying prompt from chrome due to self signed certificates. The only problem is the certs expire pretty fast in about 90 days as of this writing, while this … <\/p>\n

Continue reading “Automate letsencrypt certificate renewal”<\/span><\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5,102,83,10],"tags":[145,147,146],"_links":{"self":[{"href":"https:\/\/muthii.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/477"}],"collection":[{"href":"https:\/\/muthii.com\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/muthii.com\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/muthii.com\/blog\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/muthii.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=477"}],"version-history":[{"count":10,"href":"https:\/\/muthii.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/477\/revisions"}],"predecessor-version":[{"id":488,"href":"https:\/\/muthii.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/477\/revisions\/488"}],"wp:attachment":[{"href":"https:\/\/muthii.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=477"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/muthii.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=477"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/muthii.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=477"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}