Let's Encrypt wildcard

• https://www.jesusamieiro.com/generar-un-certificado-ssl-wildcard-con-lets-encrypt/
  • https://www.whatsmydns.net/
  • https://dnschecker.org/#TXT/_acme-challenge.fidmag.org
  • https://mxtoolbox.com/SuperTool.aspx?action=txt%3a_acme-challenge.example.com&run=toolpage#
• https://redeslinux.net/guia-completa-pfsense-con-ddns-de-cloudflare-certificados-lets-encrypt-y-haproxy-para-proxy-inverso-y-balanceo-de-carga-de-servicios/
• https://discourse.haproxy.org/t/using-ssl-with-haproxy-for-docker-containers/307
• https://github.com/BradJonesLLC/docker-haproxy-letsencrypt/blob/master/certs.sh
• https://github.com/BradJonesLLC/docker-haproxy-letsencrypt

• primera vegada:

  sudo curl -o /etc/letsencrypt/acme-dns-auth.py https://raw.githubusercontent.com/joohoi/acme-dns-certbot-joohoi/master/acme-dns-auth.py
  sudo chmod +x /etc/letsencrypt/acme-dns-auth.py
  sudo certbot certonly --manual --manual-auth-hook /etc/letsencrypt/acme-dns-auth.py --preferred-challenges dns --debug-challenges -d "*.fidmag.org" -d "fidmag.org"

• creat registre CNAME:

  _acme-challenge.fidmag.org CNAME 1569f935-7bf3-4630-9c3d-5846ad7c956e.auth.acme-dns.io.

  dig _acme-challenge.fidmag.org CNAME +short

• renovacions per cron

  0 7,19 * * * certbot renew --quiet --deploy-hook "/home/fidmag/certbot/renew-dns.sh" > /home/fidmag/certbot/last_exec 2>&1

  • simulacro:

    certbot renew --dry-run

  • comprobar fichero configuración renovación:

    /etc/letsencrypt/renewal/fidmag.org-0001.conf

    # Options used in the renewal process
    [renewalparams]
    account = ***
    pref_challs = dns-01,
    authenticator = manual
    server = https://acme-v02.api.letsencrypt.org/directory
    key_type = ecdsa
    manual_auth_hook = /etc/letsencrypt/acme-dns-auth.py

  • Let's encrypt recomienda comprobar 2 veces al día (Gemini dixit)
  • --deploy-hook: script a ejecutar si la renovación es exitosa

sudo certbot certonly --manual --preferred-challenges=dns --email informatica@fidmag.org --server https://acme-v02.api.letsencrypt.org/directory --agree-tos -d *.fidmag.org

sudo certbot certificates

sudo certbot delete --cert-name <CERT_NAME>