MoinQ: Letsencrypt/certbot/renew

/APIplugin

Letsencrypt/certbot/manual_mode/dns-01/ubuntu/wildcard

DNS APIが用意できていないので、manualモードで再取得した。-- ToshinoriMaeno 2021-07-01 18:44:56 

以下のあとで、/nginxのreloadが必要 (Makefileあり) OK -- ToshinoriMaeno 2021-09-25 03:34:10

sudo nginx -s reload

1. 2022-02-15

2/15 logを見ると、manual plugin が/エラーになっていた。手動で試すか。-- ToshinoriMaeno 2022-02-15 13:26:51

• 手動だと、2箇所のzone のTXTを修正することになって面倒なので、一箇所に直すか。
  • あるいはrenewが動くようにするか。

IMPORTANT NOTES:
 - Congratulations! Your certificate and chain have been saved at:
   /etc/letsencrypt/live/qmail.jp/fullchain.pem
   Your key file has been saved at:
   /etc/letsencrypt/live/qmail.jp/privkey.pem
   Your cert will expire on 2022-05-16. To obtain a new or tweaked
   version of this certificate in the future, simply run certbot
   again. To non-interactively renew *all* of your certificates, run
   "certbot renew"
 - If you like Certbot, please consider supporting our work by:

   Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
   Donating to EFF:                    https://eff.org/donate-le

2. 2022-02-05

_acmchallenge.* TXT を一度セットしておけば、renewもいけるという話だったので、試す。 crontab に /usr/bin/crontab を入れて、一日一回実行することに。

• log --> /var/log/letsencryptに出る。

うまくいかない。理由は未解明。

3. 2021-09-25

# certbot certonly --manual -d \*.qmail.jp

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Please deploy a DNS TXT record under the name
_acme-challenge.qmail.jp with the following value:

q3QPXwj50vnseJfauHg_Csyf336YoTSFKcTZtiscS90
   このtextレコードをtinydns zoneに追加する。(副サーバーへも)

Before continuing, verify the record is deployed.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Press Enter to Continue
Waiting for verification...
Cleaning up challenges

IMPORTANT NOTES:
 - Congratulations! Your certificate and chain have been saved at:
   /etc/letsencrypt/live/qmail.jp/fullchain.pem
   Your key file has been saved at:
   /etc/letsencrypt/live/qmail.jp/privkey.pem
   Your cert will expire on 2021-12-24. To obtain a new or tweaked
   version of this certificate in the future, simply run certbot
   again. To non-interactively renew *all* of your certificates, run
   "certbot renew"
 - If you like Certbot, please consider supporting our work by:

   Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
   Donating to EFF:                    https://eff.org/donate-le

CategoryDns CategoryWatch CategoryTemplate