CertGetter - Revision history

Tinker at 05:14, 2 July 2020

2020-07-02T05:14:27Z

Tinker at 05:21, 27 June 2020

2020-06-27T05:21:30Z

Tinker: /* Interim Notes */

2020-06-26T10:40:12Z

Interim Notes

Tinker: /* Interim Notes */

2020-06-26T10:38:03Z

Interim Notes

Tinker: /* Coming Soon... */

2020-06-26T10:37:44Z

Coming Soon...

Tinker at 08:43, 26 June 2020

2020-06-26T08:43:26Z

Tinker: /* Usage */

2020-06-20T20:53:25Z

Usage

Tinker: Created page with "Proper SSL certificates can only be assigned to machines with Internet accessible FQDNs (Fully Qualified Domain Names). On an internal network, this causes all sorts of annoy..."

2020-06-20T19:09:40Z

Created page with "Proper SSL certificates can only be assigned to machines with Internet accessible FQDNs (Fully Qualified Domain Names). On an internal network, this causes all sorts of annoy..."

New page

Proper SSL certificates can only be assigned to machines with Internet accessible FQDNs (Fully Qualified Domain Names). On an internal network, this causes all sorts of annoying problems since modern browsers actively oppose insecure connections (& even a self-signed certificate is considered insecure.)

If your internal network is set up to use your '''actual''' domain, This is a way to get certs for machines that are not accessible from the outside world.

These certs will expire & cannot be renewed automatically, but can be renewed using this same basic procedure. (simply running it again) You can also renew all of the certs this machine has obtained with <code>sudo certbot renew</code>

[https://certbot.eff.org/docs/ Certbot Documentation]

= Setting Up =
* Create a [[SBN - Baseline Server Notes|Baseline Server]]
* Install certbot
** <code>sudo apt-get install certbot</code>

= Usage =
* [[CertGetter - Assign port 80|Assign port 80]] to this machine on your firewall
* [[CertGetter - Assign DNS|Assign DNS]] for the name of the machine you're obtaining certs for
* Wait for the DNS entry to propagate
* Run certbot
** <code>sudo certbot certonly --standalone --dry-run</code>
*** (Always test first with <code>--dry-run</code>)
*** Then run it again if all is ok but without <code>--dry-run</code>
* You will find the resulting certs in <code>/etc/letsencrypt/live/</code> in a subfolder matching the machine name you gave certbot.
* '''fullchain.pem''' is the certificate
* '''privkey.pem''' is the key
* Then simply copy '''fullchain.pem''' & '''privkey.pem''' (following the [[CertGetter - procedures for the OS involved|procedures for the OS involved]]) the cert to the machine in need.
* It is a good idea to [[CertGetter - Assign port 80|disconnect port 80]] from this machine when not in use. (especially if you have an actual webserver...

← Older revision		Revision as of 05:14, 2 July 2020
Line 1:		Line 1:
−	'''<big><u>NOTICE: This is no longer valid! This machines function is being moved to the primary webserver.</u></big>'''	+	'''<big><u>NOTICE: This is no longer valid! This machines function is being moved to the [[SBN - Web Server Notes\|primary webserver]].</u></big>'''

	Proper SSL certificates can only be assigned to machines with Internet accessible FQDNs (Fully Qualified Domain Names). On an internal network, this causes all sorts of annoying problems since modern browsers actively oppose insecure connections (& even a self-signed certificate is considered insecure.)		Proper SSL certificates can only be assigned to machines with Internet accessible FQDNs (Fully Qualified Domain Names). On an internal network, this causes all sorts of annoying problems since modern browsers actively oppose insecure connections (& even a self-signed certificate is considered insecure.)

← Older revision		Revision as of 05:21, 27 June 2020
Line 1:		Line 1:
		+	'''<big><u>NOTICE: This is no longer valid! This machines function is being moved to the primary webserver.</u></big>'''
		+
	Proper SSL certificates can only be assigned to machines with Internet accessible FQDNs (Fully Qualified Domain Names). On an internal network, this causes all sorts of annoying problems since modern browsers actively oppose insecure connections (& even a self-signed certificate is considered insecure.)		Proper SSL certificates can only be assigned to machines with Internet accessible FQDNs (Fully Qualified Domain Names). On an internal network, this causes all sorts of annoying problems since modern browsers actively oppose insecure connections (& even a self-signed certificate is considered insecure.)

@@ Line 30: / Line 30: @@
 *It is a good idea to [[CertGetter - Assign port 80|disconnect port 80]] from this machine when not in use. (especially if you have an actual webserver...
-== Interim Notes ==
+==Interim Notes==
-* To copy certs for a machine to your proxy server
+*To copy certs for a machine to your proxy server (Replace '''Machine.Domain.TLD''' with the proper name for your machine...) (&, of course, '''user''' & '''webserver''' may need adjusting...)
-** First, make sure you can SSH into the proxy server from CertGetter
+**First, make sure you can SSH into the proxy server from CertGetter
-*** <code>ssh webserver</code>
+***<code>ssh webserver</code>
-*** then exit when you've succeeded (this tells CertGetter how to get there...)
+***then exit when you've succeeded (this tells CertGetter how to get there...)
-** Then you can use '''scp''' to copy the certs.
+**Then you can use '''scp''' to copy the certs.
-*** <code>scp -r /etc/letsencrypt/live/Machine.Domain.TLD user@webserver:~</code>
+***<code>scp -r /etc/letsencrypt/live/Machine.Domain.TLD user@webserver:~</code>
-** Then ssh back into the proxy server & move the certs into their proper location
+**Then ssh back into the proxy server & move the certs into their proper location
-** <code>sudo mv Machine.Domain.TLD /etc/letsencrypt/live/</code>
+***<code>sudo mv Machine.Domain.TLD /etc/letsencrypt/live/</code>
 ==Coming Soon...==
 I am currently working on a script or 6 to make CertGetter automatically renew certs & push them to the appropriate machines.  Watch this space.

@@ Line 39: / Line 39: @@
 *** <code>scp -r /etc/letsencrypt/live/Machine.Domain.TLD user@webserver:~</code>
 ** Then ssh back into the proxy server & move the certs into their proper location
-** sudo mv <code>Machine.Domain.TLD /etc/letsencrypt/live/</code>
+** <code>sudo mv Machine.Domain.TLD /etc/letsencrypt/live/</code>
 ==Coming Soon...==
 I am currently working on a script or 6 to make CertGetter automatically renew certs & push them to the appropriate machines.  Watch this space.

@@ Line 30: / Line 30: @@
 *It is a good idea to [[CertGetter - Assign port 80|disconnect port 80]] from this machine when not in use. (especially if you have an actual webserver...
-== Coming Soon... ==
+== Interim Notes ==
 I am currently working on a script or 6 to make CertGetter automatically renew certs & push them to the appropriate machines.  Watch this space.

@@ Line 7: / Line 7: @@
 [https://certbot.eff.org/docs/ Certbot Documentation]
-=Setting Up=
+==Setting Up==
 *Create a [[SBN - Baseline Server Notes|Baseline Server]]
@@ Line 13: / Line 13: @@
 **<code>sudo apt-get install certbot</code>
-=Usage=
+==Usage==
 *[[CertGetter - Assign port 80|Assign port 80]] to this machine on your firewall
@@ Line 29: / Line 29: @@
 *Then simply copy '''fullchain.pem''' & '''privkey.pem''' (following the [[CertGetter - procedures for the OS involved|procedures for the OS involved]]) the cert to the machine in need.
 *It is a good idea to [[CertGetter - Assign port 80|disconnect port 80]] from this machine when not in use. (especially if you have an actual webserver...

@@ Line 7: / Line 7: @@
 [https://certbot.eff.org/docs/ Certbot Documentation]
-= Setting Up =
+=Setting Up=
-= Usage =
+*Create a [[SBN - Baseline Server Notes|Baseline Server]]
-* [[CertGetter - Assign port 80|Assign port 80]] to this machine on your firewall
+*Install certbot
-* [[CertGetter - Assign DNS|Assign DNS]] for the name of the machine you're obtaining certs for
+**<code>sudo apt-get install certbot</code>
 * Wait for the DNS entry to propagate
-* Run certbot
+=Usage=
 ** <code>sudo certbot certonly --standalone --dry-run</code>
-*** (Always test first with <code>--dry-run</code>)
+*[[CertGetter - Assign port 80|Assign port 80]] to this machine on your firewall
-*** Then run it again if all is ok but without <code>--dry-run</code>
+*[[CertGetter - Assign DNS|Assign DNS]] for the name of the machine you're obtaining certs for
-* You will find the resulting certs in <code>/etc/letsencrypt/live/</code> in a subfolder matching the machine name you gave certbot.
+*Wait for the DNS entry to propagate
-* '''fullchain.pem''' is the certificate
+**You can repeatedly try <code>systemd-resolve ''machinename.yourdomain.net''</code> until it shows your outside address...
-* '''privkey.pem''' is the key
+**(Tho, you ''might'' need to do this from outside your local network.)
-* Then simply copy '''fullchain.pem''' & '''privkey.pem''' (following the [[CertGetter - procedures for the OS involved|procedures for the OS involved]]) the cert to the machine in need.
+*Run certbot
-* It is a good idea to [[CertGetter - Assign port 80|disconnect port 80]] from this machine when not in use. (especially if you have an actual webserver...
+**<code>sudo certbot certonly --standalone --dry-run</code>