Deutsche Version

Back to overview

SSL Certificates

SSL management uses certbot with the Apache plugin.

ssl create, ssl delete and ssl renew only run with ST_WEBSERVER=apache. With nginx they abort with ... only supports Apache ... Nginx SSL support is not yet implemented. ssl wildcard does not check the webserver backend and runs with both backends, but it needs a configured DNS provider. ssl list and ssl check only read certbot or /etc/letsencrypt and also work with both backends.

Create a certificate

server-tools ssl create --domain example.com
server-tools ssl create --domain example.com --email admin@example.com

Flow:

1. The domain is checked. An Apache VHost <domain>.conf must exist for it, otherwise the command aborts.
2. If certbot is not installed, the tool installs the packages certbot and python3-certbot-apache via apt-get.
3. The email address is determined in this order: --email, ST_CERTBOT_EMAIL, webmaster@<domain>. If the address is invalid, the tool uses webmaster@<domain> with a warning.
4. certbot --apache -d <domain> --non-interactive --agree-tos --email <address>.
5. For proxy VHosts, the tool sets the targets https://localhost, https://127.0.0.1 and https://[::1] in ProxyPass and ProxyPassReverse of the generated <domain>-le-ssl.conf back to http://, because the backend usually does not speak TLS.
6. Apache is reloaded.

The certificate only covers the given domain. Aliases of the VHost are not included.

Wildcard certificate

server-tools ssl wildcard --domain example.com --provider cloudflare

Requirements and flow:

1. The provider comes from --provider or ST_DNS_PROVIDER. Supported: cloudflare, digitalocean, route53, google, linode, ovh.
2. If the package python3-certbot-dns-<provider> is missing, it is installed via apt-get.
3. The file with the API credentials must exist: ST_DNS_CREDENTIALS_FILE or /root/.certbot-dns-<provider>.ini. If it is missing, the tool shows an example of the content for cloudflare and digitalocean.
4. certbot certonly --dns-<provider> --dns-<provider>-credentials <file> -d <domain> -d *.<domain> --non-interactive --agree-tos, with ST_CERTBOT_EMAIL or webmaster@<domain>.

There is no --email option for wildcard certificates. The tool does not set up VHost SSL and does not change any Apache configuration. You have to include the certificate in a VHost yourself.

Delete a certificate

server-tools ssl delete --domain example.com

The certificate under /etc/letsencrypt/live/<domain> must exist. After the prompt the tool calls certbot delete --cert-name <domain>, removes /etc/apache2/sites-available/<domain>-le-ssl.conf and reloads Apache. The file <domain>.conf is left untouched.

List and check expiry

server-tools ssl list
server-tools ssl check --days 14

list prints certbot certificates. check reads all certificates in /etc/letsencrypt/live/ and shows those that expire in at most --days days (default 30) as <domain>: expires in <n> days. Already expired certificates appear with a negative number of days.

Set up automatic renewal

server-tools ssl renew

The command does not renew by itself, it sets up the renewal:

Existing files are overwritten without a prompt. To test:

sudo certbot renew --dry-run

Recreate all certificates (menu only)

The menu offers "Recreate all certificates (Apache mode)". The tool finds all certificates in /etc/letsencrypt/live/ for which an Apache VHost exists and asks All certificates will be deleted and recreated!. Then, for each domain, the SSL site and <domain>-le-ssl.conf are removed, Apache is reloaded, all certificates are deleted and requested again via certbot --apache. At the end it prints Results: <success>/<total> successful.

During the process the domains are reachable without HTTPS. If requesting a domain again fails, it stays without a certificate.

Next

• Virtual hosts
• Troubleshooting