certboting

certbot in action

0. prerequisites

   • check pip3 list | egrep -i 'pyOpenSSL'

1. re/new
   ref: https://eff-certbot.readthedocs.io/en/stable/using.html

   podman

   certboting-funcs.sh

   function _run_certbot {(
       set -eu
       DEAL=$1
       OTHER=${@:2}
       CWD=$(pwd)
       set -x
       podman run --rm --cap-drop=ALL \
         --umask 0002 \
         -v ${CWD}/work-${DEAL}:/var/lib/letsencrypt \
         -v ${CWD}/logs-${DEAL}:/var/log/letsencrypt \
         -v ${CWD}/conf-${DEAL}:/etc/letsencrypt \
         -it docker.io/certbot/certbot \
       ${OTHER}
   )}
   
   function cbdeal {(
       set -eu
       DEAL=$1
       DNS_OPTIONS=${@:2}
       _run_certbot "$DEAL" show_account || true
       _run_certbot "$DEAL" certonly --manual --preferred-challenges dns ${DNS_OPTIONS}
       tar czvf certpack-${DEAL}.tgz \
           -C conf-${DEAL}/live/$(ls -1rt conf-${DEAL}/live/ | tail -n1) \
           -h fullchain.pem privkey.pem
   )}

   local

   certboting-funcs.sh

   function cbdeal {
       DEAL=$1
       DNS_OPTIONS=$2
       /opt/certbot/bin/certbot show_account \
           --config-dir conf-${DEAL} --work-dir work-${DEAL} --logs-dir logs-${DEAL}
       /opt/certbot/bin/certbot certonly --manual \
           --config-dir conf-${DEAL} --work-dir work-${DEAL} --logs-dir logs-${DEAL} \
           --preferred-challenges dns ${DNS_OPTIONS}
       tar czvf certpack-${DEAL}.tgz \
           -C conf-${DEAL}/live/$(ls -1rt conf-${DEAL}/live/ | tail -n1) \
           -h fullchain.pem privkey.pem
   }

   then

   source certboting-funcs.sh
   cbdeal '<account-folder>' '-d example.com -d www.example.com'

2. copy

   scp ./certpack-{pack1,pack2}.tgz ...:.

3. deploy

   function certinstall {
       Q=$1
       tar xvf certpack-${Q}.tgz
       install -v -o root -g root -m 600 -T privkey.pem /etc/nginx/ssl-private/${Q}-privkey.pem
       install -v -o root -g root -m 644 -T fullchain.pem /etc/nginx/ssl-certs/${Q}-fullchain.pem
       rm -v privkey.pem fullchain.pem certpack-${Q}.tgz
   }

   then at the target machine with nginx

   certinstall <file-suffix>

certbot setup (local)

https://certbot.eff.org/instructions?ws=other&os=pip

sudo apt update
sudo apt install python3 python3-venv libaugeas0

python3 -m venv /opt/certbot/
/opt/certbot/bin/pip install --upgrade pip
/opt/certbot/bin/pip install certbot

/opt/certbot/bin/pip list -o --format=json \
  | jq -r '.[].name' | xargs /opt/certbot/bin/pip install -U