View source for CERTBOT - Base Documentation

[[Category:Wiki]]

'''''[https://it-arts.net/index.php/Category:Wiki Return to Wiki Index]'''''

== Certbot Overview ==

=== Core Concepts ===
Certbot is an automated tool to help manage SSL/TLS certificates for web servers, typically from **Let's Encrypt**. It helps with obtaining, renewing, and installing certificates. The tool uses the ACME protocol to communicate with Certificate Authorities (CAs).

Certbot can automatically configure your web server (Apache, Nginx, etc.) to use the certificates and manage renewals.

=== Supported Web Servers ===
Certbot supports the following web servers:
* Apache
* Nginx
* Lighttpd
* Manual configuration for other servers

=== ACME Challenges ===
Certbot uses ACME challenges to verify domain ownership. The two main types are:
* **HTTP-01** (HTTP challenge)
* **DNS-01** (DNS challenge)

== Basic Commands ==

=== Obtaining a Certificate ===
The most common command to obtain a certificate for a domain:
 <nowiki>
certbot --apache -d example.com -d www.example.com</nowiki>

This will:
1. Obtain the certificate.
2. Automatically configure Apache to use the certificate.

For Nginx:
 <nowiki>
certbot --nginx -d example.com -d www.example.com</nowiki>

Example for manual configuration:
 <nowiki>
certbot certonly --manual -d example.com</nowiki>

=== Renewing Certificates ===
Renewal of certificates is done automatically with:
 <nowiki>
certbot renew</nowiki>

This command will check all installed certificates and renew those that are near expiration.

It is recommended to run this as a cron job for automatic renewal.

Example of a cron job:
 <nowiki>
0 0,12 * * * certbot renew --quiet</nowiki>

This will run the renewal twice a day at midnight and noon.

== Configuration and Automation ==

=== Auto-Renewal and Cron Jobs ===
Certbot's auto-renewal process is controlled via the `certbot renew` command. By default, Certbot installs a cron job or systemd timer to automatically handle renewals.

For manual configuration of a cron job:
 <nowiki>
crontab -e</nowiki>
Add:
 <nowiki>
0 0 * * * certbot renew --quiet</nowiki>

Ensure **--quiet** is added to avoid unnecessary output.

== Security Concepts ==

=== Securing the Certificate Private Key ===
After obtaining a certificate, the private key is stored in:
 <nowiki>
/etc/letsencrypt/live/{domain}/privkey.pem</nowiki>

Access to this private key should be restricted to the root user only to avoid unauthorized decryption of traffic.

Ensure proper permissions:
 <nowiki>
chmod 600 /etc/letsencrypt/live/{domain}/privkey.pem</nowiki>

Additionally, the private key should be stored in a secure location with regular backups.

=== Security of Certbot Configuration Files ===
Certbot's configuration files, such as `/etc/letsencrypt/renewal/{domain}.conf`, should also be protected from unauthorized access.

Example:
 <nowiki>
chmod 600 /etc/letsencrypt/renewal/{domain}.conf</nowiki>

The `/etc/letsencrypt/` directory should only be accessible by root to prevent unauthorized users from manipulating certificates or renewal configurations.

== DNS Challenges and Advanced Configurations ==

=== DNS-01 Challenge ===
The DNS-01 challenge requires creating a DNS TXT record to prove domain ownership. This is useful when HTTP-01 challenges are not possible.

Example for DNS challenge:
 <nowiki>
certbot --manual --preferred-challenges dns -d example.com -d www.example.com</nowiki>

This will prompt the user to add the DNS TXT record and proceed with validation.

For automated DNS-01 with DNS providers (e.g., Cloudflare, AWS Route 53):
 <nowiki>
certbot -a dns-cloudflare -d example.com</nowiki>

This method doesn't require a web server to be running and is suitable for wildcard certificates.

== Certificate Renewal and Troubleshooting ==

=== Troubleshooting Certificate Renewal ===

=== Expired or Invalid Certificates ===
If Certbot is unable to renew a certificate, common issues could include:
* Misconfigured DNS records
* HTTP server is not responding to ACME challenges
* Certbot is running out of permissions for renewal directories

To force a renewal attempt and see detailed output:
 <nowiki>
certbot renew --force-renewal --debug</nowiki>

Check for specific error messages related to DNS, permissions, or rate limits.

=== Rate Limits ===
Let's Encrypt imposes rate limits to prevent abuse. Common rate limits include:
* **Duplicate certificate limit**: 5 identical certificates per week
* **Failed validation limit**: 5 failed validations per hour

For more details on rate limits:
 <nowiki>
https://letsencrypt.org/docs/rate-limits/</nowiki>

If you've hit a rate limit, you'll need to wait for the limit to reset before trying again.

=== Verifying Certificate Installation ===
You can verify the correct installation and renewal of certificates by checking the status of the installed certificates:
 <nowiki>
certbot certificates</nowiki>

This command will display:
* List of certificates
* Expiry date
* Domains associated with the certificate

For a deeper inspection of certificate details:
 <nowiki>openssl x509 -in /etc/letsencrypt/live/example.com/cert.pem -text -noout</nowiki>

== Advanced Topics ==

=== Wildcard Certificates ===
Wildcard certificates are used to secure all subdomains of a domain. They require DNS-01 challenge.

Example command for a wildcard certificate:
 <nowiki>
certbot -d example.com -d '*.example.com' --manual --preferred-challenges dns</nowiki>

You will be prompted to add a DNS TXT record for validation.

Automating wildcard certificates is possible with supported DNS APIs, e.g., Cloudflare, AWS, etc.

=== Using Certbot with Docker ===
Certbot can be used in Docker environments for isolated certificate management.

Example Docker usage:
 <nowiki>
docker run -it --rm -v "/path/to/certbot/config:/etc/letsencrypt" -v "/path/to/certbot/logs:/var/log/letsencrypt" certbot/certbot certonly --standalone -d example.com</nowiki>

This runs Certbot inside a Docker container and obtains certificates via the standalone server.

== Useful Links ==

* https://certbot.eff.org/docs/
* https://letsencrypt.org/docs/rate-limits/
* https://man7.org/linux/man-pages/man1/certbot.1.html
* https://letsencrypt.org/
* https://www.digitalocean.com/community/tutorials/how-to-automate-ssl-certificate-renewals-with-let-s-encrypt-and-certbot
* https://www.nginx.com/blog/automating-ssl-certificate-renewals-with-lets-encrypt-and-certbot/
* https://certbot-dns-cloudflare.readthedocs.io/en/stable/

----

'''''[https://it-arts.net/index.php/Category:Wiki Return to Wiki Index]'''''