@ -13,7 +13,7 @@
"articleSection" : "post",
"articleSection" : "post",
"name" : "auto fetch Wildcard ssl certs with lego \x2b acme-dns ( Domain Register : Namecheap)",
"name" : "auto fetch Wildcard ssl certs with lego \x2b acme-dns ( Domain Register : Namecheap)",
"headline" : "auto fetch Wildcard ssl certs with lego \x2b acme-dns ( Domain Register : Namecheap)",
"headline" : "auto fetch Wildcard ssl certs with lego \x2b acme-dns ( Domain Register : Namecheap)",
"description" : "\x3ch3 id=\x22auto-fetch--wildcard-ssl-certs-with-lego--acme-dns--domain-register--namecheap\x22\x3eauto fetch Wildcard ssl certs with lego \x2b acme-dns ( Domain Register : Namecheap)\x3c\/h3\x3e\n\x3c p\x3e自從用了 \x3ca href=\x22https:\/\/github.com\/artyom\/leproxy\x22\x3eleproxy\x3c\/a\x3e 之後, 其實就很少在管ssl 憑證的問題,反正\x3ca href=\x22https:\/\/github.com\/artyom\/leproxy\x22\x3eleproxy \x3c\/a\x3e都會自動處理好\x3c\/p\x3e\n\x3cp\x3e不過LAN裡面的機器越來越多, 每次看到警告說沒有加密的訊息就有點不爽, 之前用了很多方式去申請全域憑證, 申請倒是還好, 沒太多問題。但是一碰到要更新, 就都無法自動, 因為都會要求去修改DNS 的 TXT 或者是 CNAME 記錄。\x3c\/p\x3e\n\x3cp\x3e一般來說, 如果是其他DNS 供應商, 大部分都會提供API, 那就還好。 BUT !! (對, 然生就是離不開這個BUT \x26hellip;) 我們的域名是老闆在 iwantmyname 買的,一開始是給 webfaction 代管, 後來webfaction 被godaddy 買走,就轉到 namecheap 去(我也不知道為什麼不在godaddy 就好)。\x3c\/p\x3e",
"description" : "\x3cp\x3e自從用了 \x3ca href=\x22https:\/\/github.com\/artyom\/leproxy\x22\x3eleproxy\x3c\/a\x3e 之後, 其實就很少在管ssl 憑證的問題,反正\x3ca href=\x22https:\/\/github.com\/artyom\/leproxy\x22\x3eleproxy \x3c\/a\x3e都會自動處理好\x3c\/p\x3e\n\x3cp\x3e不過LAN裡面的機器越來越多, 每次看到警告說沒有加密的訊息就有點不爽, 之前用了很多方式去申請全域憑證, 申請倒是還好, 沒太多問題。但是一碰到要更新, 就都無法自動, 因為都會要求去修改DNS 的 TXT 或者是 CNAME 記錄。\x3c\/p\x3e\n\x3cp\x3e一般來說, 如果是其他DNS 供應商, 大部分都會提供API, 那就還好。 BUT !! (對, 然生就是離不開這個BUT \x26hellip;) 我們的域名是老闆在 iwantmyname 買的,一開始是給 webfaction 代管, 後來webfaction 被godaddy 買走,就轉到 namecheap 去(我也不知道為什麼不在godaddy 就好)。\x3c\/p\x3e",
"inLanguage" : "en",
"inLanguage" : "en",
"author" : "Eric Chang",
"author" : "Eric Chang",
"creator" : "Eric Chang",
"creator" : "Eric Chang",
@ -24,7 +24,7 @@
"datePublished": "2021-08-26 12:08:43 \x2b0800 CST",
"datePublished": "2021-08-26 12:08:43 \x2b0800 CST",
"dateModified" : "2021-08-26 12:08:43 \x2b0800 CST",
"dateModified" : "2021-08-26 12:08:43 \x2b0800 CST",
"url" : "https:\/\/h.cowbay.org\/post\/auto-fetch-wildcard-ssl-certs-acme-dns-lego\/",
"url" : "https:\/\/h.cowbay.org\/post\/auto-fetch-wildcard-ssl-certs-acme-dns-lego\/",
"wordCount" : "744 ",
"wordCount" : "730 ",
"image" : "https://h.cowbay.orghttps://h.cowbay.org/images/post-default-8.jpg"",
"image" : "https://h.cowbay.orghttps://h.cowbay.org/images/post-default-8.jpg"",
"keywords" : [ ""acme"",""acme-dns"",""lego"",""ssl"","Blog" ]
"keywords" : [ ""acme"",""acme-dns"",""lego"",""ssl"","Blog" ]
}
}
@ -45,9 +45,9 @@
< link rel = "stylesheet" href = "https://use.fontawesome.com/releases/v5.3.1/css/all.css" integrity = "sha384-mzrmE5qonljUremFsqc01SB46JvROS7bZs3IO2EmfFsd15uHvIt+Y8vEf7N7fWAU" crossorigin = "anonymous" >
< link rel = "stylesheet" href = "https://use.fontawesome.com/releases/v5.3.1/css/all.css" integrity = "sha384-mzrmE5qonljUremFsqc01SB46JvROS7bZs3IO2EmfFsd15uHvIt+Y8vEf7N7fWAU" crossorigin = "anonymous" >
< link href = "https://h.cowbay.org/css/style.css?v=162995 2272 " rel = "stylesheet" id = "theme-stylesheet" type = 'text/css' media = 'all' >
< link href = "https://h.cowbay.org/css/style.css?v=162995 7884 " rel = "stylesheet" id = "theme-stylesheet" type = 'text/css' media = 'all' >
< link href = "https://h.cowbay.org/css/custom.css?v=162995 2272 " rel = "stylesheet" type = 'text/css' media = 'all' >
< link href = "https://h.cowbay.org/css/custom.css?v=162995 7884 " rel = "stylesheet" type = 'text/css' media = 'all' >
< link rel = "shortcut icon" href = "https://h.cowbay.org/img/favicon.ico" type = "image/x-icon" >
< link rel = "shortcut icon" href = "https://h.cowbay.org/img/favicon.ico" type = "image/x-icon" >
< link rel = "icon" href = "https://h.cowbay.org/img/favicon.ico" type = "image/x-icon" >
< link rel = "icon" href = "https://h.cowbay.org/img/favicon.ico" type = "image/x-icon" >
@ -304,7 +304,6 @@ if (!doNotTrack) {
< div class = "entry-container" >
< div class = "entry-container" >
< div class = "entry-content" >
< div class = "entry-content" >
< article >
< article >
< h3 id = "auto-fetch--wildcard-ssl-certs-with-lego--acme-dns--domain-register--namecheap" > auto fetch Wildcard ssl certs with lego + acme-dns ( Domain Register : Namecheap)< / h3 >
< p > 自從用了 < a href = "https://github.com/artyom/leproxy" > leproxy< / a > 之後, 其實就很少在管ssl 憑證的問題,反正< a href = "https://github.com/artyom/leproxy" > leproxy < / a > 都會自動處理好< / p >
< p > 自從用了 < a href = "https://github.com/artyom/leproxy" > leproxy< / a > 之後, 其實就很少在管ssl 憑證的問題,反正< a href = "https://github.com/artyom/leproxy" > leproxy < / a > 都會自動處理好< / p >
< p > 不過LAN裡面的機器越來越多, 每次看到警告說沒有加密的訊息就有點不爽, 之前用了很多方式去申請全域憑證, 申請倒是還好, 沒太多問題。但是一碰到要更新, 就都無法自動, 因為都會要求去修改DNS 的 TXT 或者是 CNAME 記錄。< / p >
< p > 不過LAN裡面的機器越來越多, 每次看到警告說沒有加密的訊息就有點不爽, 之前用了很多方式去申請全域憑證, 申請倒是還好, 沒太多問題。但是一碰到要更新, 就都無法自動, 因為都會要求去修改DNS 的 TXT 或者是 CNAME 記錄。< / p >
< p > 一般來說, 如果是其他DNS 供應商, 大部分都會提供API, 那就還好。 BUT !! (對, 然生就是離不開這個BUT … ) 我們的域名是老闆在 iwantmyname 買的,一開始是給 webfaction 代管, 後來webfaction 被godaddy 買走,就轉到 namecheap 去(我也不知道為什麼不在godaddy 就好)。< / p >
< p > 一般來說, 如果是其他DNS 供應商, 大部分都會提供API, 那就還好。 BUT !! (對, 然生就是離不開這個BUT … ) 我們的域名是老闆在 iwantmyname 買的,一開始是給 webfaction 代管, 後來webfaction 被godaddy 買走,就轉到 namecheap 去(我也不知道為什麼不在godaddy 就好)。< / p >
@ -336,90 +335,90 @@ tar zxvf acme-dns_0.8_linux_amd64.tar.gz && sudo mv acme-dns /usr/local/
< p > 本機如果有開firewall ,記得要放行 udp 53< / p >
< p > 本機如果有開firewall ,記得要放行 udp 53< / p >
< hr >
< hr >
< h4 id = "設定acme-dns" > 設定acme-dns< / h4 >
< h4 id = "設定acme-dns" > 設定acme-dns< / h4 >
< div class = "highlight" > < pre style = "color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4" > < code class = "language-shell" data-lang = "shell" > < span style = "color:#75715e" > #建立 acme-dns 目錄< / span >
< pre > < code > #建立 acme-dns 目錄
mkdir -p /etc/acme-dns
mkdir -p /etc/acme-dns
mkdir -p /var/lib/acme-dns
mkdir -p /var/lib/acme-dns
< span style = "color:#75715e" > #建立 acme-dns 設定檔< / span >
#建立 acme-dns 設定檔
sudo vim /etc/acme-dns/config.cfg
sudo vim /etc/acme-dns/config.cfg
< / code > < / pre > < / div > < p > config 的內容如下,順便補上一些自己的註解< / p >
< / code > < / pre > < p > config 的內容如下,順便補上一些自己的註解< / p >
< div class = "highlight" > < pre style = "color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4" > < code class = "language-shell" data-lang = "shell" > < span style = "color:#75715e" > #/etc/acme-dns/config.cfg< / span >
< pre > < code > #/etc/acme-dns/config.cfg
< span style = "color:#f92672" > [< / span > general< span style = "color:#f92672" > ]< / span >
[general]
< span style = "color:#75715e" > # DNS interface< / span >
# DNS interface
< span style = "color:#75715e" > # 本來預設是只有 :53 在某些VPS 上會出錯,所以改成 0.0.0.0:53< / span >
# 本來預設是只有 :53 在某些VPS 上會出錯,所以改成 0.0.0.0:53
listen < span style = "color:#f92672" > =< / span > < span style = "color:#e6db74" > " 0.0.0.0:53" < / span >
listen = " 0.0.0.0:53"
protocol < span style = "color:#f92672" > =< / span > < span style = "color:#e6db74" > " udp" < / span >
protocol = " udp"
< span style = "color:#75715e" > # domain name to serve the requests off of< / span >
# domain name to serve the requests off of
< span style = "color:#75715e" > # 不是要設定的 domain, 而是這臺機器要負責的sub domain< / span >
# 不是要設定的 domain, 而是這臺機器要負責的sub domain
< span style = "color:#75715e" > # 總之就是輸入 acme 再加上原本的domain< / span >
# 總之就是輸入 acme 再加上原本的domain
< span style = "color:#75715e" > # 不想用 acme 當然也可以< / span >
# 不想用 acme 當然也可以
domain < span style = "color:#f92672" > =< / span > < span style = "color:#e6db74" > " acme.abc.com" < / span >
domain = " acme.abc.com"
< span style = "color:#75715e" > # zone name server< / span >
# zone name server
< span style = "color:#75715e" > # ns1 再加上原本的 domain< / span >
# ns1 再加上原本的 domain
< span style = "color:#75715e" > # 一樣, 不想用ns1 也可以,後面記得作對應的修改< / span >
# 一樣, 不想用ns1 也可以,後面記得作對應的修改
nsname < span style = "color:#f92672" > =< / span > < span style = "color:#e6db74" > " ns1.abc.com" < / span >
nsname = " ns1.abc.com"
< span style = "color:#75715e" > # admin email address, where @ is substituted with .< / span >
# admin email address, where @ is substituted with .
< span style = "color:#75715e" > # 管理者email , admin + 原本的 domain< / span >
# 管理者email , admin + 原本的 domain
nsadmin < span style = "color:#f92672" > =< / span > < span style = "color:#e6db74" > " admin.abc.com" < / span >
nsadmin = " admin.abc.com"
< span style = "color:#75715e" > # predefined records served in addition to the TXT< / span >
# predefined records served in addition to the TXT
#
#
< span style = "color:#75715e" > # 前面兩筆 A 記錄對應上面的 domain , nsname< / span >
# 前面兩筆 A 記錄對應上面的 domain , nsname
< span style = "color:#75715e" > # 後面則是這臺機器的 WAN IP< / span >
# 後面則是這臺機器的 WAN IP
< span style = "color:#75715e" > # 第三筆 是NS 記錄< / span >
# 第三筆 是NS 記錄
< span style = "color:#75715e" > # 這三筆記錄等一下要新增到namecheap 的DNS< / span >
# 這三筆記錄等一下要新增到namecheap 的DNS
records < span style ="color:#f92672" > =< / span > < span style = "color:#f92672" > [< / span >
records = [
< span style = "color:#e6db74" > " acme.abc.com. A 11.22.33.44" < / span > ,
" acme.abc.com. A 11.22.33.44" ,
< span style = "color:#e6db74" > " ns1.acme.abc.com. A 11.22.33.44" < / span > ,
" ns1.acme.abc.com. A 11.22.33.44" ,
< span style = "color:#e6db74" > " acme.abc.com. NS ns1.abc.com." < / span > ,
" acme.abc.com. NS ns1.abc.com." ,
< span style = "color:#f92672" > ]< / span >
]
debug < span style ="color:#f92672" > =< / span > false
debug = false
< span style = "color:#f92672" > [< / span > database< span style = "color:#f92672" > ]< / span >
[database]
engine < span style = "color:#f92672" > =< / span > < span style = "color:#e6db74" > " sqlite3" < / span >
engine = " sqlite3"
connection < span style = "color:#f92672" > =< / span > < span style = "color:#e6db74" > " /var/lib/acme-dns/acme-dns.db" < / span >
connection = " /var/lib/acme-dns/acme-dns.db"
< span style = "color:#75715e" > ### 要記一下port ,等等會用到< / span >
### 要記一下port ,等等會用到
< span style = "color:#f92672" > [< / span > api< span style = "color:#f92672" > ]< / span >
[api]
api_domain < span style = "color:#f92672" > =< / span > < span style = "color:#e6db74" > " " < / span >
api_domain = " "
ip < span style = "color:#f92672" > =< / span > < span style = "color:#e6db74" > " 127.0.0.1" < / span >
ip = " 127.0.0.1"
disable_registration < span style ="color:#f92672" > =< / span > false
disable_registration = false
autocert_port < span style = "color:#f92672" > =< / span > < span style = "color:#e6db74" > " 80" < / span >
autocert_port = " 80"
port < span style = "color:#f92672" > =< / span > < span style = "color:#e6db74" > " 9000" < / span >
port = " 9000"
tls < span style = "color:#f92672" > =< / span > < span style = "color:#e6db74" > " none" < / span >
tls = " none"
corsorigins < span style ="color:#f92672" > =< / span > < span style = "color:#f92672" > [< / span >
corsorigins = [
< span style = "color:#e6db74" > " *" < / span >
" *"
< span style = "color:#f92672" > ]< / span >
]
use_header < span style ="color:#f92672" > =< / span > false
use_header = false
header_name < span style = "color:#f92672" > =< / span > < span style = "color:#e6db74" > " X-Forwarded-For" < / span >
header_name = " X-Forwarded-For"
< span style = "color:#f92672" > [< / span > logconfig< span style = "color:#f92672" > ]< / span >
[logconfig]
loglevel < span style = "color:#f92672" > =< / span > < span style = "color:#e6db74" > " debug" < / span >
loglevel = " debug"
logtype < span style = "color:#f92672" > =< / span > < span style = "color:#e6db74" > " stdout" < / span >
logtype = " stdout"
logformat < span style = "color:#f92672" > =< / span > < span style = "color:#e6db74" > " text" < / span >
logformat = " text"
< / code > < / pre > < / div > < p > 編輯完後,存檔離開。< / p >
< / code > < / pre > < p > 編輯完後,存檔離開。< / p >
< p > 新增 acme-dns.service 的systemd config< / p >
< p > 新增 acme-dns.service 的systemd config< / p >
< div class = "highlight" > < pre style = "color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4" > < code class = "language-shell" data-lang = "shell" > sudo vim /etc/systemd/system/acme-dns.service
< pre > < code > sudo vim /etc/systemd/system/acme-dns.service
< / code > < / pre > < / div > < p > 內容如下< / p >
< / code > < / pre > < p > 內容如下< / p >
< div class = "highlight" > < pre style = "color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4" > < code class = "language-shell" data-lang = "shell" > < span style = "color:#75715e" > # /etc/systemd/system/acme-dns.service< / span >
< pre > < code > # /etc/systemd/system/acme-dns.service
< span style = "color:#f92672" > [< / span > Unit< span style = "color:#f92672" > ]< / span >
[Unit]
Description< span style ="color:#f92672" > =< / span > ACMD DNS
Description=ACMD DNS
After< span style ="color:#f92672" > =< / span > network.target
After=network.target
< span style = "color:#f92672" > [< / span > Service< span style = "color:#f92672" > ]< / span >
[Service]
ExecStart< span style ="color:#f92672" > =< / span > /usr/local/bin/acme-dns
ExecStart=/usr/local/bin/acme-dns
Restart< span style ="color:#f92672" > =< / span > on-failure
Restart=on-failure
< span style = "color:#f92672" > [< / span > Install< span style = "color:#f92672" > ]< / span >
[Install]
WantedBy< span style ="color:#f92672" > =< / span > multi-user.target
WantedBy=multi-user.target
< / code > < / pre > < / div > < p > 存檔離開,並啟用 acme-dns service< / p >
< / code > < / pre > < p > 存檔離開,並啟用 acme-dns service< / p >
< div class = "highlight" > < pre style = "color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4" > < code class = "language-shell" data-lang = "shell" > sudo systemctl daemon-reload
< pre > < code > sudo systemctl daemon-reload
sudo systemctl enable --now acme-dns.service
sudo systemctl enable --now acme-dns.service
< span style = "color:#75715e" > # 檢查一下狀態是否正常< / span >
# 檢查一下狀態是否正常
sudo systemctl status acme-dns
sudo systemctl status acme-dns
< span style = "color:#75715e" > # 底下這個指令如果沒有回傳任何訊息,是正常的< / span >
# 底下這個指令如果沒有回傳任何訊息,是正常的
curl http://localhost:9000/health
curl http://localhost:9000/health
< / code > < / pre > < / div > < h4 id = "設定namecheap-dns-記錄" > 設定namecheap DNS 記錄< / h4 >
< / code > < / pre > < h4 id = "設定namecheap-dns-記錄" > 設定namecheap DNS 記錄< / h4 >
< p > 總共要新增兩筆A 記錄,一筆 NS 記錄 (目前),後面還會需要新增一筆 CNAME< / p >
< p > 總共要新增兩筆A 記錄,一筆 NS 記錄 (目前),後面還會需要新增一筆 CNAME< / p >
< p > domain< / p >
< p > domain< / p >
< p > < img src = "https://raw.githubusercontent.com/changchichung/imagebed/main/20210826113826-image.png" alt = "20210826113826-image.png" > < / p >
< p > < img src = "https://raw.githubusercontent.com/changchichung/imagebed/main/20210826113826-image.png" alt = "20210826113826-image.png" > < / p >
@ -431,51 +430,51 @@ curl http://localhost:9000/health
< h5 id = "透過lego-取得憑證" > 透過lego 取得憑證< / h5 >
< h5 id = "透過lego-取得憑證" > 透過lego 取得憑證< / h5 >
< p > 只要確認上面的防火牆設定、acme-dns 設定、以及 DNS 的修改生效之後, 剩下的lego 指令就很簡單了< / p >
< p > 只要確認上面的防火牆設定、acme-dns 設定、以及 DNS 的修改生效之後, 剩下的lego 指令就很簡單了< / p >
< p > < a href = "https://go-acme.github.io/lego/dns/acme-dns/" > https://go-acme.github.io/lego/dns/acme-dns/< / a > < / p >
< p > < a href = "https://go-acme.github.io/lego/dns/acme-dns/" > https://go-acme.github.io/lego/dns/acme-dns/< / a > < / p >
< div class = "highlight" > < pre style = "color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4" > < code class = "language-shell" data-lang = "shell" > < span style = "color:#75715e" > # 第一個ACME_DNS_API_BASE是剛剛設定acme-dns API port< / span >
< pre > < code > # 第一個ACME_DNS_API_BASE是剛剛設定acme-dns API port
< span style = "color:#75715e" > # 然後 ACME_DNS_STORAGE_PATH 是lego存放賬戶資料的地方< / span >
# 然後 ACME_DNS_STORAGE_PATH 是lego存放賬戶資料的地方
< span style = "color:#75715e" > # 後面就是lego 的指令< / span >
# 後面就是lego 的指令
ACME_DNS_API_BASE< span style ="color:#f92672" > =< / span > http://localhost:9000 ACME_DNS_STORAGE_PATH< span style ="color:#f92672" > =< / span > /home/minion/.lego-acme-dns-accounts.json lego --email changch@abc.com --dns acme-dns --domains *.abc.com run
ACME_DNS_API_BASE=http://localhost:9000 ACME_DNS_STORAGE_PATH=/home/minion/.lego-acme-dns-accounts.json lego --email changch@abc.com --dns acme-dns --domains *.abc.com run
< / code > < / pre > < / div > < p > 執行完成後,會在目錄底下產生一個叫 .lego 的目錄,用來存放憑證檔案< / p >
< / code > < / pre > < p > 執行完成後,會在目錄底下產生一個叫 .lego 的目錄,用來存放憑證檔案< / p >
< div class = "highlight" > < pre style = "color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4" > < code class = "language-shell" data-lang = "shell" > 2021-08-26 11:55:16 < span style = "color:#f92672" > [< / span > minion@hqs058 ~< span style = "color:#f92672" > ]< / span > $ ls -la .lego/certificates/
< pre > < code > 2021-08-26 11:55:16 [minion@hqs058 ~]$ ls -la .lego/certificates/
total < span style = "color:#ae81ff" > 28< / span >
total 28
drwx------ < span style = "color:#ae81ff" > 2< / span > minion sudo < span style = "color:#ae81ff" > 4096< / span > Aug < span style = "color:#ae81ff" > 26< / span > 09:35 .
drwx------ 2 minion sudo 4096 Aug 26 09:35 .
drwx------ < span style = "color:#ae81ff" > 4< / span > minion sudo < span style = "color:#ae81ff" > 4096< / span > Aug < span style = "color:#ae81ff" > 26< / span > 09:33 ..
drwx------ 4 minion sudo 4096 Aug 26 09:33 ..
-rw------- < span style = "color:#ae8 1ff"> 1< / span > minion sudo < span style = "color:#ae81ff" > 5325< / span > Aug < span style = "color:#ae81ff" > 26< / span > 09:35 _.abc.com.crt
-rw------- 1 minion sudo 5325 Aug 26 09:35 _.abc.com.crt
-rw------- < span style = "color:#ae8 1ff"> 1< / span > minion sudo < span style = "color:#ae81ff" > 3751< / span > Aug < span style = "color:#ae81ff" > 26< / span > 09:35 _.abc.com.issuer.crt
-rw------- 1 minion sudo 3751 Aug 26 09:35 _.abc.com.issuer.crt
-rw------- < span style = "color:#ae8 1ff"> 1< / span > minion sudo < span style = "color:#ae81ff" > 238< / span > Aug < span style = "color:#ae81ff" > 26< / span > 09:35 _.abc.com.json
-rw------- 1 minion sudo 238 Aug 26 09:35 _.abc.com.json
-rw------- < span style = "color:#ae8 1ff"> 1< / span > minion sudo < span style = "color:#ae81ff" > 227< / span > Aug < span style = "color:#ae81ff" > 26< / span > 09:35 _.abc.com.key
-rw------- 1 minion sudo 227 Aug 26 09:35 _.abc.com.key
2021-08-26 11:58:22 < span style = "color:#f92672" > [< / span > minion@hqs058 ~< span style = "color:#f92672" > ]< / span > $
2021-08-26 11:58:22 [minion@hqs058 ~]$
< / code > < / pre > < / div > < p > 沒錯,就這麼簡單!!< / p >
< / code > < / pre > < p > 沒錯,就這麼簡單!!< / p >
< p > 甚至於我要撤銷這些憑證也很簡單!!!< / p >
< p > 甚至於我要撤銷這些憑證也很簡單!!!< / p >
< p > 把最後面的 run 改成 revoke 就可以了!< / p >
< p > 把最後面的 run 改成 revoke 就可以了!< / p >
< div class = "highlight" > < pre style = "color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4" > < code class = "language-shell" data-lang = "shell" > ACME_DNS_API_BASE< span style ="color:#f92672" > =< / span > http://localhost:9000 ACME_DNS_STORAGE_PATH< span style ="color:#f92672" > =< / span > /home/minion/.lego-acme-dns-accounts.json lego --email changch@abc.com --dns acme-dns --domains *.abc.com revoke
< pre > < code > ACME_DNS_API_BASE=http://localhost:9000 ACME_DNS_STORAGE_PATH=/home/minion/.lego-acme-dns-accounts.json lego --email changch@abc.com --dns acme-dns --domains *.abc.com revoke
2021/08/26 11:59:13 Trying to revoke certificate < span style = "color:#66d9ef" > for< / span > domain *.abc.com
2021/08/26 11:59:13 Trying to revoke certificate for domain *.abc.com
2021/08/26 11:59:14 Certificate was revoked.
2021/08/26 11:59:14 Certificate was revoked.
2021/08/26 11:59:14 Certificate was archived < span style = "color:#66d9ef" > for< / span > domain: *.abc.com
2021/08/26 11:59:14 Certificate was archived for domain: *.abc.com
< / code > < / pre > < / div > < p > 再來跑一次申請新憑證測試看看< / p >
< / code > < / pre > < p > 再來跑一次申請新憑證測試看看< / p >
< div class = "highlight" > < pre style = "color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4" > < code class = "language-shell" data-lang = "shell" > ACME_DNS_API_BASE< span style ="color:#f92672" > =< / span > http://localhost:9000 ACME_DNS_STORAGE_PATH< span style ="color:#f92672" > =< / span > /home/minion/.lego-acme-dns-accounts.json lego --email changch@abc.com --dns acme-dns --domains *.abc.com run
< pre > < code > ACME_DNS_API_BASE=http://localhost:9000 ACME_DNS_STORAGE_PATH=/home/minion/.lego-acme-dns-accounts.json lego --email changch@abc.com --dns acme-dns --domains *.abc.com run
2021/08/26 12:00:51 < span style = "color:#f92672" > [< / span > INFO< span style = "color:#f92672" > ]< / span > < span style = "color:#f92672" > [< / span > *.abc.com< span style = "color:#f92672" > ]< / span > acme: Obtaining bundled SAN certificate
2021/08/26 12:00:51 [INFO] [*.abc.com] acme: Obtaining bundled SAN certificate
2021/08/26 12:00:52 < span style = "color:#f92672" > [< / span > INFO< span style = "color:#f92672" > ]< / span > < span style = "color:#f92672" > [< / span > *.abc.com< span style = "color:#f92672" > ]< / span > AuthURL: https://acme-v02.api.letsencrypt.org/acme/authz-v3/25150773810
2021/08/26 12:00:52 [INFO] [*.abc.com] AuthURL: https://acme-v02.api.letsencrypt.org/acme/authz-v3/25150773810
2021/08/26 12:00:52 < span style = "color:#f92672" > [< / span > INFO< span style = "color:#f92672" > ]< / span > < span style = "color:#f92672" > [< / span > *.abc.com< span style = "color:#f92672" > ]< / span > acme: authorization already valid; skipping challenge
2021/08/26 12:00:52 [INFO] [*.abc.com] acme: authorization already valid; skipping challenge
2021/08/26 12:00:52 < span style = "color:#f92672" > [< / span > INFO< span style = "color:#f92672" > ]< / span > < span style = "color:#f92672" > [< / span > *.abc.com< span style = "color:#f92672" > ]< / span > acme: Validations succeeded; requesting certificates
2021/08/26 12:00:52 [INFO] [*.abc.com] acme: Validations succeeded; requesting certificates
2021/08/26 12:00:53 < span style = "color:#f92672" > [< / span > INFO< span style = "color:#f92672" > ]< / span > < span style = "color:#f92672" > [< / span > *.abc.com< span style = "color:#f92672" > ]< / span > Server responded with a certificate.
2021/08/26 12:00:53 [INFO] [*.abc.com] Server responded with a certificate.
< / code > < / pre > < / div > < p > 同樣地, 會產生新的ssl 憑證< / p >
< / code > < / pre > < p > 同樣地, 會產生新的ssl 憑證< / p >
< div class = "highlight" > < pre style = "color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4" > < code class = "language-shell" data-lang = "shell" > 2021-08-26 12:00:53 < span style = "color:#f92672" > [< / span > minion@hqs058 ~< span style = "color:#f92672" > ]< / span > $ ls -la .lego/certificates/
< pre > < code > 2021-08-26 12:00:53 [minion@hqs058 ~]$ ls -la .lego/certificates/
total < span style = "color:#ae81ff" > 28< / span >
total 28
drwx------ < span style = "color:#ae81ff" > 2< / span > minion sudo < span style = "color:#ae81ff" > 4096< / span > Aug < span style = "color:#ae81ff" > 26< / span > 12:00 .
drwx------ 2 minion sudo 4096 Aug 26 12:00 .
drwx------ < span style = "color:#ae81ff" > 5< / span > minion sudo < span style = "color:#ae81ff" > 4096< / span > Aug < span style = "color:#ae81ff" > 26< / span > 11:59 ..
drwx------ 5 minion sudo 4096 Aug 26 11:59 ..
-rw------- < span style = "color:#ae8 1ff"> 1< / span > minion sudo < span style = "color:#ae81ff" > 5325< / span > Aug < span style = "color:#ae81ff" > 26< / span > 12:00 _.abc.com.crt
-rw------- 1 minion sudo 5325 Aug 26 12:00 _.abc.com.crt
-rw------- < span style = "color:#ae8 1ff"> 1< / span > minion sudo < span style = "color:#ae81ff" > 3751< / span > Aug < span style = "color:#ae81ff" > 26< / span > 12:00 _.abc.com.issuer.crt
-rw------- 1 minion sudo 3751 Aug 26 12:00 _.abc.com.issuer.crt
-rw------- < span style = "color:#ae8 1ff"> 1< / span > minion sudo < span style = "color:#ae81ff" > 238< / span > Aug < span style = "color:#ae81ff" > 26< / span > 12:00 _.abc.com.json
-rw------- 1 minion sudo 238 Aug 26 12:00 _.abc.com.json
-rw------- < span style = "color:#ae8 1ff"> 1< / span > minion sudo < span style = "color:#ae81ff" > 227< / span > Aug < span style = "color:#ae81ff" > 26< / span > 12:00 _.abc.com.key
-rw------- 1 minion sudo 227 Aug 26 12:00 _.abc.com.key
2021-08-26 12:02:37 < span style = "color:#f92672" > [< / span > minion@hqs058 ~< span style = "color:#f92672" > ]< / span > $
2021-08-26 12:02:37 [minion@hqs058 ~]$
< / code > < / pre > < / div > < p > 超方便的啊!!!!< / p >
< / code > < / pre > < p > 超方便的啊!!!!< / p >
< p > 後面要更新就把指令最後的 run 改成 renew< / p >
< p > 後面要更新就把指令最後的 run 改成 renew< / p >
< div class = "highlight" > < pre style = "color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4" > < code class = "language-shell" data-lang = "shell" > ACME_DNS_API_BASE< span style ="color:#f92672" > =< / span > http://localhost:9000 ACME_DNS_STORAGE_PATH< span style ="color:#f92672" > =< / span > /home/minion/.lego-acme-dns-accounts.json lego --email changch@abc.com --dns acme-dns --domains *.abc.com renew
< pre > < code > ACME_DNS_API_BASE=http://localhost:9000 ACME_DNS_STORAGE_PATH=/home/minion/.lego-acme-dns-accounts.json lego --email changch@abc.com --dns acme-dns --domains *.abc.com renew
2021/08/26 12:04:00 < span style = "color:#f92672" > [< / span > *.abc.com< span style = "color:#f92672" > ]< / span > The certificate expires in < span style = "color:#ae81ff" > 89< / span > days, the number of days defined to perform the renewal is 30: no renewal.
2021/08/26 12:04:00 [*.abc.com] The certificate expires in 89 days, the number of days defined to perform the renewal is 30: no renewal.
< / code > < / pre > < / div > < p > 因為是剛剛才要到的憑證,當然是不能更新啦… < / p >
< / code > < / pre > < p > 因為是剛剛才要到的憑證,當然是不能更新啦… < / p >
< p > 把這個指令寫到 crontab ,以後時間到了就會自動更新憑證< / p >
< p > 把這個指令寫到 crontab ,以後時間到了就會自動更新憑證< / p >
< p > 後續再搭配 ansible 來抓新的憑證,派送到其他伺服器去< / p >
< p > 後續再搭配 ansible 來抓新的憑證,派送到其他伺服器去< / p >
< p > 終於可以不用再為ssl 憑證煩惱了!!!< / p >
< p > 終於可以不用再為ssl 憑證煩惱了!!!< / p >
@ -771,7 +770,7 @@ title="pinterest icon"></i>
< / div >
< / div >
< script src = "https://h.cowbay.org/js/jquery.min.js" > < / script >
< script src = "https://h.cowbay.org/js/jquery.min.js" > < / script >
< script src = "https://h.cowbay.org/js/jquerymigrate.js" > < / script >
< script src = "https://h.cowbay.org/js/jquerymigrate.js" > < / script >
< script src = "https://h.cowbay.org/js/production.min.js?v=162995 2272 "> < / script >
< script src = "https://h.cowbay.org/js/production.min.js?v=162995 7884 "> < / script >
< / body >
< / body >
< / html >
< / html >