chchang/hugo_backup
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

update some content

Browse Source
This commit is contained in:
Eric Chang
2021-10-28 14:13:06 +08:00
parent 97eb780aa4
commit 4f99455d8f
242 changed files with 1826 additions and 2616 deletions
Download Patch File Download Diff File Expand all files Collapse all files

40
public/post/auto-fetch-wildcard-ssl-certs-acme-dns-lego/index.html
View File

@@ -11,9 +11,9 @@
"@id": "https:\/\/h.cowbay.org"
},
"articleSection" : "post",
"name" : "auto fetch Wildcard ssl certs with lego \x2b acme-dns ( Domain Register : Namecheap)",
"headline" : "auto fetch Wildcard ssl certs with lego \x2b acme-dns ( Domain Register : Namecheap)",
"description" : "\x3cp\x3e自從用了 \x3ca href=\x22https:\/\/github.com\/artyom\/leproxy\x22\x3eleproxy\x3c\/a\x3e 之後，其實就很少在管ssl 憑證的問題，反正\x3ca href=\x22https:\/\/github.com\/artyom\/leproxy\x22\x3eleproxy \x3c\/a\x3e都會自動處理好\x3c\/p\x3e\n\x3cp\x3e不過LAN裡面的機器越來越多，每次看到警告說沒有加密的訊息就有點不爽，之前用了很多方式去申請全域憑證，申請倒是還好，沒太多問題。但是一碰到要更新，就都無法自動，因為都會要求去修改DNS 的 TXT 或者是 CNAME 記錄。\x3c\/p\x3e\n\x3cp\x3e一般來說，如果是其他DNS 供應商，大部分都會提供API，那就還好。 BUT !! (對，然生就是離不開這個BUT \x26hellip;) 我們的域名是老闆在 iwantmyname 買的，一開始是給 webfaction 代管，後來webfaction 被godaddy 買走，就轉到 namecheap 去(我也不知道為什麼不在godaddy 就好)。\x3c\/p\x3e",
"name" : "auto fetch Wildcard ssl certs with lego \u002b acme-dns ( Domain Register : Namecheap)",
"headline" : "auto fetch Wildcard ssl certs with lego \u002b acme-dns ( Domain Register : Namecheap)",
"description" : "\u003cp\u003e自從用了 \u003ca href=\u0022https:\/\/github.com\/artyom\/leproxy\u0022\u003eleproxy\u003c\/a\u003e 之後，其實就很少在管ssl 憑證的問題，反正\u003ca href=\u0022https:\/\/github.com\/artyom\/leproxy\u0022\u003eleproxy \u003c\/a\u003e都會自動處理好\u003c\/p\u003e\n\u003cp\u003e不過LAN裡面的機器越來越多，每次看到警告說沒有加密的訊息就有點不爽，之前用了很多方式去申請全域憑證，申請倒是還好，沒太多問題。但是一碰到要更新，就都無法自動，因為都會要求去修改DNS 的 TXT 或者是 CNAME 記錄。\u003c\/p\u003e\n\u003cp\u003e一般來說，如果是其他DNS 供應商，大部分都會提供API，那就還好。 BUT !! (對，然生就是離不開這個BUT \u0026hellip;) 我們的域名是老闆在 iwantmyname 買的，一開始是給 webfaction 代管，後來webfaction 被godaddy 買走，就轉到 namecheap 去(我也不知道為什麼不在godaddy 就好)。\u003c\/p\u003e",
"inLanguage" : "en",
"author" : "Eric Chang",
"creator" : "Eric Chang",
@@ -21,8 +21,8 @@
"accountablePerson" : "Eric Chang",
"copyrightHolder" : "Eric Chang",
"copyrightYear" : "2021",
"datePublished": "2021-08-26 12:08:43 \x2b0800 CST",
"dateModified" : "2021-08-26 12:08:43 \x2b0800 CST",
"datePublished": "2021-08-26 12:08:43 \u002b0800 CST",
"dateModified" : "2021-08-26 12:08:43 \u002b0800 CST",
"url" : "https:\/\/h.cowbay.org\/post\/auto-fetch-wildcard-ssl-certs-acme-dns-lego\/",
"wordCount" : "730",
"image" : "https://h.cowbay.orghttps://h.cowbay.org/images/post-default-8.jpg"",
@@ -45,9 +45,9 @@
<link rel="stylesheet" href="https://use.fontawesome.com/releases/v5.3.1/css/all.css" integrity="sha384-mzrmE5qonljUremFsqc01SB46JvROS7bZs3IO2EmfFsd15uHvIt+Y8vEf7N7fWAU" crossorigin="anonymous">
<link href="https://h.cowbay.org/css/style.css?v=1632901488" rel="stylesheet" id="theme-stylesheet" type='text/css' media='all'>
<link href="https://h.cowbay.org/css/style.css?v=1634607506" rel="stylesheet" id="theme-stylesheet" type='text/css' media='all'>
<link href="https://h.cowbay.org/css/custom.css?v=1632901488" rel="stylesheet" type='text/css' media='all'>
<link href="https://h.cowbay.org/css/custom.css?v=1634607506" rel="stylesheet" type='text/css' media='all'>
<link rel="shortcut icon" href="https://h.cowbay.org/img/favicon.ico" type="image/x-icon">
<link rel="icon" href="https://h.cowbay.org/img/favicon.ico" type="image/x-icon">
@@ -308,7 +308,7 @@ if (!doNotTrack) {
<p>不過LAN裡面的機器越來越多，每次看到警告說沒有加密的訊息就有點不爽，之前用了很多方式去申請全域憑證，申請倒是還好，沒太多問題。但是一碰到要更新，就都無法自動，因為都會要求去修改DNS 的 TXT 或者是 CNAME 記錄。</p>
<p>一般來說，如果是其他DNS 供應商，大部分都會提供API，那就還好。 BUT !! (對，然生就是離不開這個BUT &hellip;) 我們的域名是老闆在 iwantmyname 買的，一開始是給 webfaction 代管，後來webfaction 被godaddy 買走，就轉到 namecheap 去(我也不知道為什麼不在godaddy 就好)。</p>
<p>DNS 管理基本上都是大同小異啦，可是namecheap 免費賬戶不提供 API ，應該說要使用namecheap 提供的API ，需要滿足以下的條件</p>
<pre><code>I want to enable API for my account. Are there any specific requirements?
<pre tabindex="0"><code>I want to enable API for my account. Are there any specific requirements?
We have certain requirements for activation to prevent system abuse. In order to have API enabled for your account, you should meet one of the following requirements:
@@ -335,13 +335,13 @@ tar zxvf acme-dns_0.8_linux_amd64.tar.gz &amp;&amp; sudo mv acme-dns /usr/local/
<p>本機如果有開firewall ，記得要放行 udp 53</p>
<hr>
<h4 id="設定acme-dns">設定acme-dns</h4>
<pre><code>#建立 acme-dns 目錄
<pre tabindex="0"><code>#建立 acme-dns 目錄
mkdir -p /etc/acme-dns
mkdir -p /var/lib/acme-dns
#建立 acme-dns 設定檔
sudo vim /etc/acme-dns/config.cfg
</code></pre><p>config 的內容如下，順便補上一些自己的註解</p>
<pre><code>#/etc/acme-dns/config.cfg
<pre tabindex="0"><code>#/etc/acme-dns/config.cfg
[general]
# DNS interface
# 本來預設是只有 :53 在某些VPS 上會出錯，所以改成 0.0.0.0:53
@@ -397,9 +397,9 @@ logformat = &quot;text&quot;
</code></pre><p>編輯完後，存檔離開。</p>
<p>新增 acme-dns.service 的systemd config</p>
<pre><code>sudo vim /etc/systemd/system/acme-dns.service
<pre tabindex="0"><code>sudo vim /etc/systemd/system/acme-dns.service
</code></pre><p>內容如下</p>
<pre><code># /etc/systemd/system/acme-dns.service
<pre tabindex="0"><code># /etc/systemd/system/acme-dns.service
[Unit]
Description=ACMD DNS
After=network.target
@@ -412,7 +412,7 @@ Restart=on-failure
WantedBy=multi-user.target
</code></pre><p>存檔離開，並啟用 acme-dns service</p>
<pre><code>sudo systemctl daemon-reload
<pre tabindex="0"><code>sudo systemctl daemon-reload
sudo systemctl enable --now acme-dns.service
# 檢查一下狀態是否正常
sudo systemctl status acme-dns
@@ -430,12 +430,12 @@ curl http://localhost:9000/health
<h5 id="透過lego-取得憑證">透過lego 取得憑證</h5>
<p>只要確認上面的防火牆設定、acme-dns 設定、以及 DNS 的修改生效之後，剩下的lego 指令就很簡單了</p>
<p><a href="https://go-acme.github.io/lego/dns/acme-dns/">https://go-acme.github.io/lego/dns/acme-dns/</a></p>
<pre><code># 第一個ACME_DNS_API_BASE是剛剛設定acme-dns API port
<pre tabindex="0"><code># 第一個ACME_DNS_API_BASE是剛剛設定acme-dns API port
# 然後 ACME_DNS_STORAGE_PATH 是lego存放賬戶資料的地方
# 後面就是lego 的指令
ACME_DNS_API_BASE=http://localhost:9000 ACME_DNS_STORAGE_PATH=/home/minion/.lego-acme-dns-accounts.json lego --email changch@abc.com --dns acme-dns --domains *.abc.com run
</code></pre><p>執行完成後，會在目錄底下產生一個叫 .lego 的目錄，用來存放憑證檔案</p>
<pre><code>2021-08-26 11:55:16 [minion@hqs058 ~]$ ls -la .lego/certificates/
<pre tabindex="0"><code>2021-08-26 11:55:16 [minion@hqs058 ~]$ ls -la .lego/certificates/
total 28
drwx------ 2 minion sudo 4096 Aug 26 09:35 .
drwx------ 4 minion sudo 4096 Aug 26 09:33 ..
@@ -448,20 +448,20 @@ drwx------ 4 minion sudo 4096 Aug 26 09:33 ..
</code></pre><p>沒錯，就這麼簡單!!</p>
<p>甚至於我要撤銷這些憑證也很簡單!!!</p>
<p>把最後面的 run 改成 revoke 就可以了！</p>
<pre><code>ACME_DNS_API_BASE=http://localhost:9000 ACME_DNS_STORAGE_PATH=/home/minion/.lego-acme-dns-accounts.json lego --email changch@abc.com --dns acme-dns --domains *.abc.com revoke
<pre tabindex="0"><code>ACME_DNS_API_BASE=http://localhost:9000 ACME_DNS_STORAGE_PATH=/home/minion/.lego-acme-dns-accounts.json lego --email changch@abc.com --dns acme-dns --domains *.abc.com revoke
2021/08/26 11:59:13 Trying to revoke certificate for domain *.abc.com
2021/08/26 11:59:14 Certificate was revoked.
2021/08/26 11:59:14 Certificate was archived for domain: *.abc.com
</code></pre><p>再來跑一次申請新憑證測試看看</p>
<pre><code>ACME_DNS_API_BASE=http://localhost:9000 ACME_DNS_STORAGE_PATH=/home/minion/.lego-acme-dns-accounts.json lego --email changch@abc.com --dns acme-dns --domains *.abc.com run
<pre tabindex="0"><code>ACME_DNS_API_BASE=http://localhost:9000 ACME_DNS_STORAGE_PATH=/home/minion/.lego-acme-dns-accounts.json lego --email changch@abc.com --dns acme-dns --domains *.abc.com run
2021/08/26 12:00:51 [INFO] [*.abc.com] acme: Obtaining bundled SAN certificate
2021/08/26 12:00:52 [INFO] [*.abc.com] AuthURL: https://acme-v02.api.letsencrypt.org/acme/authz-v3/25150773810
2021/08/26 12:00:52 [INFO] [*.abc.com] acme: authorization already valid; skipping challenge
2021/08/26 12:00:52 [INFO] [*.abc.com] acme: Validations succeeded; requesting certificates
2021/08/26 12:00:53 [INFO] [*.abc.com] Server responded with a certificate.
</code></pre><p>同樣地，會產生新的ssl 憑證</p>
<pre><code>2021-08-26 12:00:53 [minion@hqs058 ~]$ ls -la .lego/certificates/
<pre tabindex="0"><code>2021-08-26 12:00:53 [minion@hqs058 ~]$ ls -la .lego/certificates/
total 28
drwx------ 2 minion sudo 4096 Aug 26 12:00 .
drwx------ 5 minion sudo 4096 Aug 26 11:59 ..
@@ -472,7 +472,7 @@ drwx------ 5 minion sudo 4096 Aug 26 11:59 ..
2021-08-26 12:02:37 [minion@hqs058 ~]$
</code></pre><p>超方便的啊！！！！</p>
<p>後面要更新就把指令最後的 run 改成 renew</p>
<pre><code>ACME_DNS_API_BASE=http://localhost:9000 ACME_DNS_STORAGE_PATH=/home/minion/.lego-acme-dns-accounts.json lego --email changch@abc.com --dns acme-dns --domains *.abc.com renew
<pre tabindex="0"><code>ACME_DNS_API_BASE=http://localhost:9000 ACME_DNS_STORAGE_PATH=/home/minion/.lego-acme-dns-accounts.json lego --email changch@abc.com --dns acme-dns --domains *.abc.com renew
2021/08/26 12:04:00 [*.abc.com] The certificate expires in 89 days, the number of days defined to perform the renewal is 30: no renewal.
</code></pre><p>因為是剛剛才要到的憑證，當然是不能更新啦&hellip;</p>
<p>把這個指令寫到 crontab ，以後時間到了就會自動更新憑證</p>
@@ -770,7 +770,7 @@ title="pinterest icon"></i>
</div>
<script src="https://h.cowbay.org/js/jquery.min.js"></script>
<script src="https://h.cowbay.org/js/jquerymigrate.js"></script>
<script src="https://h.cowbay.org/js/production.min.js?v=1632901488"></script>
<script src="https://h.cowbay.org/js/production.min.js?v=1634607506"></script>
</body>
</html>