====== Avril and Let's Encrypt Certificates ======

===== Install certificates initially =====

A **standalone** certificate should be fetched. (I think because our certbot runs externally, and nginx runs in a docker container).

For the domain ''vwiki2.avril.work'':

<code bash>
sudo certbot certonly --standalone -d vwiki2.avril.work
</code>
===== Renew certificates manually =====

**Note:** //Usually it should be done automatically with help of a cron job, but here is described how we can do it manually.//

Simply run:
<code bash>
cd /dockerdata/compose
# Stop Avril docker compose
sudo docker-compose down

# Renew certificates 
sudo certbot renew

# Start Avril docker compose 
sudo docker-compose up -d
</code>

After that check in browser if you have new certificates. Maybe removing all cookies (Ctrl+Shift+Del) etc. and F5 is necessary.


Der obige Ansatz funktioniert sehr gut (nur 2 minuten Downtime). Aber 0 Minuten Downtime ist besser, deshalb wäre es schön nach einer Lösung zu schauen, die einen anderen Ansatz fährt (z.B. DNS-Plugins verwenden: https://certbot.eff.org/docs/using.html#dns-plugins).

P.S. Übrigens, das cerbot-Log liegt unter /var/log/letsencrypt.

===== Renew certs automatically =====

It does not work at the moment, because the necessary port (80? or 443?) is in use during renewal. It can work (I didn't test it) if we install pre- and post-hooks, which will shut down and start again (after certs renewal) the docker compose. 

At the moment I'm using the manual way, because I want to know exactly when the server will shut down.




===== relay.avril.work certificate renewal =====

Important for relay.avril.work certificates: because of problems, whether the mail server(?) uses wrong (old) certificates, the Dovecot service should be reloaded after the certificate renewal (see https://superuser.com/questions/1494333/thunderbird-not-updating-certificate-keeps-using-old-one-and-saying-its-expire
).

<code>
sudo service dovecot reload
</code>

It can be checked from a client with the following command:
<code bash>
openssl s_client -connect relay.avril.work:993 -quiet
</code>

This command gives for expired certificate:

<code bash>
kalaschnikow@kalaschnikow2017:~$ openssl s_client -connect relay.avril.work:993 -quiet
depth=2 C = US, O = Internet Security Research Group, CN = ISRG Root X1
verify return:1
depth=1 C = US, O = Let's Encrypt, CN = R3
verify return:1
depth=0 CN = relay.avril.work
verify error:num=10:certificate has expired
notAfter=Oct 28 17:05:33 2021 GMT
verify return:1
depth=0 CN = relay.avril.work
notAfter=Oct 28 17:05:33 2021 GMT
verify return:1
* OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE AUTH=PLAIN] Dovecot (Ubuntu) ready.
^C
</code>

And for valid certificate:

<code bash>
kalaschnikow@kalaschnikow2017:~$ openssl s_client -connect relay.avril.work:993 -quiet
depth=2 C = US, O = Internet Security Research Group, CN = ISRG Root X1
verify return:1
depth=1 C = US, O = Let's Encrypt, CN = R3
verify return:1
depth=0 CN = relay.avril.work
verify return:1
* OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE AUTH=PLAIN] Dovecot (Ubuntu) ready.
^C
</code>

===== List of all my Let's Encrypt certs =====

If certbot is used the status of certificates can be checked in the terminal on the particular system with the command:

''sudo certbot certificates'' 

(see https://eff-certbot.readthedocs.io/en/stable/using.html#managing-certificates)

  * 94.199.215.198 (jrserver on ip-projects)
    * /etc/letsencrypt/live/relay.avril.work/fullchain.pem expires on 2022-04-27
    * /etc/letsencrypt/live/www.avril.work/fullchain.pem expires on 2022-04-27

  * 202.61.247.140 (Avril2021 on netcup)
    * /etc/letsencrypt/live/avril2021.avril.work/fullchain.pem expires on Donnerstag, 3. April 2025 um 08:28:04

  * 185.194.236.66 (Avril2019 on ip-projects)
    * /etc/letsencrypt/live/avril2019.wialon-consulting.de/fullchain.pem expires on Montag, 1. Januar 2024 um 06:48:09

===== Misc =====

  * Running certbot in a container (but our installation is based on a certbot which runs not in docker container, but "purely" on host system )
    * https://dev.to/kingyou/automating-https-with-docker-nginx-certbot-2ein