Differences

This shows you the differences between two versions of the page.

--- avril_and_let_s_encrypt_certificates [2022/02/04 11:07] – [List of all my Let's Encrypt certs] kalaschnikow
+++ avril_and_let_s_encrypt_certificates [2026/10/31 19:42] (current) – [List of all my Let's Encrypt certs] 91.5.30.114
@@ Line 1: / Line 1: @@
+====== Avril and Let's Encrypt Certificates ======
+===== Install certificates initially =====
+A **standalone** certificate should be fetched. (I think because our certbot runs externally, and nginx runs in a docker container).
+For the domain ''vwiki2.avril.work'':
+<code bash>
+sudo certbot certonly --standalone -d vwiki2.avril.work
+</code>
+===== Renew certificates manually =====
+**Note:** //Usually it should be done automatically with help of a cron job, but here is described how we can do it manually.//
+Simply run:
+<code bash>
+cd /dockerdata/compose
+# Stop Avril docker compose
+sudo docker-compose down
+# Renew certificates
+sudo certbot renew
+# Start Avril docker compose
+sudo docker-compose up -d
+</code>
+After that check in browser if you have new certificates. Maybe removing all cookies (Ctrl+Shift+Del) etc. and F5 is necessary.
+Der obige Ansatz funktioniert sehr gut (nur 2 minuten Downtime). Aber 0 Minuten Downtime ist besser, deshalb wäre es schön nach einer Lösung zu schauen, die einen anderen Ansatz fährt (z.B. DNS-Plugins verwenden: https://certbot.eff.org/docs/using.html#dns-plugins).
+P.S. Übrigens, das cerbot-Log liegt unter /var/log/letsencrypt.
+===== Renew certs automatically =====
+It does not work at the moment, because the necessary port (80? or 443?) is in use during renewal. It can work (I didn't test it) if we install pre- and post-hooks, which will shut down and start again (after certs renewal) the docker compose.
+At the moment I'm using the manual way, because I want to know exactly when the server will shut down.
+===== relay.avril.work certificate renewal =====
+Important for relay.avril.work certificates: because of problems, whether the mail server(?) uses wrong (old) certificates, the Dovecot service should be reloaded after the certificate renewal (see https://superuser.com/questions/1494333/thunderbird-not-updating-certificate-keeps-using-old-one-and-saying-its-expire
+).
+<code>
+sudo service dovecot reload
+</code>
+It can be checked from a client with the following command:
+<code bash>
+openssl s_client -connect relay.avril.work:993 -quiet
+</code>
+This command gives for expired certificate:
+<code bash>
+kalaschnikow@kalaschnikow2017:~$ openssl s_client -connect relay.avril.work:993 -quiet
+depth=2 C = US, O = Internet Security Research Group, CN = ISRG Root X1
+verify return:1
+depth=1 C = US, O = Let's Encrypt, CN = R3
+verify return:1
+depth=0 CN = relay.avril.work
+verify error:num=10:certificate has expired
+notAfter=Oct 28 17:05:33 2021 GMT
+verify return:1
+depth=0 CN = relay.avril.work
+notAfter=Oct 28 17:05:33 2021 GMT
+verify return:1
+* OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE AUTH=PLAIN] Dovecot (Ubuntu) ready.
+^C
+</code>
+And for valid certificate:
+<code bash>
+kalaschnikow@kalaschnikow2017:~$ openssl s_client -connect relay.avril.work:993 -quiet
+depth=2 C = US, O = Internet Security Research Group, CN = ISRG Root X1
+verify return:1
+depth=1 C = US, O = Let's Encrypt, CN = R3
+verify return:1
+depth=0 CN = relay.avril.work
+verify return:1
+* OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE AUTH=PLAIN] Dovecot (Ubuntu) ready.
+^C
+</code>
+===== List of all my Let's Encrypt certs =====
+If certbot is used the status of certificates can be checked in the terminal on the particular system with the command:
+''sudo certbot certificates''
+(see https://eff-certbot.readthedocs.io/en/stable/using.html#managing-certificates)
+  * 94.199.215.198 (jrserver on ip-projects)
+    * /etc/letsencrypt/live/relay.avril.work/fullchain.pem expires on 2022-04-27
+    * /etc/letsencrypt/live/www.avril.work/fullchain.pem expires on 2022-04-27
+  * 202.61.247.140 (Avril2021 on netcup)
+    * /etc/letsencrypt/live/avril2021.avril.work/fullchain.pem expires on Donnerstag, 3. April 2025 um 08:28:04
+  * 185.194.236.66 (Avril2019 on ip-projects)
+    * /etc/letsencrypt/live/avril2019.wialon-consulting.de/fullchain.pem expires on Montag, 1. Januar 2024 um 06:48:09
+===== Misc =====
+  * Running certbot in a container (but our installation is based on a certbot which runs not in docker container, but "purely" on host system )
+    * https://dev.to/kingyou/automating-https-with-docker-nginx-certbot-2ein