{"id":2837,"date":"2016-02-26T11:20:16","date_gmt":"2016-02-26T16:20:16","guid":{"rendered":"https:\/\/antipaucity.com\/?p=2837"},"modified":"2016-02-26T11:20:16","modified_gmt":"2016-02-26T16:20:16","slug":"automated-lets-encrypt-ssl-certificate-renewal-on-centos-7","status":"publish","type":"post","link":"https:\/\/merikebi.warrenmyers.com\/?p=2837","title":{"rendered":"automated let’s encrypt ssl certificate renewal on centos 7"},"content":{"rendered":"

In my how-to for Let’s Encrypt<\/a>, I gave an example script that can be called via cron (or manually) which will renew Let’s Encrypt<\/a> {{SSL}} certificates under {{CentOS}} 6.<\/p>\n

If you want to do it on {{CentOS}} 7 (which is what I am now running<\/a>), use the following:<\/p>\n

cd ~\/letsencrypt
\ngit pull
\nsystemctl stop httpd.service
\n~\/letsencrypt\/letsencrypt-auto --agree-tos --keep --rsa-key-size 2048 --standalone certonly -m user@domain.tld -d domain.tld [-d sub.domain.tld [-d ...]]
\nsystemctl start httpd.service
\n<\/code><\/p>\n

Now, what does this script do? Step by step:<\/p>\n

    \n
  1. clear-out the last grab of the Let’s Encrypt git repo (there’s probably a better way to do this, but I don’t know what it is)<\/li>\n
  2. go to root’s home (\/root<\/code>)<\/li>\n
  3. clone-down the Let’s Encrypt<\/a> toolset<\/li>\n
  4. stop httpd ({{Apache}} in my case, though you might be running {{nginx}} or something else<\/li>\n
  5. run the cert tool in automated form:\n
      \n
    1. agree to terms of service<\/li>\n
    2. keep current cert if it doesn’t need to be updated<\/li>\n
    3. key size of 2048 bits<\/a><\/li>\n
    4. run the standalone webserver to verify “ownership” of the domain<\/li>\n
    5. generate just the cert<\/li>\n
    6. administrative email (optional, but “encouraged”)<\/li>\n
    7. domain(s) to issue cert for (must be individually identified with successive -d flags; LE does not support wildcard certs<\/a>)<\/li>\n<\/ol>\n<\/li>\n
    8. restart httpd<\/li>\n<\/ol>\n

      I set mine to run @weekly<\/code> in cron<\/a> – @monthly<\/code> is likely<\/em> good enough, but since it’s “free” to run, running slightly more than is necessary seems good to me. Plus, if you’re getting {{SSL}} certs for many domains all being served from the same server, they may have different expiration dates, so running more often is better.<\/p>\n

      My crontab entry for renewing certs:<\/p>\n

      @weekly \/root\/renew-le-ssl.sh<\/code><\/p>\n","protected":false},"excerpt":{"rendered":"

      In my how-to for Let’s Encrypt, I gave an example script that can be called via cron (or manually) which will renew Let’s Encrypt {{SSL}} certificates under {{CentOS}} 6. If you want to do it on {{CentOS}} 7 (which is what I am now running), use the following: cd ~\/letsencrypt git pull systemctl stop httpd.service …
      Continue reading automated let’s encrypt ssl certificate renewal on centos 7<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_hide_featured_image":false,"_jetpack_featured_image_duplicate_dismissed":0,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[41,45],"tags":[166,390,713],"keyring_services":[],"class_list":["post-2837","post","type-post","status-publish","format-standard","hentry","category-technical","category-tutorial","tag-centos","tag-how-to","tag-ssl"],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/posts\/2837","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2837"}],"version-history":[{"count":0,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/posts\/2837\/revisions"}],"wp:attachment":[{"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2837"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2837"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2837"},{"taxonomy":"keyring_services","embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Fkeyring_services&post=2837"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}