]>
Commit | Line | Data |
---|---|---|
7664f1c2 | 1 | # letsencrypt.sh [![Build Status](https://travis-ci.org/lukas2511/letsencrypt.sh.svg?branch=master)](https://travis-ci.org/lukas2511/letsencrypt.sh) |
61f0b7ed | 2 | |
e567a87e | 3 | This is a client for signing certificates with an ACME-server (currently only provided by letsencrypt) implemented as a relatively simple bash-script. |
274e8e41 LS |
4 | |
5 | It uses the `openssl` utility for everything related to actually handling keys and certificates, so you need to have that installed. | |
6 | ||
7 | Other dependencies are (for now): curl, sed | |
8 | ||
9 | Perl no longer is a dependency. | |
77df80b5 | 10 | The only remaining perl code in this repository is the script you can use to convert your existing letsencrypt-keyfile into something openssl (and this script) can read. |
274e8e41 LS |
11 | |
12 | Current features: | |
13 | - Signing of a list of domains | |
14 | - Renewal if a certificate is about to expire | |
12c566b1 | 15 | - Certificate revocation |
274e8e41 LS |
16 | |
17 | Please keep in mind that this software and even the acme-protocol are relatively young and may still have some unresolved issues. | |
18 | Feel free to report any issues you find with this script or contribute by submitting a pullrequest. | |
0d7913ab LS |
19 | |
20 | ## Usage: | |
21 | ||
8662a000 LS |
22 | ```text |
23 | Usage: ./letsencrypt.sh [-h] [command [argument]] [parameter [argument]] [parameter [argument]] ... | |
0d7913ab | 24 | |
083c6736 | 25 | Default command: help |
8662a000 LS |
26 | |
27 | Commands: | |
083c6736 | 28 | --cron (-c) Sign/renew non-existant/changed/expiring certificates. |
8662a000 LS |
29 | --revoke (-r) path/to/cert.pem Revoke specified certificate |
30 | --help (-h) Show help text | |
31 | --env (-e) Output configuration variables for use in other scripts | |
32 | ||
33 | Parameters: | |
92a822e0 LS |
34 | --domain (-d) domain.tld Use specified domain name(s) instead of domains.txt entry (one certificate!) |
35 | --force (-x) Force renew of certificate even if it is longer valid than value in RENEW_DAYS | |
8662a000 | 36 | --privkey (-p) path/to/key.pem Use specified private key instead of account key (useful for revocation) |
92a822e0 | 37 | --config (-f) path/to/config.sh Use specified config file |
ed27e013 | 38 | --hook (-k) path/to/hook.sh Use specified script for hooks |
0d7913ab | 39 | ``` |
8662a000 LS |
40 | |
41 | ### domains.txt | |
42 | ||
43 | The file `domains.txt` should have the following format: | |
44 | ||
45 | ```text | |
0d7913ab LS |
46 | example.com www.example.com |
47 | example.net www.example.net wiki.example.net | |
48 | ``` | |
49 | ||
50 | This states that there should be two certificates `example.com` and `example.net`, | |
51 | with the other domains in the corresponding line being their alternative names. | |
52 | ||
7b968344 | 53 | ### $WELLKNOWN / challenge-response |
0d7913ab | 54 | |
7b968344 | 55 | Boulder (acme-server) is looking for challenge responses under your domain in the `.well-known/acme-challenge` directory |
0d7913ab | 56 | |
92a822e0 | 57 | This script uses `http-01`-type verification (for now) so you need to have that directory available over normal http (no ssl). |
7b968344 LS |
58 | |
59 | A full URL would look like `http://example.org/.well-known/acme-challenge/c3VjaC1jaGFsbGVuZ2UtbXVjaA-aW52YWxpZC13b3c`. | |
60 | ||
61 | An example setup to get this to work would be: | |
62 | ||
63 | nginx.conf: | |
0d7913ab | 64 | ``` |
7b968344 | 65 | ... |
0d7913ab | 66 | location /.well-known/acme-challenge { |
7b968344 | 67 | alias /var/www/letsencrypt; |
0d7913ab | 68 | } |
7b968344 LS |
69 | ... |
70 | ``` | |
71 | ||
72 | config.sh: | |
73 | ```bash | |
74 | ... | |
75 | WELLKNOWN="/var/www/letsencrypt" | |
76 | ... | |
0d7913ab LS |
77 | ``` |
78 | ||
7b968344 LS |
79 | An alternative to setting the WELLKNOWN variable would be to create a symlink to the default location next to the script (or BASEDIR): |
80 | `ln -s /var/www/letsencrypt .acme-challenges` | |
8662a000 | 81 | |
0d7913ab LS |
82 | ## Import |
83 | ||
84 | ### import-account.pl | |
85 | ||
86 | This perl-script can be used to import the account key from the original letsencrypt client. | |
87 | ||
88 | You should copy `private_key.json` to the same directory as the script. | |
89 | The json-file can be found in a subdirectory of `/etc/letsencrypt/accounts/acme-v01.api.letsencrypt.org/directory`. | |
90 | ||
ffa35427 | 91 | Usage: `./import-account.pl` |
0d7913ab LS |
92 | |
93 | ### import-certs.sh | |
94 | ||
95 | This script can be used to import private keys and certificates created by the original letsencrypt client. | |
96 | ||
97 | By default it expects the certificates to be found under `/etc/letsencrypt`, which is the default output directory of the original client. | |
98 | You can change the path by setting LETSENCRYPT in your config file: ```LETSENCRYPT="/etc/letsencrypt"```. | |
99 | ||
100 | Usage: `./import-certs.sh` |