]>
Commit | Line | Data |
---|---|---|
1 | # letsencrypt.sh [![Build Status](https://travis-ci.org/lukas2511/letsencrypt.sh.svg?branch=master)](https://travis-ci.org/lukas2511/letsencrypt.sh) | |
2 | ||
3 | This is a client for signing certificates with an ACME-server (currently only provided by letsencrypt) implemented as a relatively simple bash-script. | |
4 | ||
5 | It uses the `openssl` utility for everything related to actually handling keys and certificates, so you need to have that installed. | |
6 | ||
7 | Other dependencies are (for now): curl, sed | |
8 | ||
9 | Perl no longer is a dependency. | |
10 | The only remaining perl code in this repository is the script you can use to convert your existing letsencrypt-keyfile into something openssl (and this script) can read. | |
11 | ||
12 | Current features: | |
13 | - Signing of a list of domains | |
14 | - Renewal if a certificate is about to expire | |
15 | - Certificate revocation | |
16 | ||
17 | Please keep in mind that this software and even the acme-protocol are relatively young and may still have some unresolved issues. | |
18 | Feel free to report any issues you find with this script or contribute by submitting a pullrequest. | |
19 | ||
20 | ## Usage: | |
21 | ||
22 | ```text | |
23 | Usage: ./letsencrypt.sh [-h] [command [argument]] [parameter [argument]] [parameter [argument]] ... | |
24 | ||
25 | Default command: help | |
26 | ||
27 | Commands: | |
28 | --cron (-c) Sign/renew non-existant/changed/expiring certificates. | |
29 | --revoke (-r) path/to/cert.pem Revoke specified certificate | |
30 | --help (-h) Show help text | |
31 | --env (-e) Output configuration variables for use in other scripts | |
32 | ||
33 | Parameters: | |
34 | --domain (-d) domain.tld Use specified domain name instead of domains.txt, use multiple times for certificate with SAN names | |
35 | --force (-x) force renew of certificate even if it is longer valid than value in RENEW_DAYS | |
36 | --config (-f) path/to/config.sh Use specified config file | |
37 | --privkey (-p) path/to/key.pem Use specified private key instead of account key (useful for revocation) | |
38 | ``` | |
39 | ||
40 | ### domains.txt | |
41 | ||
42 | The file `domains.txt` should have the following format: | |
43 | ||
44 | ```text | |
45 | example.com www.example.com | |
46 | example.net www.example.net wiki.example.net | |
47 | ``` | |
48 | ||
49 | This states that there should be two certificates `example.com` and `example.net`, | |
50 | with the other domains in the corresponding line being their alternative names. | |
51 | ||
52 | ### example nginx config | |
53 | ||
54 | If you want to use nginx you can set up a location block to serve your challenge responses: | |
55 | ||
56 | ``` | |
57 | location /.well-known/acme-challenge { | |
58 | root /var/www/letsencrypt; | |
59 | } | |
60 | ``` | |
61 | ||
62 | For this to work i'd suggest either configuring `/var/www/letsencrypt` as WELLKNOWN directory, | |
63 | or to create a symlink to the default location next to the script: `ln -s /var/www/letsencrypt .acme-challenges` | |
64 | ||
65 | ## Import | |
66 | ||
67 | ### import-account.pl | |
68 | ||
69 | This perl-script can be used to import the account key from the original letsencrypt client. | |
70 | ||
71 | You should copy `private_key.json` to the same directory as the script. | |
72 | The json-file can be found in a subdirectory of `/etc/letsencrypt/accounts/acme-v01.api.letsencrypt.org/directory`. | |
73 | ||
74 | Usage: `./import-account.pl` | |
75 | ||
76 | ### import-certs.sh | |
77 | ||
78 | This script can be used to import private keys and certificates created by the original letsencrypt client. | |
79 | ||
80 | By default it expects the certificates to be found under `/etc/letsencrypt`, which is the default output directory of the original client. | |
81 | You can change the path by setting LETSENCRYPT in your config file: ```LETSENCRYPT="/etc/letsencrypt"```. | |
82 | ||
83 | Usage: `./import-certs.sh` |