0

How could I automate the generation of SSL certificates for different subdomains? In my workflow, different subdomains ab.mydomain.com, cd.mydomain.com, ab.mynewdomain.com, etc. will point to the IP of my Nginx machine.

I want to generate SSL certificates for these subdomains configured on my Nginx. How could I automate the generation of SSL certificates? Is there a way? Is there any library that can do this for me? I can also start with free SSL certificates, that will not be a problem.

I tried to search this, but could not find any answer.

  • Check out letsencrypt. They have a tool which generates & renews certificates. You need to set up a scheduled task to call "certbot renew". My advice is don't let certbot auto modify your nginx config, just get the certificates and configure nginx manually. – Admiral Noisy Bottom Jun 5 at 4:20
  • @AdmiralNoisyBottom Could you please point me to a tutorial / steps? – Amanda Jun 5 at 4:29
  • @AdmiralNoisyBottom Also, I want to skip the questions that are asked during SSL certificate generation. Is there a way to supply the answers as arguments while invoking the utility? – Amanda Jun 5 at 4:32
  • From memory passing -q to certbot causes it to be quiet and provide no output or ask questions. A cron job calling "certbot -q renew" will renew all certificates within 30 days of expiring. – Admiral Noisy Bottom Jun 5 at 4:40
  • There is a standardized protocol called ACME. It allows to interact with a CA and make it generate certificates, after validation. This is what Let's Encrypt uses, but other CAs exist that allows to use this protocol. – Patrick Mevzek Jun 7 at 0:40
1

Admiral Noisy Bottom is right, LetsEncrypt can generate valid certificates for you, and certbot is one of the easiest ways to do that.

You can find certbot instructions here which differ slightly for each platform.

Certbot will make the changes to your nginx configuration for you, if you run:

sudo certbot --nginx

You may need to answer some questions the first time you run it, but for future renewals it will be automatic.

(You might want to back up your nginx config first! But I've never had a problem with it.)

Don't forget to follow their instructions at the end of the process, to add a cronjob for automatic renewal.


One mistake I have in the past was to use crontab -e instead of creating a file at /etc/cron.d/certbot. Adding a line to the crontab can work, but in that case you need to remove the root argument from the cron line. It's easier just to follow their instructions exactly.

| improve this answer | |
  • I want to automate the QA part too. Is there a way to do that? – Amanda Jun 8 at 6:21
  • @Amanda You may be able to use curl in a shellscript. To actually test against browsers you could consider puppeteer or Selenium. – joeytwiddle Jun 10 at 4:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.