330 votes
Accepted

How to use Let's Encrypt DNS-01 challenge validation?

Currently it is possible to perform DNS validation, also with the certbot LetsEncrypt client in manual mode. Automation is possible as well (see below). Manual plugin You can either perform a manual ...
ph4r05's user avatar
  • 3,426
230 votes
Accepted

Best practices for setting a cron job for Let's Encrypt (Certbot) renewal?

Monthly is not frequent enough. This script should run at least weekly, and preferably daily. Remember that certs don't get renewed unless they are near to expiration, and monthly could cause your ...
Michael Hampton's user avatar
93 votes
Accepted

Lets Encrypt with an nginx reverse proxy

Yes, you can have nginx proxy requests to HTTP servers, and then itself respond to clients over HTTPS. When doing this, you will want to be sure that the nginx<->proxy connect is unlikely to be ...
puzzlement's user avatar
  • 1,096
59 votes

how do I change the admin email for let's encrypt?

Use: certbot-auto register --update-registration --email [email protected] or certbot register --update-registration --email [email protected] or certbot update_account --email yourname+...
Ralph's user avatar
  • 892
57 votes

Best practices for setting a cron job for Let's Encrypt (Certbot) renewal?

The certbot documentation recommends running the script twice a day: Note: if you're setting up a cron or systemd job, we recommend running it twice per day (it won't do anything until your ...
glaux's user avatar
  • 681
54 votes

Best practices for setting a cron job for Let's Encrypt (Certbot) renewal?

You shouldn't have to set up anything. Any recent Debian/Ubuntu install of certbot should install a systemd timer and a cron job (and the cron job will only run certbot if systemd is not active, so ...
Hamish Downer's user avatar
48 votes
Accepted

A+ rating still unsecure by Google Chrome's opinion

This server could not prove that it is www.zandu.biz; its security certificate is from zandu.biz. This may be caused by a misconfiguration or an attacker intercepting your connection. The name in ...
zrm's user avatar
  • 636
46 votes

How to use Let's Encrypt DNS-01 challenge validation?

I was able to use the dehydrated client to obtain a certificate using DNS validation. https://github.com/lukas2511/dehydrated ./dehydrated --cron --domain my.domain.example.com --hook ./hook.route53....
alexcline's user avatar
  • 571
42 votes

Nginx disable .htaccess and hidden files but allow .well-known directory

The other solutions did not helped me. My solution is to include a negative regex for .well-known. Your code block should look like this then: ## Disable .htaccess and other hidden files location ~ /...
therealmarv's user avatar
41 votes
Accepted

How can Let's Encrypt verify the identity over insecure http?

Indeed, there is no infallible protection against a man-in-the-middle attack for the HTTP-01 challenge. Someone who can intercept traffic between the Let's Encrypt validation nodes and your server CAN ...
Håkan Lindqvist's user avatar
39 votes
Accepted

SSL & Ngnix: no "ssl_certificate" is defined in server listening on SSL port while SSL handshaking

My guess is that you have another server listening on port 443. This server has no ssl_certificate defined, and it's automatically selected (SNI). Try to delete all symbolic links from /etc/nginx/...
C.A. Vuyk's user avatar
  • 632
33 votes

Client on Debian 9 erroneously reports expired certificate for letsencrypt-issued domain

Warning! Please plan OS upgrade path. The below advice should be applied only in emergency situation to quickly fix a critical system. Below solution works on Debian Jessy 8 and should on Stretch 9 ...
gertas's user avatar
  • 1,117
29 votes

Nginx disable .htaccess and hidden files but allow .well-known directory

Nginx applies locations with regular expressions in the order of their appearance in the configuration file. Therefore, adding an entry like this just before your current location it will help you. ...
Weirdei's user avatar
  • 416
26 votes
Accepted

Client on Debian 9 erroneously reports expired certificate for letsencrypt-issued domain

First off, Debian 9 is EOL. But as the clients may not be under your control, you may of course want to try to cater to them in this breakage. I assume that while the question only mentions certbot, ...
Håkan Lindqvist's user avatar
25 votes

How to setup coturn with letsencrypt

Thanks for the question. Letsencrypt supports post deploy hooks. I used it with the following. I am using a Debian 10 buster with coturn 4.5.1.1-1.1 and letsencrypt certbot 0.31.0 . Assuming: coturn ...
luvzfootball's user avatar
25 votes
Accepted

Redirect all requests to HTTPS, except for one subdirectory

Try this: server { listen 80; server_name sub.domain.tld; server_tokens off; root /var/www/letsencrypt; location /.well-known { try_files $uri $uri/ =404; ...
Tero Kilkanen's user avatar
25 votes
Accepted

Why does my Let's Encrypt certificate contain references to Cloudflare?

Nimbus2023 is a certificate transparency log, hosted by Cloudflare. Basically CAB requires that all issued certificates is listed in transparency logs - and CF operates one such. SCT is a Signed ...
vidarlo's user avatar
  • 9,112
23 votes

Let's Encrypt SSL Certificate File Not Found Error, but still working

In my case the files and permissions where not the issue. I was trying to restart the server with apachectl restart or test the config (apachectl -t or apachectl configtest). The user running the ...
mrtnmgs's user avatar
  • 351
19 votes
Accepted

How can I disable "Subject Alternative Name" from being included in Certbot Let's Encrypt certificates?

You don't really want to omit the Subject Alternative Names. If you omit the SAN no modern browser will accept your certificates as valid. If you don't want all domains in one certificate, just create ...
Gerald Schneider's user avatar
18 votes

Why not validate self signed certificates through DNS-record instead of letsencrypt

The basic infrastructure, that would make this possible, exists and is called DNS-Based Authentication of Named Entities (DANE) and specified in RFC6698. It works by means of a TLSA resource record, ...
Sebastian Schrader's user avatar
17 votes
Accepted

Certbot letsencrypt on different port than 443

According to: https://community.letsencrypt.org/t/how-to-specify-a-port-different-from-443-for-the-dvsni-challenge/12753/4 This is not possible with certbot. You should take a look at the other ...
Orphans's user avatar
  • 1,424
17 votes

Nginx SSL_do_handshake() failed SSL: error:1417D18C:SSL

Ignore Them Looking at the number of connection attempts made to my site within a short span of time, these are clearly attempts to compromise the server's security. Don't downgrade your security ...
Mark Tomlin's user avatar
16 votes
Accepted

Renew domains using certbot and using DNS challenge

Updated answer (see original answer below) In my original answer I focused on the fact that the script you provided is not required when using the renew command. However, I did not make sure the renew ...
malte's user avatar
  • 326
15 votes
Accepted

looking for a way to get certbot running on Amazon Linux 2

I was having trouble with this as well since Amazon Linux 2 doesn't have epel-release in its repositories, but I've found you can install the EPEL RPM package itself, and then you'll be able to ...
David Birks's user avatar
14 votes

how do I change the admin email for let's encrypt?

Update based on https://letsencrypt.org/docs/expiration-emails/ certbot update_account --email [email protected] Before This is just an update on n3rve's answer, since certbot-auto didn't work ...
lupo's user avatar
  • 141
14 votes

SSL & Ngnix: no "ssl_certificate" is defined in server listening on SSL port while SSL handshaking

I fixed this same problem earlier this morning, so I'm here to clarify C.A's point (which, now that I understand the problem, was well made), you most likely have two server blocks: # default server {...
Big T's user avatar
  • 889
14 votes
Accepted

Letsencrypt for all subdomains *.example.com

As mentioned in a comment, the solution is to use DNS challenge validation, like here: How to use Let's Encrypt DNS-01 challenge validation?. First, remove your previous certificate (if needed) ...
Basj's user avatar
  • 739
14 votes
Accepted

How do I specify a port other than 80 when adding SSL certificate using Certbot?

There is no way to specify a different port than defaults (80/443). I recommend you to use the acme-dns validation. I use it and it works fine. More details here : https://www.digitalocean.com/...
Thomas Coche's user avatar
13 votes

how do I change the admin email for let's encrypt?

There is also a contact email address stored by the python letsencrypt client under: /etc/letsencrypt/accounts/acme-v01.api.letsencrypt.org/directory/{someKindOfHash}/regr.json I believe that if you ...
Alex Nauda's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible