330
votes
Accepted
How to use Let's Encrypt DNS-01 challenge validation?
Currently it is possible to perform DNS validation, also with the certbot LetsEncrypt client in manual mode. Automation is possible as well (see below).
Manual plugin
You can either perform a manual ...
230
votes
Accepted
Best practices for setting a cron job for Let's Encrypt (Certbot) renewal?
Monthly is not frequent enough.
This script should run at least weekly, and preferably daily. Remember that certs don't get renewed unless they are near to expiration, and monthly could cause your ...
93
votes
Accepted
Lets Encrypt with an nginx reverse proxy
Yes, you can have nginx proxy requests to HTTP servers, and then itself respond to clients over HTTPS. When doing this, you will want to be sure that the nginx<->proxy connect is unlikely to be ...
59
votes
how do I change the admin email for let's encrypt?
Use:
certbot-auto register --update-registration --email [email protected]
or
certbot register --update-registration --email [email protected]
or
certbot update_account --email yourname+...
57
votes
Best practices for setting a cron job for Let's Encrypt (Certbot) renewal?
The certbot documentation recommends running the script twice a day:
Note:
if you're setting up a cron or systemd job, we recommend running it twice per day (it won't do anything until your ...
54
votes
Best practices for setting a cron job for Let's Encrypt (Certbot) renewal?
You shouldn't have to set up anything. Any recent Debian/Ubuntu install of certbot should install a systemd timer and a cron job (and the cron job will only run certbot if systemd is not active, so ...
48
votes
Accepted
A+ rating still unsecure by Google Chrome's opinion
This server could not prove that it is www.zandu.biz; its security
certificate is from zandu.biz. This may be caused by a
misconfiguration or an attacker intercepting your connection.
The name in ...
46
votes
How to use Let's Encrypt DNS-01 challenge validation?
I was able to use the dehydrated client to obtain a certificate using DNS validation.
https://github.com/lukas2511/dehydrated
./dehydrated --cron --domain my.domain.example.com --hook ./hook.route53....
42
votes
Nginx disable .htaccess and hidden files but allow .well-known directory
The other solutions did not helped me.
My solution is to include a negative regex for .well-known. Your code block should look like this then:
## Disable .htaccess and other hidden files
location ~ /...
41
votes
Accepted
How can Let's Encrypt verify the identity over insecure http?
Indeed, there is no infallible protection against a man-in-the-middle attack for the HTTP-01 challenge.
Someone who can intercept traffic between the Let's Encrypt validation nodes and your server CAN ...
39
votes
Accepted
SSL & Ngnix: no "ssl_certificate" is defined in server listening on SSL port while SSL handshaking
My guess is that you have another server listening on port 443.
This server has no ssl_certificate defined, and it's automatically selected (SNI).
Try to delete all symbolic links from /etc/nginx/...
33
votes
Client on Debian 9 erroneously reports expired certificate for letsencrypt-issued domain
Warning! Please plan OS upgrade path. The below advice should be applied only in emergency situation to quickly fix a critical system.
Below solution works on Debian Jessy 8 and should on Stretch 9 ...
29
votes
Nginx disable .htaccess and hidden files but allow .well-known directory
Nginx applies locations with regular expressions in the order of their appearance in the configuration file.
Therefore, adding an entry like this just before your current location it will help you.
...
26
votes
Accepted
Client on Debian 9 erroneously reports expired certificate for letsencrypt-issued domain
First off, Debian 9 is EOL. But as the clients may not be under your control, you may of course want to try to cater to them in this breakage.
I assume that while the question only mentions certbot, ...
25
votes
How to setup coturn with letsencrypt
Thanks for the question. Letsencrypt supports post deploy hooks. I used it with the following.
I am using a Debian 10 buster with coturn 4.5.1.1-1.1 and letsencrypt certbot 0.31.0 .
Assuming:
coturn ...
25
votes
Accepted
Redirect all requests to HTTPS, except for one subdirectory
Try this:
server {
listen 80;
server_name sub.domain.tld;
server_tokens off;
root /var/www/letsencrypt;
location /.well-known {
try_files $uri $uri/ =404;
...
25
votes
Accepted
Why does my Let's Encrypt certificate contain references to Cloudflare?
Nimbus2023 is a certificate transparency log, hosted by Cloudflare. Basically CAB requires that all issued certificates is listed in transparency logs - and CF operates one such. SCT is a Signed ...
23
votes
Let's Encrypt SSL Certificate File Not Found Error, but still working
In my case the files and permissions where not the issue. I was trying to restart the server with apachectl restart or test the config (apachectl -t or apachectl configtest). The user running the ...
19
votes
Accepted
How can I disable "Subject Alternative Name" from being included in Certbot Let's Encrypt certificates?
You don't really want to omit the Subject Alternative Names. If you omit the SAN no modern browser will accept your certificates as valid. If you don't want all domains in one certificate, just create ...
18
votes
Why not validate self signed certificates through DNS-record instead of letsencrypt
The basic infrastructure, that would make this possible, exists and is called DNS-Based Authentication of Named Entities (DANE) and specified in RFC6698. It works by means of a TLSA resource record, ...
17
votes
Accepted
Certbot letsencrypt on different port than 443
According to:
https://community.letsencrypt.org/t/how-to-specify-a-port-different-from-443-for-the-dvsni-challenge/12753/4
This is not possible with certbot.
You should take a look at the other ...
17
votes
Nginx SSL_do_handshake() failed SSL: error:1417D18C:SSL
Ignore Them
Looking at the number of connection attempts made to my site within a short span of time, these are clearly attempts to compromise the server's security. Don't downgrade your security ...
16
votes
Accepted
Renew domains using certbot and using DNS challenge
Updated answer (see original answer below)
In my original answer I focused on the fact that the script you provided is not required when using the renew command. However, I did not make sure the renew ...
15
votes
Accepted
looking for a way to get certbot running on Amazon Linux 2
I was having trouble with this as well since Amazon Linux 2 doesn't have epel-release in its repositories, but I've found you can install the EPEL RPM package itself, and then you'll be able to ...
14
votes
how do I change the admin email for let's encrypt?
Update based on https://letsencrypt.org/docs/expiration-emails/
certbot update_account --email [email protected]
Before This is just an update on n3rve's answer, since certbot-auto didn't work ...
14
votes
SSL & Ngnix: no "ssl_certificate" is defined in server listening on SSL port while SSL handshaking
I fixed this same problem earlier this morning, so I'm here to clarify C.A's point (which, now that I understand the problem, was well made), you most likely have two server blocks:
# default
server {...
14
votes
Accepted
Letsencrypt for all subdomains *.example.com
As mentioned in a comment, the solution is to use DNS challenge validation, like here: How to use Let's Encrypt DNS-01 challenge validation?.
First, remove your previous certificate (if needed) ...
14
votes
Accepted
How do I specify a port other than 80 when adding SSL certificate using Certbot?
There is no way to specify a different port than defaults (80/443).
I recommend you to use the acme-dns validation. I use it and it works fine.
More details here : https://www.digitalocean.com/...
13
votes
how do I change the admin email for let's encrypt?
There is also a contact email address stored by the python letsencrypt client under:
/etc/letsencrypt/accounts/acme-v01.api.letsencrypt.org/directory/{someKindOfHash}/regr.json
I believe that if you ...
Only top scored, non community-wiki answers of a minimum length are eligible
Related Tags
lets-encrypt × 839ssl × 273
nginx × 223
ssl-certificate × 213
certbot × 172
apache-2.4 × 100
https × 65
ubuntu × 57
apache2 × 46
docker × 37
domain-name-system × 35
linux × 28
apache-2.2 × 25
debian × 20
virtualhost × 19
postfix × 18
openssl × 18
cloudflare × 18
centos × 17
reverse-proxy × 16
redirect × 16
amazon-ec2 × 15
certificate × 15
haproxy × 14
subdomain × 14