6 ms·
> Now you've still got a hurdle to overcome. In order for nginx to serve out the right certificate chain, you'll need to bundle the intermediary. So you should
by gingerlime 11y ago
> Now you've still got a hurdle to overcome. In order for nginx to serve out the right certificate chain, you'll need to bundle the intermediary. So you should wget that from The official Certificates Download page.
A small suggestion - instead of wget-ing the certificate chain from the page, I would use the cert-chain-resolver tool[0]. It's super simple, but highly effective bash script that wraps around OpenSSL / wget and does all this for you.
[0] https://github.com/zakjan/cert-chain-resolver https://github.com/zakjan/cert-chain-resolver
- deleted 11y ago[deleted]
- IceyEC 11y agoIt's bash so pretty easy to audit
- coherentpony 11y agoThe first thing I notice is a missing set -eu set -o pipefail at the top of the script, which is equivalent to ON ERROR RESUME NEXT in BASIC.
- voltagex_ 11y agohttps://github.com/zakjan/cert-chain-resolver/issues https://github.com/zakjan/cert-chain-resolver/issues - add an issue?
- leni536 11y agoNote that "set -e" doesn't work in subshells so you have to be extremely careful if you make complex subshell commands or write set -e in every subshell too.
- icebraining 11y agoApparently, "pipefail" is a bashism, you can't use it on portable scripts.
- deleted 11y ago[deleted]
- zakjan 11y agoAuthor here. I used the options you mention before, however I found it highly unreliable. I have replaced them with better manual error handling and tests. Please review the latest code. I'm looking forward to any reported issues.
- zakjan 11y agoAlso I'm going to rewrite it to a different language, Shell was really just a quick hack. Probably in C. I want to keep it minimalistic in dependencies.
- deleted 11y ago[deleted]
- zachberger 11y agoHad the author used the official tool, the chain would be automatically downloaded. [0] Additionally the author is over-weary of the official tool complaining it modifies server conf files. In fact the default option recommended to beta users, './letsencrypt-auto auth', simply downloads the certificates and doesn't touch conf files at all. [0] https://letsencrypt.readthedocs.org/en/latest/using.html#where-are-my-certificates https://letsencrypt.readthedocs.org/en/latest/using.html#whe...