4 ms·
If, like me, you don't want it to modify your configs files for you, and don't want to turn off the webserver everytime you renew certificates, use Webroot mode
by wildpeaks 10y ago
If, like me, you don't want it to modify your configs files for you, and don't want to turn off the webserver everytime you renew certificates, use Webroot mode.
I updated my guide to setup Nginx + Ubuntu 16.04 + Let's encrypt (Nginx, IPv6, HTTP/2, and A+ rating at SLL Labs):
https://gist.github.com/cecilemuller/a26737699a7e70a7093d4dc115915de8 https://gist.github.com/cecilemuller/a26737699a7e70a7093d4dc...
I hope it helps those that hesitate to use Let's encrypt.
- JelteF 10y agoAnother good method is to use https://github.com/diafygi/acme-tiny https://github.com/diafygi/acme-tiny and the ciphers from https://cipherli.st https://cipherli.st
- JoshTriplett 10y agoI used acme-tiny to secure several domains on my server, including automated renewal via cron, running as an unprivileged user that only has access to the CSR, the ACME auth key, and the directory /.well-known/acme maps to, but not the server private key. Took about an hour to secure three domains, most of which was convincing OpenSSL to produce the right three CSRs with SubjectAltName set (to cover the "www." variants so I can securely redirect them).
- pde3 10y agoYou can now get those instructions in concise form from the simple widget at https://certbot.eff.org https://certbot.eff.org. Let us know if there are any tweaks you'd like to see made to them (or send a PR to https://github.com/certbot/website https://github.com/certbot/website, the instructions are in _scripts/instruction-widget)