Hot answers tagged

19

Better method, thanks to the others responses for helping me get to this. Determine what plugins are installed currently: # certbot-auto plugins Saving debug log to /var/log/letsencrypt/letsencrypt.log - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - * apache Description: Apache Web Server plugin - Beta Interfaces: ...


15

First run # type certbot certbot is hashed (/usr/bin/certbot) To find out where certbot is installed to. Or command -v certbot if you prefer. Then run head /usr/bin/certbot and note what version of Python it's using: #!/usr/bin/python3 In my case, it was using Python 3. I noticed from my pip output it was trying to install a Python 2.7 package: # pip ...


11

I think you're looking for the wait_for module. It will allow you to check and make an action when a certain port is available and more.


8

Now (July 2018), you should be able to use either pip install certbot-dns-digitalocean or git clone https://github.com/certbot/certbot.git cd certbot/certbot-dns-digitalocean/ python setup.py install You may need sudo privileges for either. After installing you may not be able to see the plugin with certbot plugins, but you should be able to certbot ...


5

Thanks for linking your question. Here's the github thread for reference: https://github.com/geerlingguy/ansible-role-certbot/issues/87 There are many different ways to get certs from a CA. certbot (what this repo uses) is just one of the ways which uses letsencrypt as a certificate authority. acme_certificate is more generic and if you can't use ...


3

You have to use Docker to use dns plugins. From DNS Plugins: These plugins are still in the process of being packaged by many distributions and cannot currently be installed with certbot-auto. If, however, you are comfortable installing the certificates yourself, you can run these plugins with Docker.


3

You just can not because from Let's Encrypt FAQ: What IP addresses does Let’s Encrypt use to validate my web server? We don’t publish a list of IP addresses we use to validate, because they may change at any time. In the future we may validate from multiple IP addresses at once. You will need a reverse proxy (usually a WAF), routing /.well-...


2

Based on @13nilux' answer the following code has been created: - name: Check whether port 80 is available wait_for: port: 80 state: stopped timeout: 10 When port 80 is listening the run will fail if for example nginx is listening: TASK [role_under_test : Check whether port 80 is available] ******************** fatal: [localhost]: FAILED! =&...


2

The way you install certbot plugins depends on how you installed certbot itself. If you installed certbot using some package manager (apt, rpm, brew...), then you should look for compatible certbot plugins in that package manager's repository. Let's Encrypt also support an alternative installation method: the certbot-auto wrapper. This wrapper creates a ...


1

If you're on ubuntu or debian, you can grab the following packages from debian testing (buster) python3-certbot-dns-digitalocean_0.23.0-2_all.deb python3-digitalocean_1.13.2-1_all.deb


1

Don't read the text written on Certbot site, the real talk is in the documentation. In order to make less actions, consider grouping configs by domains. Plays for a playbook in order to achieve what you want: Deploy certbot and nginx with no config files, then for each domain on host: Deploy an nginx config for default server with location /.well-known/acme-...


1

Answered my own question, documented my steps on my Github repo. Recap: Add Nginx config to desired domains: location ~ /.well-known/acme-challenge { allow all; try_files $uri $uri/ /index.php; } Use certbot staging to try out test certificates before running the real deal. sudo docker run -it --rm -v /some/place/to/save/letsencrypt:/...


1

I have been writing a few playbooks and roles to automate the installation of servers in my network, but the initial request for a certificate from LE has always proven cumbersome. E.g. For a dns-01 challenge, your dns configuration must have been propagated upstream or certbot will fail. I am now considering to use the native acme_* modules to acquire the ...


1

Others have pointed it out already; Certbot makes it easy to handle certificates while acme_certificate module is more flexible and transparent. Acquire Certificate To request the ssl certificate with acme_certificate, there are good examples on DigitalOcean or on Reddit. These examples boil down to following tasks: Ensure you have a private key for your ...


1

Changed the challenge from tls-sni to: --preferred-challenges http and the certificates are renewed.


1

For those who is using certbot distributed by OS distros certbot plugins can be installed by a package manager using provider's name, for example: Debian/Ubuntu: apt-get install python3-certbot-dns-cloudflare apt-get install python3-certbot-dns-google apt-get install python3-certbot-dns-route53 RHEL/CentOS/Rocky/AlmaLinux 8: dnf install python3-certbot-dns-...


1

This worked for me on Ubuntu 18.04 LTS apt install certbot apt install python3-certbot-dns-digitalocean See this certbot issue


1

If you really want to create the role yourself, you have to use --agree-tos --noninteractive to disable user interaction. See https://certbot.eff.org/docs/using.html for more details


1

@euank indicated that it is not required to create a DNS record on GCP in order to make it work. https://github.com/jetstack/cert-manager/issues/399


Only top voted, non community-wiki answers of a minimum length are eligible