Operations grimoire/TLS certificates - Revision history

Dereckson: /* on nginx */

2026-02-05T22:58:26Z

on nginx

← Older revision		Revision as of 22:58, 5 February 2026
Line 142:		Line 142:

	doit être mis dans le fichier de configuration pour le certificat ou ajouter la commande		doit être mis dans le fichier de configuration pour le certificat ou ajouter la commande

			''This part is now handled by Salt, as part of {{D\|3906}}.''

	== Nasqueron PKI ==		== Nasqueron PKI ==

2026-02-05T22:58:07Z

Deploying of the certificates

← Older revision		Revision as of 22:58, 5 February 2026
Line 118:		Line 118:
	--fullchain-file /var/certificates/exemple.nasqueron.org/fullchain.pem \		--fullchain-file /var/certificates/exemple.nasqueron.org/fullchain.pem \
	--ca-file /var/certificates/exemple.nasqueron.org/chain.pem		--ca-file /var/certificates/exemple.nasqueron.org/chain.pem

			''This command is now run by Salt, as part of {{D\|3906}}.''

	===== improved command =====		===== improved command =====
Line 132:		Line 134:
	--ca-file /var/certificates/$domain/chain.pem \		--ca-file /var/certificates/$domain/chain.pem \
	--fullchain-file /var/certificates/$domain/fullchain.pem		--fullchain-file /var/certificates/$domain/fullchain.pem

			''This command is now run by Salt, as part of {{D\|3906}}.''

	==== on nginx ====		==== on nginx ====

2025-05-20T19:38:56Z

improved command

← Older revision		Revision as of 19:38, 20 May 2025
Line 130:		Line 130:
	--cert-file /var/certificates/$domain/cert.pem \		--cert-file /var/certificates/$domain/cert.pem \
	--key-file /var/certificates/$domain/key.pem \		--key-file /var/certificates/$domain/key.pem \
	--~~fullchain~~-file /var/certificates/$domain/~~fullchain~~.pem \		--ca-file /var/certificates/$domain/chain.pem \
	--ca-file /var/certificates/$domain/~~chain~~.pem		--fullchain-file /var/certificates/$domain/fullchain.pem

	==== on nginx ====		==== on nginx ====

2025-05-20T19:38:09Z

improved command

← Older revision		Revision as of 19:38, 20 May 2025
Line 130:		Line 130:
	--cert-file /var/certificates/$domain/cert.pem \		--cert-file /var/certificates/$domain/cert.pem \
	--key-file /var/certificates/$domain/key.pem \		--key-file /var/certificates/$domain/key.pem \
	--fullchain-file /var/certificates/$domain/fullchain.pem		--fullchain-file /var/certificates/$domain/fullchain.pem \
	--ca-file /var/certificates/$domain/chain.pem		--ca-file /var/certificates/$domain/chain.pem

2025-05-20T19:35:09Z

Deploying of the certificates

← Older revision		Revision as of 19:35, 20 May 2025
Line 116:		Line 116:
	--cert-file /var/certificates/exemple.nasqueron.org/cert.pem \		--cert-file /var/certificates/exemple.nasqueron.org/cert.pem \
	--key-file /var/certificates/exemple.nasqueron.org/key.pem \		--key-file /var/certificates/exemple.nasqueron.org/key.pem \
	--fullchain-file /var/certificates/exemple.nasqueron.org/fullchain.pem		--fullchain-file /var/certificates/exemple.nasqueron.org/fullchain.pem \
			--ca-file /var/certificates/exemple.nasqueron.org/chain.pem

	===== improved command =====		===== improved command =====
Line 131:		Line 131:
	--key-file /var/certificates/$domain/key.pem \		--key-file /var/certificates/$domain/key.pem \
	--fullchain-file /var/certificates/$domain/fullchain.pem		--fullchain-file /var/certificates/$domain/fullchain.pem
			--ca-file /var/certificates/$domain/chain.pem

	==== on nginx ====		==== on nginx ====

2025-03-12T21:25:27Z

on nginx

← Older revision		Revision as of 21:25, 12 March 2025
Line 133:		Line 133:

	==== on nginx ====		==== on nginx ====

			Le_ReloadCmd='sudo acmesh-nginxCheck'

			doit être mis dans le fichier de configuration pour le certificat ou ajouter la commande

	== Nasqueron PKI ==		== Nasqueron PKI ==

2025-02-10T20:51:54Z

Credential lost for a ACME DNS subdomain

← Older revision		Revision as of 20:51, 10 February 2025
Line 216:		Line 216:
	$ ssh docker-002		$ ssh docker-002
	$ export SQLITE_HISTORY=/dev/null		$ export SQLITE_HISTORY=/dev/null
	$ sqlite3 /srv/acme/. lib/acme-dns.db		$ sqlite3 /srv/acme/lib/acme-dns.db
	UPDATE records SET Password = "<new bcrypt hash>" WHERE Subdomain = "<DNS answer>"		UPDATE records SET Password = "<new bcrypt hash>" WHERE Subdomain = "<DNS answer>"

2025-01-03T11:48:02Z

Paths to update

← Older revision		Revision as of 11:48, 3 January 2025
Line 233:		Line 233:
	==== Paths to update ====		==== Paths to update ====

	Paths from /usr/local/etc/letsencrypt or /etc/letsencrypt (OS-dependant path) needs to be updated to /var/certificates (cross-platform path).		Paths from /usr/local/etc/letsencrypt or /etc/letsencrypt (OS-dependant path) needs to be updated to /var/certificates (cross-platform path). The private key file is only `key.pem` instead of `privkey.pem`.

	An example is available on https://devcentral.nasqueron.org/D3624		An example is available on https://devcentral.nasqueron.org/D3624

2025-01-03T11:47:14Z

← Older revision		Revision as of 11:47, 3 January 2025
Line 229:		Line 229:

	Replace $2y$ by $2a$ as x and y are unique for PHP, the rest of the world uses $2a$.		Replace $2y$ by $2a$ as x and y are unique for PHP, the rest of the world uses $2a$.

			=== Migration to acme.sh ===
			==== Paths to update ====

			Paths from /usr/local/etc/letsencrypt or /etc/letsencrypt (OS-dependant path) needs to be updated to /var/certificates (cross-platform path).

			An example is available on https://devcentral.nasqueron.org/D3624

	== Notes & references ==		== Notes & references ==
	<references />		<references />

2024-11-05T20:34:57Z

Deploying of the certificates

@@ Line 116: / Line 116: @@
    --cert-file /var/certificates/exemple.nasqueron.org/cert.pem \
    --key-file /var/certificates/exemple.nasqueron.org/key.pem \
-   --fullchain-file /var/certificates/exemple.nasqueron.org/fullchain.pem \
+   --fullchain-file /var/certificates/exemple.nasqueron.org/fullchain.pem
 ==== on nginx ====