Junos OS

Hi Morne,

Basically, the certbot tool, a script to retrieve and update the webserver certificate and a firewall rule is what you need:

Firstly, install the certbot tool and update the firewall in order to open port 80:

$ dnf install -y certbot$ firewall-cmd --permanent --add-service=http --zone t128$ firewall-cmd --reload

Secondly, make sure your fqdn resolves publicly to the IP address of your conductor:

$ host conductor.example.com 8.8.8.8

Then create a script that binds altogether (replace "conductor.example.com" with your FQDN):

$ cat > /usr/local/sbin/renew-certificate.sh <<'EOF'#!/bin/shDOMAIN=conductor.example.comcertbot certonly -d $DOMAIN --register-unsafely-without-email --webroot --webroot-path /var/www/128technology/ --agree-tos --quiet --post-hook "cat /etc/letsencrypt/live/$DOMAIN/{fullchain,privkey}.pem > /etc/128technology/pki/webserver.pem"EOF$ chmod +x /usr/local/sbin/renew-certificate.sh

Now you should be able to call that script from the shell:

$ /usr/local/sbin/renew-certificate.sh

It should confirm the certificate retrieval with "Congratulations". If not, double-check the conductor is reachable from the internet on port tcp/80.

Finally, install a cronjob that tries to renew the certificate every two months or so:

$ crontab -e42 23 1 */2 *	/usr/local/sbin/renew-certificate.sh

Done.

Hi Morne,

Basically, the certbot tool, a script to retrieve and update the webserver certificate and a firewall rule is what you need:

Firstly, install the certbot tool and update the firewall in order to open port 80:

$ dnf install -y certbot$ firewall-cmd --permanent --add-service=http --zone t128$ firewall-cmd --reload

Secondly, make sure your fqdn resolves publicly to the IP address of your conductor:

$ host conductor.example.com 8.8.8.8

Then create a script that binds altogether (replace "conductor.example.com" with your FQDN):

$ cat > /usr/local/sbin/renew-certificate.sh <<'EOF'#!/bin/shDOMAIN=conductor.example.comcertbot certonly -d $DOMAIN --register-unsafely-without-email --webroot --webroot-path /var/www/128technology/ --agree-tos --quiet --post-hook "cat /etc/letsencrypt/live/$DOMAIN/{fullchain,privkey}.pem > /etc/128technology/pki/webserver.pem"EOF$ chmod +x /usr/local/sbin/renew-certificate.sh

Now you should be able to call that script from the shell:

$ /usr/local/sbin/renew-certificate.sh

It should confirm the certificate retrieval with "Congratulations". If not, double-check the conductor is reachable from the internet on port tcp/80.

Finally, install a cronjob that tries to renew the certificate every two months or so:

$ crontab -e42 23 1 */2 *	/usr/local/sbin/renew-certificate.sh

Done.

Hi Morne,

The authorization is done by a challenge-response protocol. This is why port 80 is needed and the fqdn (A record) has to point to the conductor's public IP.

Of course, this works only for publicly reachable systems. For private systems and/or wildcard certificates Let's Encrypt offers dns validation which is more complex, since the certbot requires a way to dynamically place a TXT record into the company's dns server/database.

I hope this answers your question.

Mathias

Hi Morne,

Basically, the certbot tool, a script to retrieve and update the webserver certificate and a firewall rule is what you need:

Firstly, install the certbot tool and update the firewall in order to open port 80:

$ dnf install -y certbot$ firewall-cmd --permanent --add-service=http --zone t128$ firewall-cmd --reload

Secondly, make sure your fqdn resolves publicly to the IP address of your conductor:

$ host conductor.example.com 8.8.8.8

Then create a script that binds altogether (replace "conductor.example.com" with your FQDN):

$ cat > /usr/local/sbin/renew-certificate.sh <<'EOF'#!/bin/shDOMAIN=conductor.example.comcertbot certonly -d $DOMAIN --register-unsafely-without-email --webroot --webroot-path /var/www/128technology/ --agree-tos --quiet --post-hook "cat /etc/letsencrypt/live/$DOMAIN/{fullchain,privkey}.pem > /etc/128technology/pki/webserver.pem"EOF$ chmod +x /usr/local/sbin/renew-certificate.sh

Now you should be able to call that script from the shell:

$ /usr/local/sbin/renew-certificate.sh

It should confirm the certificate retrieval with "Congratulations". If not, double-check the conductor is reachable from the internet on port tcp/80.

Finally, install a cronjob that tries to renew the certificate every two months or so:

$ crontab -e42 23 1 */2 *	/usr/local/sbin/renew-certificate.sh

Done.