certbot

هذا الجزء لم يُترجم بعد. أنت ترى النص الإنجليزي.

ماذا يفعل

Certbot speaks the ACME protocol with Let's Encrypt: it proves you control a domain (an HTTP file or a DNS record), gets a certificate valid for 90 days, can install it into nginx or Apache, and renews it with a timer before it expires. On RHEL, install it from EPEL (certbot, python3-certbot-nginx, python3-certbot-apache).

Certificates live in /etc/letsencrypt/live/DOMAIN/ (fullchain.pem, privkey.pem).

طريقة الكتابة

certbot [SUBCOMMAND] [OPTION]...
certbot certonly --webroot -w DIR -d DOMAIN

الأجزاء الرئيسية

Subcommands

run (default): Get a certificate and install it.
certonly: Only get the certificate.
renew: Renew all certificates that expire soon.
certificates: List certificates and their expiry dates.
delete --cert-name NAME: Delete a certificate.
revoke --cert-path FILE: Revoke a certificate.
reconfigure: Change the renewal settings.
register / update_account / unregister: Manage the ACME account.

الخيارات 14

الأكثر استخدامًا

Main options

-d DOMAIN: A domain name (repeat for more names).
--nginx / --apache: Use the web-server plugin to prove and install.
--webroot -w DIR: Prove by writing a file into the web root.
--standalone: Start a small own web server on port 80.
--manual / --preferred-challenges dns: Prove with a DNS TXT record.
--dns-PLUGIN: Use a DNS provider plugin (cloudflare, route53, …).
--cert-name NAME: Name of the certificate lineage.
--email MAIL / --agree-tos / -n: Account email, accept terms, no questions.
--staging / --test-cert: Use the Let's Encrypt staging server.
--dry-run: Test renew or certonly without saving.
--key-type rsa|ecdsa / --rsa-key-size N: Key type and size.
--deploy-hook CMD: Command to run after a successful renewal.
--force-renewal: Renew now even if not due.
--expand: Add names to an existing certificate.

أمثلة 10

$ مستخدم عادي# بصلاحية root (أو مع sudo)

1Install on RHEL

#dnf install -y epel-release
#dnf install -y certbot python3-certbot-nginx

2Get and install a certificate for nginx

#certbot --nginx -d shop.example.com -d www.shop.example.com --email admin@example.com --agree-tos -n

3Only get the certificate with the webroot method

#certbot certonly --webroot -w /srv/www/shop -d shop.example.com

4Get a wildcard certificate with a DNS challenge

#certbot certonly --manual --preferred-challenges dns -d '*.example.com' -d example.com

5Test on staging first

#certbot certonly --staging --nginx -d test.example.com

6List certificates and expiry dates
```
#certbot certificates
```

7Test and run the renewal

#certbot renew --dry-run
#systemctl list-timers | grep certbot
#certbot renew --deploy-hook "systemctl reload nginx"

8Use the files in a server config

#cat /etc/nginx/conf.d/shop-tls.conf
ssl_certificate     /etc/letsencrypt/live/shop.example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/shop.example.com/privkey.pem;

9Check the certificate from outside

$echo | openssl s_client -connect shop.example.com:443 -servername shop.example.com 2>/dev/null | openssl x509 -noout -dates -issuer

10Revoke and delete a certificate

#certbot revoke --cert-name shop.example.com
#certbot delete --cert-name shop.example.com

انتبه

Let's Encrypt has rate limits; test with --staging.
Keep /etc/letsencrypt/ backed up and private: it contains the private keys.
The HTTP challenge needs port 80 open from the internet.

الملفات

/etc/letsencrypt/live/DOMAIN/: Current certificate files (links).
/etc/letsencrypt/renewal/DOMAIN.conf: Renewal settings.
/var/log/letsencrypt/letsencrypt.log: Log.

نصائح للحفظ

In Kubernetes use cert-manager instead; for Traefik/Caddy the proxy does ACME itself.

رموز الخروج

`0`	Success.
`1`	Error.

`certbot`

ماذا يفعل

طريقة الكتابة

الأجزاء الرئيسية

Subcommands

الخيارات 14

Main options

أمثلة 10

1Install on RHEL

2Get and install a certificate for nginx

3Only get the certificate with the webroot method

4Get a wildcard certificate with a DNS challenge

5Test on staging first

6List certificates and expiry dates

7Test and run the renewal

8Use the files in a server config

9Check the certificate from outside

10Revoke and delete a certificate

انتبه

الملفات

نصائح للحفظ

رموز الخروج

الدليل الكامل

ماذا يفعل

طريقة الكتابة

الأجزاء الرئيسية

Subcommands

الخيارات 14

Main options

أمثلة 10

1Install on RHEL

2Get and install a certificate for nginx

3Only get the certificate with the webroot method

4Get a wildcard certificate with a DNS challenge

5Test on staging first

6List certificates and expiry dates

7Test and run the renewal

8Use the files in a server config

9Check the certificate from outside

10Revoke and delete a certificate

انتبه

الملفات

نصائح للحفظ

رموز الخروج

أوامر مرتبطة

مُستخدم في هذه الدروس

الدليل الكامل

`certbot`