certbot

What it does

How to write it

certbot [SUBCOMMAND] [OPTION]...
certbot certonly --webroot -w DIR -d DOMAIN

Main parts

Subcommands

run (default)

Get a certificate and install it.

certonly

Only get the certificate.

renew

Renew all certificates that expire soon.

certificates

List certificates and their expiry dates.

delete --cert-name NAME

Delete a certificate.

revoke --cert-path FILE

Revoke a certificate.

reconfigure

Change the renewal settings.

register / update_account / unregister

Manage the ACME account.

Most used

Nothing matches this filter.

$ run as a normal user# run as root (or with sudo)

1. 1Install on RHEL

   #dnf install -y epel-release
   #dnf install -y certbot python3-certbot-nginx

2. 2Get and install a certificate for nginx

   #certbot --nginx -d shop.example.com -d www.shop.example.com --email admin@example.com --agree-tos -n

3. 3Only get the certificate with the webroot method

   #certbot certonly --webroot -w /srv/www/shop -d shop.example.com

4. 4Get a wildcard certificate with a DNS challenge

   #certbot certonly --manual --preferred-challenges dns -d '*.example.com' -d example.com

5. 5Test on staging first

   #certbot certonly --staging --nginx -d test.example.com

6. 6List certificates and expiry dates

   #certbot certificates

7. 7Test and run the renewal

   #certbot renew --dry-run
   #systemctl list-timers | grep certbot
   #certbot renew --deploy-hook "systemctl reload nginx"

8. 8Use the files in a server config

   #cat /etc/nginx/conf.d/shop-tls.conf
   ssl_certificate     /etc/letsencrypt/live/shop.example.com/fullchain.pem;
   ssl_certificate_key /etc/letsencrypt/live/shop.example.com/privkey.pem;

9. 9Check the certificate from outside

   $echo | openssl s_client -connect shop.example.com:443 -servername shop.example.com 2>/dev/null | openssl x509 -noout -dates -issuer

10. 10Revoke and delete a certificate

    #certbot revoke --cert-name shop.example.com
    #certbot delete --cert-name shop.example.com

Nothing matches this filter.

Files

/etc/letsencrypt/live/DOMAIN/

Current certificate files (links).

/etc/letsencrypt/renewal/DOMAIN.conf

Renewal settings.

/var/log/letsencrypt/letsencrypt.log

Log.

Exit codes