This was done on Centos 6 where prebuilt ‘certbot’ packages are not available. On Centos 7, install ‘certbot’ from the EPEL repo.<\/p>\n
cd ~root;
\nmkdir certbot;
\nwget https:\/\/dl.eff.org\/certbot-auto;
\nchmod 755 certbot-auto;
\n.\/certbot-auto;<\/p><\/blockquote>\nThis installs packages, including gcc, which you may want to uninstall as it’s bad practice to have compilers on a external facing (public) Web server.<\/p>\n
On my server I have a different configuration file for each server we’re proxying for. These are in\u00a0\/etc\/nginx\/conf.d\/ and using a naming convention of:<\/p>\n
domainname.domain.conf<\/p><\/blockquote>\n
For example, example.com would be:<\/p>\n
example.com.conf<\/p><\/blockquote>\n
Edit your config file and add this after\u00a0location \/<\/span> { … } :<\/span><\/p>\n
location \/.well-known {
\nalias \/tmp\/static\/.well-known;
\n}<\/p><\/blockquote>\nThen:<\/p>\n
mkdir \/tmp\/static\/;<\/p><\/blockquote>\n
Run certbot:<\/p>\n
.\/certbot-auto certonly<\/p><\/blockquote>\n
Selection option 2, enter your domain, then enter 1. then enter the path to the webroot as ‘\/tmp\/static\/’.<\/p>\n
How would you like to authenticate with the ACME CA?<\/p>\n
——————————————————————————-<\/p>\n
1: Spin up a temporary webserver (standalone)<\/p>\n
2: Place files in webroot directory (webroot)<\/p>\n
——————————————————————————-<\/p>\n
Select the appropriate number [1-2] then [enter] (press ‘c’ to cancel): 2<\/p>\n
Please enter in your domain name(s) (comma and\/or space separated) (Enter ‘c’<\/p>\n
to cancel):example.com<\/p>\n
Obtaining a new certificate<\/p>\n
Performing the following challenges:<\/p>\n
http-01 challenge forexample.com<\/p>\n
Select the webroot for example.com:<\/p>\n
——————————————————————————-<\/p>\n
1: Enter a new webroot<\/p>\n
——————————————————————————-<\/p>\n
Press 1 [enter] to confirm the selection (press ‘c’ to cancel): \/tmp\/static\/<\/p>\n
** Invalid input **<\/p>\n
Press 1 [enter] to confirm the selection (press ‘c’ to cancel): 1<\/p>\n
Input the webroot for biogrids.org: (Enter ‘c’ to cancel):\/tmp\/static\/<\/p>\n
Waiting for verification…<\/p>\n
Cleaning up challenges<\/p>\n
IMPORTANT NOTES:<\/p>\n
– Congratulations! Your certificate and chain have been saved at<\/p>\n
\/etc\/letsencrypt\/live\/biogrids.org\/fullchain.pem. Your cert will<\/p>\n
expire on 2017-08-03. To obtain a new or tweaked version of this<\/p>\n
certificate in the future, simply run certbot-auto again. To<\/p>\n
non-interactively renew *all* of your certificates, run<\/p>\n
“certbot-auto renew”<\/p>\n
– If you like Certbot, please consider supporting our work by:<\/p>\n
Donating to ISRG \/ Let’s Encrypt: https:\/\/letsencrypt.org\/donate<\/p>\n
Donating to EFF: https:\/\/eff.org\/donate-le<\/p><\/blockquote>\n
Then edit your site’s NGinx config to point to the certs, replace example.com with your domain:<\/p>\n
# using letsencrypt cert:
\nssl_certificate \/etc\/letsencrypt\/live\/example.com\/fullchain.pem;
\nssl_certificate_key \/etc\/letsencrypt\/live\/example.com\/privkey.pem;<\/p><\/blockquote>\nReload Nginx’s configure:<\/p>\n
service nginx reload<\/p><\/blockquote>\n
Or on systemd systems:<\/p>\n
\nsystemctl\u00a0 <\/span>reload nginx.service <\/span><\/p>\n<\/blockquote>\n
<\/p>\n","protected":false},"excerpt":{"rendered":"
This was done on Centos 6 where prebuilt ‘certbot’ packages are not available. On Centos 7, install ‘certbot’ from the EPEL repo. cd ~root; mkdir certbot; wget https:\/\/dl.eff.org\/certbot-auto; chmod 755 certbot-auto; .\/certbot-auto; This installs packages, including gcc, which you may want to uninstall as it’s bad practice to have compilers on a external facing (public) … Continue reading Let’s Encrypt Cert & Nginx (Using a Web Proxy) on Centos 6.x<\/span>