Difference between revisions of "Letsencrypt/openssl"
(→Let's Encrypt) |
(→Date Expiration) |
||
| (5 intermediate revisions by 2 users not shown) | |||
| Line 36: | Line 36: | ||
<pre> | <pre> | ||
| − | $ openssl x509 -text -in <(openssl s_client -connect | + | $ export CN='hackerspace.gr'; |
| + | $ openssl x509 -text -in <(openssl s_client -connect ${CN}:443) | grep -E 'Not Before|Not After' | ||
Not Before: Jun 12 17:55:50 2015 GMT | Not Before: Jun 12 17:55:50 2015 GMT | ||
| Line 130: | Line 131: | ||
</pre> | </pre> | ||
| − | ===== CentOS 6 ==== | + | ===== an example ===== |
| + | |||
| + | |||
| + | <pre> | ||
| + | |||
| + | # yum -y install letsencrypt | ||
| + | # letsencrypt certonly \ | ||
| + | -t --agree-tos \ | ||
| + | -d librebit.net \ | ||
| + | --email testuser@librebit.net \ | ||
| + | --webroot -w /var/www/html / | ||
| + | --dry-run | ||
| + | |||
| + | remove “--dry-run” to activate your Certs | ||
| + | |||
| + | </pre> | ||
| + | |||
| + | |||
| + | <pre> | ||
| + | |||
| + | ls -l /etc/letsencrypt/live/librebit.net | ||
| + | total 0 | ||
| + | lrwxrwxrwx 1 root root 36 May 28 06:57 cert.pem -> ../../archive/librebit.net/cert1.pem | ||
| + | lrwxrwxrwx 1 root root 37 May 28 06:57 chain.pem -> ../../archive/librebit.net/chain1.pem | ||
| + | lrwxrwxrwx 1 root root 41 May 28 06:57 fullchain.pem -> ../../archive/librebit.net/fullchain1.pem | ||
| + | lrwxrwxrwx 1 root root 39 May 28 06:57 privkey.pem -> ../../archive/librebit.net/privkey1.pem | ||
| + | |||
| + | </pre> | ||
| + | |||
| + | ==== CentOS 6 ==== | ||
Σε CentOS 6 έχει by default python 2.6 | Σε CentOS 6 έχει by default python 2.6 | ||
| Line 150: | Line 180: | ||
Υπενθυμίζω πως τίποτα από όλα αυτά δεν χρειάζονται, εάν η διανομή σας | Υπενθυμίζω πως τίποτα από όλα αυτά δεν χρειάζονται, εάν η διανομή σας | ||
| + | |||
| + | |||
| + | === Renew === | ||
| + | |||
| + | ==== Lets Encrypt Client: certbot on Centos 6.8 ==== | ||
| + | |||
| + | Let’s Encrypt client: '''certbot''' is been written in python and as it’s predecessor needs at least Python 2.7. | ||
| + | |||
| + | But (still) in CentOS series 6 (currently 6.8) there is no natively support for python27. | ||
| + | |||
| + | So I did this thing below, quick & dirty: | ||
| + | |||
| + | |||
| + | <pre> | ||
| + | |||
| + | # cd /usr/local/src/ | ||
| + | # wget -c https://www.python.org/ftp/python/2.7.11/Python-2.7.11.tgz | ||
| + | # tar xf Python-2.7.11.tgz | ||
| + | # cd Python-2.7.11 | ||
| + | # ./configure | ||
| + | # make | ||
| + | # make install | ||
| + | |||
| + | </pre> | ||
| + | |||
| + | |||
| + | and these are my notes for renew certificates : | ||
| + | |||
| + | <pre> | ||
| + | |||
| + | # ln -s /opt/Python-2.7/bin/python2.7 /usr/local/bin/python2 | ||
| + | |||
| + | [root@1 certbot]# source venv/bin/activate | ||
| + | (venv)[root@1 certbot]# | ||
| + | |||
| + | # cd venv/bin/ | ||
| + | |||
| + | # ./certbot renew --dry-run | ||
| + | |||
| + | # ./certbot renew | ||
| + | |||
| + | # rm /usr/local/bin/python2 | ||
| + | |||
| + | </pre> | ||
| + | |||
| + | [[Category:Documentation]] | ||
Latest revision as of 09:52, 2 November 2017
Contents
Useful Commands
OpenSSL
notes based on CentOS 6.7
Τα πιστοποιητικά (certificates) ονομάζονται x509
View a x509
Πως μπορούμε να δούμε το πιστοποιητικό ενός site
$ openssl s_client -connect hackerspace.gr:443 </dev/null
Το πιστοποιητικό είναι μεταξύ του
-----BEGIN CERTIFICATE----- ... -----END CERTIFICATE-----
Text Output
Μπορούμε να μετατρέψουμε το πιστοποιητικό σε text output για να πάρουμε περισσότερες πληροφορίες, όπως πότε λήγει:
$ openssl x509 -text -in <(openssl s_client -connect hackerspace.gr:443)
Date Expiration
$ export CN='hackerspace.gr';
$ openssl x509 -text -in <(openssl s_client -connect ${CN}:443) | grep -E 'Not Before|Not After'
Not Before: Jun 12 17:55:50 2015 GMT
Not After : Jun 13 05:21:51 2017 GMT
Chain
Πως μπορούμε να δούμε, ποιος έχει εκδόσει το πιστοποιητικό και ποιοι οργανισμοί έχουν υπογράψει
$ openssl s_client -connect hackerspace.gr:443 </dev/null | grep ^depth depth=2 C = IL, O = StartCom Ltd., OU = Secure Digital Certificate Signing, CN = StartCom Certification Authority depth=1 C = IL, O = StartCom Ltd., OU = Secure Digital Certificate Signing, CN = StartCom Class 2 Primary Intermediate Server CA depth=0 C = GR, ST = Attica, L = Filadelfeia, O = Pierros Papadeas, CN = *.hackerspace.gr, emailAddress = postmaster@hackerspace.gr DONE Το depth=0 είναι το πιστοποιητικό μας, το depth=1 είναι ο intermediate το depth=2 είναι o root Certificate Authority
intermediates
Πως βλέπουμε όλα τα πιστοποιητικά από ένα site (δλδ το δικό του και των intermediates):
$ openssl s_client -showcerts -connect hackerspace.gr:443 </dev/null
save them all to a file:
$ openssl s_client -showcerts -connect hackerspace.gr:443 </dev/null | sed -n '/BEGIN/,/END/p' > /tmp/certs
save the first certificate (site certificate) to a file:
$ openssl s_client -showcerts -connect hackerspace.gr:443 </dev/null | sed -n '/BEGIN/,/END/p;/END/q' > /tmp/hackerspace.crt
verify it:
$ openssl x509 -text -in /tmp/hackerspace.crt
verify chain
$ openssl verify -CAfile <(cat /etc/pki/tls/certs/ca-bundle.crt /tmp/certs ) /tmp/hackerspace.crt /tmp/hackerspace.crt: OK
Let's Encrypt
Διευκρίνηση
Το letsencrypt είναι πρόγραμμα -client- που αυτόματα εκδίδει πιστοποιητικά ασφαλείας (x509 certificates) με έναν εντελώς αυτόματο τρόπο υλοποιώντας το πρωτόκολλο Automated Certificate Management Environment (ACME). To ACME είναι ένας τρόπος αυθεντικοποίησης ενός domain με ένα web server.
O client του Let's Encrypt θέλει python 2.7
κι όπως είπαμε η διαδικασία έκδοσης πιστοποιητικών γίνεται εντελώς αυτόματα.
Installation
CentOS 7
# cat /etc/redhat-release CentOS Linux release 7.2.1511 (Core)
# yum -y install letsencrypt
an example
# yum -y install letsencrypt # letsencrypt certonly \ -t --agree-tos \ -d librebit.net \ --email testuser@librebit.net \ --webroot -w /var/www/html / --dry-run remove “--dry-run” to activate your Certs
ls -l /etc/letsencrypt/live/librebit.net total 0 lrwxrwxrwx 1 root root 36 May 28 06:57 cert.pem -> ../../archive/librebit.net/cert1.pem lrwxrwxrwx 1 root root 37 May 28 06:57 chain.pem -> ../../archive/librebit.net/chain1.pem lrwxrwxrwx 1 root root 41 May 28 06:57 fullchain.pem -> ../../archive/librebit.net/fullchain1.pem lrwxrwxrwx 1 root root 39 May 28 06:57 privkey.pem -> ../../archive/librebit.net/privkey1.pem
CentOS 6
Σε CentOS 6 έχει by default python 2.6
Οπότε ο προτεινόμενος τρόπος είναι ο παρακάτω:
# git clone https://github.com/letsencrypt/letsencrypt # cd letsencrypt
Θα χρειαστεί να "στήσουμε" το περιβάλλον:
# ./letsencrypt-auto-source/letsencrypt-auto --os-packages-only
ώστε να εγκατασταθούν όλα τα προγράμματα που χρειάζεται ο client.
Υπενθυμίζω πως τίποτα από όλα αυτά δεν χρειάζονται, εάν η διανομή σας
Renew
Lets Encrypt Client: certbot on Centos 6.8
Let’s Encrypt client: certbot is been written in python and as it’s predecessor needs at least Python 2.7.
But (still) in CentOS series 6 (currently 6.8) there is no natively support for python27.
So I did this thing below, quick & dirty:
# cd /usr/local/src/ # wget -c https://www.python.org/ftp/python/2.7.11/Python-2.7.11.tgz # tar xf Python-2.7.11.tgz # cd Python-2.7.11 # ./configure # make # make install
and these are my notes for renew certificates :
# ln -s /opt/Python-2.7/bin/python2.7 /usr/local/bin/python2 [root@1 certbot]# source venv/bin/activate (venv)[root@1 certbot]# # cd venv/bin/ # ./certbot renew --dry-run # ./certbot renew # rm /usr/local/bin/python2
