wiki-grav/pages/02.linux/acme-sh/default.en.md

121 lines
1.7 KiB
Markdown
Raw Normal View History

---
title: ACME.SH
visible: true
---
[toc]
2022-12-16 11:46:32 +01:00
## Getting ACME.SH
2022-12-16 11:46:32 +01:00
[shuser]
2022-12-16 11:46:32 +01:00
```sh
2023-02-19 15:15:17 +01:00
git clone https://github.com/acmesh-official/acme.sh.git
cd ./acme.sh
./acme.sh --install -m [EMAIL]
```
[/shuser]
## First time ZeroSSL registration
2022-12-16 11:46:32 +01:00
[shuser]
2023-02-19 15:15:17 +01:00
```sh
.acme.sh/acme.sh --register-account -m [EMAIL]
2023-02-19 15:15:17 +01:00
```
[/shuser]
## Issue new certificate
2022-12-16 11:46:32 +01:00
2023-02-19 15:15:17 +01:00
Needs root to start a server on port 80
[shroot]
2023-02-19 15:15:17 +01:00
```sh
.acme.sh/acme.sh --issue --standalone -d [DOMAIN]
2023-02-19 15:15:17 +01:00
```
[/shroot]
## Issue new certificate with DNS API
2022-12-16 11:46:32 +01:00
> [Official Documentation](https://github.com/acmesh-official/acme.sh/wiki/dnsapi)
### Gandi
[shuser]
2023-02-19 15:15:17 +01:00
```sh
export GANDI_LIVEDNS_KEY="[API KEY]"
2023-02-19 15:15:17 +01:00
```
2022-12-16 11:46:32 +01:00
[/shuser]
[shuser]
2023-02-19 15:15:17 +01:00
```sh
.acme.sh/acme.sh --issue --dns dns_gandi_livedns -d [DOMAIN]
2023-02-19 15:15:17 +01:00
```
[/shuser]
## Install certificate
2022-12-16 11:46:32 +01:00
Make sure to create the `/etc/acme-sh/(url)` directory
[shuser]
2022-12-16 11:46:32 +01:00
```sh
export url=[URL] \
2022-09-11 17:36:46 +02:00
&& mkdir -p /etc/acme-sh/{$url} \
&& .acme.sh/acme.sh --install-cert -d $url \
--key-file /etc/acme-sh/{$url}/key.pem \
--fullchain-file /etc/acme-sh/{$url}/cert.pem \
--reloadcmd "sudo systemctl restart nginx"
```
[/shuser]
## Systems Service & Timer
2022-12-16 11:46:32 +01:00
`/etc/systemd/system/acme-sh.service`
```systemd
[Unit]
Description=Renew certificates using acme.sh
After=network-online.target
[Service]
Type=oneshot
ExecStart=(path to acme.sh) --cron --home (path to acme folder)
User=wiki
SuccessExitStatus=0 2
```
2022-12-16 11:46:32 +01:00
`/etc/systemd/system/acme.timer`
```systemd
[Unit]
Description=Daily renewal of certificates
[Timer]
OnCalendar=daily
RandomizedDelaySec=1h
Persistent=true
[Install]
WantedBy=timers.target
```
2023-02-19 15:15:17 +01:00
Enable timer
[shroot]
2023-02-19 15:15:17 +01:00
```sh
systemctl enable --now acme-sh.timer
```
[/shroot]