Mailing List ecs-isp@2rosenthals.com Archived Message #796

Fra: "Massimo S." <ecs-isp@2rosenthals.com> Full Headers
Undecoded message
Emne: Re: [eCS-ISP] Apache HTTPS
Dato: Tue, 23 Jul 2024 12:20:39 +0200
Til: eCS ISP Mailing List <ecs-isp@2rosenthals.com>

I use Paul's port of UACME, it can renew the www.yourwebsite.com (3rd level) cert and both the 2nd level yourwebsite.com at the same time too.


This is a simple reissue of just www.yourwebsite.. certificate.
I run uacme in a separate tree, not under the apache tree, i don't suggest
you to run it under \apache tree.
You need port 80 (HTTP) open on your webserver for this operation.
You need to create all these paths you can see down here.
You don't need Let's Encrypt chain certificates files, since uacme already by it's own
create a certificate with the chain certificate inside of the .cert, so
you have always the latest chain certificate from Let's Encrypt automatically.

I run the scripts scheduled once each 2 months (LE Certs only last 3 months),
so in case of issues i still have 1 month to fix them.
**don't forget** to add a Call SysSleep of about 10 seconds between a reissue
and another (if you runs tenths of renewals like me) or you can get problems,
i mean renewal that fails.
In your script after the renewal/s you can place the code to restart apache.



renewal (issue) script:

@attrib c:\mptn\etc\ssl\uacme\private\www.youwebsite.com\key.pem -R
@copy c:\mptn\etc\ssl\uacme\private\www.youwebsite.com\key_old.pem c:\mptn\etc\ssl\uacme\private\www.youwebsite.com\key_old2.pem
@copy c:\mptn\etc\ssl\uacme\private\www.youwebsite.com\key.pem c:\mptn\etc\ssl\uacme\private\www.youwebsite.com\key_old.pem
@del c:\mptn\etc\ssl\uacme\private\www.youwebsite.com\key.pem /N
@attrib c:\mptn\etc\ssl\uacme\www.youwebsite.com\cert.pem -R
@copy c:\mptn\etc\ssl\uacme\www.youwebsite.com\cert_old.pem c:\mptn\etc\ssl\uacme\www.youwebsite.com\cert_old2.pem
@copy c:\mptn\etc\ssl\uacme\www.youwebsite.com\cert.pem c:\mptn\etc\ssl\uacme\www.youwebsite.com\cert_old.pem @del c:\mptn\etc\ssl\uacme\www.youwebsite.com\cert.pem /N
uacme issue www.youwebsite.com -h hook_yourwebsite_com.cmd 2>>d:\services\uacme\re.log



hook script:

parse arg var1 var2 var3 var4 var5
myfile = 'X:\apache\htdocs\yourwebsite\.well-known\acme-challenge\'||var4
call SysFileDelete 'X:\apache\htdocs\yourwebsite\.well-known\acme-challenge\'||var4
rc= LINEOUT(myfile,var5)



i'm keeping 2 bkup of private keys + certs (you can see all those copies)
hope it's all explained well

massimo


Il 22/07/2024 15:33, Dan Napier ha scritto:
Has anyone installed let’s Encrypt Certbot on OS2 .  What did you use ?

HTTPS is needed.  Or how are you installing the certs?

Dan Napier, MS, CIH

DNA Industrial Hygiene

2520 Artesia Boulevard

Redondo Beach, CA 90278-3210

310-644-1924 X 103

CSLB #773462

DNA Industrial Hygiene 800-644-1924


Abboner: Feed, Digest, Index.
Stopp abbonement
E-post til ListMaster