Many hyperlinks are disabled.
Use anonymous login
to enable hyperlinks.
Overview
| Comment: | The abbreviated certbot command didn't work here on my first Let's Encrypt renewal after writing the tls-nginx.md document, so changed that advice to use the full-strength form. |
|---|---|
| Timelines: | family | ancestors | descendants | both | trunk |
| Files: | files | file ages | folders |
| SHA3-256: |
dadd1342197a5794f69cac6498998601 |
| User & Date: | wyoung 2019-04-02 03:26:19.976 |
Context
|
2019-04-03
| ||
| 18:33 | Update the built-in SQLite to the latest 3.28.0 alpha version. check-in: 41974e0881 user: drh tags: trunk | |
|
2019-04-02
| ||
| 03:26 | The abbreviated certbot command didn't work here on my first Let's Encrypt renewal after writing the tls-nginx.md document, so changed that advice to use the full-strength form. check-in: dadd134219 user: wyoung tags: trunk | |
|
2019-04-01
| ||
| 00:43 | Clean up the detection of BIO_ADDR_hostname_string by removing redundant definitions; apparently autosetup has a feature which automatically creates a define with HAVE_ prepended for whatever function is intended to be detected. check-in: 3d82794348 user: andybradford tags: trunk | |
Changes
Changes to www/tls-nginx.md.
| ︙ | ︙ | |||
561 562 563 564 565 566 567 | sufficiently capable and motivated attacker unless you’ve also gone ahead and [enabled HSTS](#hsts). You can put off the need to enable HSTS by explicitly using HTTPS URIs. ## Step 7: Renewing Automatically | | > | | > > > > > | | 561 562 563 564 565 566 567 568 569 570 571 572 573 574 575 576 577 578 579 580 581 582 583 584 585 586 587 |
sufficiently capable and motivated attacker unless you’ve also gone
ahead and [enabled HSTS](#hsts). You can put off the need to enable
HSTS by explicitly using HTTPS URIs.
## Step 7: Renewing Automatically
Now that the configuration is solid, you can renew the LE cert with the
`certbot` command from above without the `--dry-run` flag plus a restart
of nginx:
sudo certbot certonly --webroot \
--webroot-path /var/www/example.com \
-d example.com -d www.example.com \
-d example.net -d www.example.net \
--webroot-path /var/www/foo.net \
-d foo.net -d www.foo.net
sudo systemctl restart nginx
I put those commands in a script in the `PATH`, then arrange to call that
periodically. Let’s Encrypt doesn’t let you renew the certificate very
often unless forced, and when forced there’s a maximum renewal counter.
Nevertheless, some people recommend running this daily and just letting
it fail until the server lets you renew. Others arrange to run it no
more often than it’s known to work without complaint. Suit yourself.
|
| ︙ | ︙ |