Code Trips & Tips

There is a wealth of documentation about how to generated a Certificate using
letsencrypt, the EFF free tool.

However, if you are using g-suite to manage your main website or want an SSL certificate to do some testing during development, and may not have shell access to the WWW server (and, further, you are unable to deploy the challenge file in the given location) things get a bit tricky.

See the EFF Certbot documentation if you do have shell or file access to your WWW server.

In the following I will outline the steps I followed to use the --manaual mode, with DNS verification.

Manual install of Certbot on Ubuntu

The version of letsencrypt that is packaged for Ubuntu 16.04 does not support DNS challenge using the manual plugin, so you will need to download and install certbot manually (which, I guess, is only appropriate):

cd ~/certbot
wget https://dl.eff.org/certbot-auto
chmod a+x certbot-auto
./certbot-auto

Setup a TXT DNS record

See this page for a clear explanation of the major types of DNS records.

The DNS records for alertavert.com can be configured on the
DNS Panel

YMMV here, but ultimately it requires being able to get on your domain registrar DNS management panel and set up a TXT record.

Run certbot in --manual mode

This is the command to run (replace alertavert.com with your domain name), you can chain several domains using the -d options several times:

$ ./certbot-auto certonly --manual --preferred-challenges dns -d alertavert.com

this will ask for the appropriate TXT record for each of the domains you specify:

Requesting root privileges to run certbot...
  /home/marco/.local/share/letsencrypt/bin/letsencrypt certonly --manual --preferred-challenges dns -d alertavert.com
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Obtaining a new certificate
Performing the following challenges:
dns-01 challenge for alertavert.com

-------------------------------------------------------------------------------
NOTE: The IP of this machine will be publicly logged as having requested this
certificate. If you're running certbot in manual mode on a machine that is not
your server, please ensure you're okay with that.

Are you OK with your IP being logged?
-------------------------------------------------------------------------------
(Y)es/(N)o: y

-------------------------------------------------------------------------------
Please deploy a DNS TXT record under the name
_acme-challenge.alertavert.com with the following value:

  <<< random value >>>

Once this is deployed,
-------------------------------------------------------------------------------
Press Enter to Continue
Waiting for verification...
Cleaning up challenges
Generating key (2048 bits): /etc/letsencrypt/keys/0000_key-certbot.pem
Creating CSR: /etc/letsencrypt/csr/0000_csr-certbot.pem

IMPORTANT NOTES:
 - Congratulations! Your certificate and chain have been saved at
   /etc/letsencrypt/live/alertavert.com/fullchain.pem. Your cert will
   expire on 2017-05-21. To obtain a new or tweaked version of this
   certificate in the future, simply run certbot-auto again. To
   non-interactively renew *all* of your certificates, run
   "certbot-auto renew"
 - If you like Certbot, please consider supporting our work by:

   Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
   Donating to EFF:                    https://eff.org/donate-le

Where is my certificate?

As the blurb above indicates, the certificate(s) are in the live/ folder under /etc/letsencrypt:

$ sudo find /etc/letsencrypt/

will yield, among (many) other things:

...
/etc/letsencrypt/live
/etc/letsencrypt/live/alertavert.com
/etc/letsencrypt/live/alertavert.com/privkey.pem
/etc/letsencrypt/live/alertavert.com/README
/etc/letsencrypt/live/alertavert.com/fullchain.pem
/etc/letsencrypt/live/alertavert.com/chain.pem
/etc/letsencrypt/live/alertavert.com/cert.pem
...

Profit!