9.0

Edit

Letsencrypt public trusted certificates example

Generate wildcard certificates

Install letsencrypt client and generate letsencrypt wildcard certificates, using your dns-provider plugin. In this example, the dns-aws plugin is used.

wget -O - https://get.acme.sh | sh
export AWS_ACCESS_KEY_ID=your_aws_access_key_here
export AWS_SECRET_ACCESS_KEY=your_aws_secret_key_here
~/.acme.sh/acme.sh --issue --dns dns_aws -d domain-name.com -d *.domain-name.com
ls ~/.acme.sh/domain-name.com/

As a result, you get the following files:

  • ca.cer: Let’s Encrypt Authority X3 (IdenTrust cross-signed)
  • domain.cer: Server certificate
  • domain.key: Server certificate key
  • fullchain.cer: ca.cer + domain.cer

Add root certificate to ca.cer

Full chain described on the Let's Encrypt page.

Letsencrypt authority certificate (ca.cer) is signed with "IdenTrust DST Root CA X3". Add a root certificate into our chain:

  1. Copy it from https://www.identrust.com/certificates/trustid/root-download-x3.html.

    Copy and paste the following DST Root certificate into a text file on your computer: root-download-x3.txt

  2. Copy the content of the downloaded certificate to the bottom of our ca.cer:

    echo "-----BEGIN CERTIFICATE-----" >> ./ca.cer
cat ./root-download-x3.txt >> ./ca.cer
echo "-----END CERTIFICATE-----" >> ./ca.cer

Copy certificates to installation folder

cp ./ca.cer ../certificates/CA.cert

cp ./fullchain.cer ../certificates/db.crt
cp ./domain.key ../certificates/db.key

cp ./fullchain.cer ../certificates/app.crt
cp ./domain.key ../certificates/app.key

cp ./fullchain.cer ../certificates/apm.crt
cp ./domain.key ../certificates/apm.key

cp ./fullchain.cer ../certificates/vds-master.crt
cp ./domain.key ../certificates/vds-master.key

cp ./fullchain.cer ../certificates/vds-slave.crt
cp ./domain.key ../certificates/vds-slave.key

You can also change certificate names in the secret.yml file in the NGINX CERTIFICATES sections.

← PreviousNext →