9.2

Edit

Letsencrypt Public Trusted Certificates example

Generate wildcard certificates

Install letsencrypt client and generate letsencrypt wildcard certificates, using your dns-provider plugin. In this example used dns-aws plugin.

wget -O - https://get.acme.sh | sh
export AWS_ACCESS_KEY_ID=your_aws_access_key_here
export AWS_SECRET_ACCESS_KEY=your_aws_secret_key_here
~/.acme.sh/acme.sh --issue --dns dns_aws -d domain-name.com -d *.domain-name.com
ls ~/.acme.sh/domain-name.com/

As a result we get files:

ca.cer - Let’s Encrypt Authority X3 (IdenTrust cross-signed)
domain.cer - Server certificate
domain.key - Server certificate key
fullchain.cer = ca.cer + domain.cer

Add root certificate into ca.cer

Full chain described on letsencrypt page: https://letsencrypt.org/certificates/

Letsencrypt authority certificate (ca.cer) signed with "IdenTrust DST Root CA X3", so we need to add root certificate into our chain:

  1. Copy it from https://www.identrust.com/certificates/trustid/root-download-x3.html.

    Copy and paste the root-download-x3.txt DST Root certificate into a text file on your computer.

  2. Copy content of downloaded certificate to the bottom of our ca.cer.

    echo "-----BEGIN CERTIFICATE-----" >> ./ca.cer
cat ./root-download-x3.txt >> ./ca.cer
echo "-----END CERTIFICATE-----" >> ./ca.cer

Copy certificates to installation folder

cp ./ca.cer ../certificates/CA.cert

cp ./fullchain.cer ../certificates/db.crt
cp ./domain.key ../certificates/db.key

cp ./fullchain.cer ../certificates/app.crt
cp ./domain.key ../certificates/app.key

cp ./fullchain.cer ../certificates/apm.crt
cp ./domain.key ../certificates/apm.key

cp ./fullchain.cer ../certificates/vds-master.crt
cp ./domain.key ../certificates/vds-master.key

cp ./fullchain.cer ../certificates/vds-slave.crt
cp ./domain.key ../certificates/vds-slave.key

Or change certificates names in secret.yml file in section "NGINX CERTIFICATES".

← PreviousNext →