9.3

Edit

Letsencrypt public trusted certificates example

Generate wildcard certificates

Install the Letsencrypt client and generate Letsencrypt wildcard certificates using your dns-provider plugin. In this example, the dns-aws plugin is used.

wget -O - https://get.acme.sh | sh
export AWS_ACCESS_KEY_ID=your_aws_access_key_here
export AWS_SECRET_ACCESS_KEY=your_aws_secret_key_here
~/.acme.sh/acme.sh --issue --dns dns_aws -d domain-name.com -d *.domain-name.com
ls ~/.acme.sh/domain-name.com/

As a result, we get the following files:

  • ca.cer: Let's Encrypt Authority X3 (IdenTrust cross-signed)
  • domain.cer: server certificate
  • domain.key: server certificate key
  • fullchain.cer = ca.cer + domain.cer

Add root certificate into ca.cer

The full chain is described on the Letsencrypt page.

The Letsencrypt authority certificate (ca.cer) signed with IdenTrust DST Root CA X3, so we need to add a root certificate into the chain:

  1. Copy it from here.

  2. Copy and paste the following DST Root certificate into a text file on your computer (root-download-x3.txt).

  3. Copy the content of the downloaded certificate to the bottom of our ca.cer.

     echo "-----BEGIN CERTIFICATE-----" >> ./ca.cer
 cat ./root-download-x3.txt >> ./ca.cer
 echo "-----END CERTIFICATE-----" >> ./ca.cer

Copy certificates to installation folder

cp ./ca.cer ../certificates/CA.cert

cp ./fullchain.cer ../certificates/db.crt
cp ./domain.key ../certificates/db.key

cp ./fullchain.cer ../certificates/app.crt
cp ./domain.key ../certificates/app.key

cp ./fullchain.cer ../certificates/apm.crt
cp ./domain.key ../certificates/apm.key

cp ./fullchain.cer ../certificates/vds-master.crt
cp ./domain.key ../certificates/vds-master.key

cp ./fullchain.cer ../certificates/vds-slave.crt
cp ./domain.key ../certificates/vds-slave.key

Alternatively, change certificates names in the secret.yml file in the NGINX CERTIFICATES section.

← PreviousNext →