9.4

Edit

Letsencrypt public trusted certificates example

Generate wildcard certificates

Install letsencrypt client and generate letsencrypt wildcard certificates, using your dns-provider plugin. In this example used dns-aws plugin.

wget -O - https://get.acme.sh | sh
export AWS_ACCESS_KEY_ID=your_aws_access_key_here
export AWS_SECRET_ACCESS_KEY=your_aws_secret_key_here
~/.acme.sh/acme.sh --issue --dns dns_aws -d domain-name.com -d *.domain-name.com
ls ~/.acme.sh/domain-name.com/

As a result, you get the following files:

  • ca.cer: Let's Encrypt Authority X3 (IdenTrust cross-signed)
  • domain.cer: Server certificate
  • domain.key: Server certificate key
  • fullchain.cer: ca.cer + domain.cer

Add root certificate into ca.cer

The full chain is described on the letsencrypt page.

The Letsencrypt authority certificate (ca.cer) is signed with "IdenTrust DST Root CA X3", so you need to add root certificate into your chain:

  1. Copy it from https://www.identrust.com/certificates/trustid/root-download-x3.html.

    Copy and paste the following DST Root certificate into a text file on your computer (root-download-x3.txt).

  2. Copy the content of the downloaded certificate to the bottom of ca.cer.

    echo "-----BEGIN CERTIFICATE-----" >> ./ca.cer
cat ./root-download-x3.txt >> ./ca.cer
echo "-----END CERTIFICATE-----" >> ./ca.cer

Copy certificates to installation folder

cp ./ca.cer ../certificates/CA.cert

cp ./fullchain.cer ../certificates/db.crt
cp ./domain.key ../certificates/db.key

cp ./fullchain.cer ../certificates/app.crt
cp ./domain.key ../certificates/app.key

cp ./fullchain.cer ../certificates/apm.crt
cp ./domain.key ../certificates/apm.key

cp ./fullchain.cer ../certificates/vds-master.crt
cp ./domain.key ../certificates/vds-master.key

cp ./fullchain.cer ../certificates/vds-slave.crt
cp ./domain.key ../certificates/vds-slave.key

You can also change certificates names in the secret.yml file in the NGINX CERTIFICATES section.

← PreviousNext →