Automating OpenSSL certificates creation, Let'sEncrypt signing, and site dir associating, in an Nginx environment

Question

I have an Ubuntu-server 16.04 VPS and Nginx. Now I'm implementing HTTP1 (without TLS, utilizing port 80) but I desire to go "one step forward" and work with HTTP2 (with TLS, utilizing port 443), for all my (Wordpress) websites.

Assuming I adjusted my environment, this way:

1. Firewall

ufw app list # Choose Nginx HTTPS

2. Server blocks

Default server block

server {
    listen 80 default_server;
    listen [::]:80 default_server;
    server_name server_domain_or_IP;
    return 302 https://$server_name$request_uri;
}

server {

    # SSL configuration

    listen 443 ssl http2 default_server;
    listen [::]:443 ssl http2 default_server;
    include snippets/self-signed.conf;
    include snippets/ssl-params.conf;
}

Each site server block

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    root /var/www/html/example.com;
    index index.php index.html index.htm index.nginx-debian.html;
    example.com www.example.com;

    location / {
        try_files $uri $uri/ =404;
    }

    location ~ \.php$ {
        include snippets/fastcgi-php.conf;
        fastcgi_pass unix:/run/php/php7.0-fpm.sock;
    }

    location ~ /\.ht {
        deny all;
    }
}

---

Now I need to create OpenSSL certificates, sign them with Let'sEncrypt, and associate them with each site dir, respectively.

My question:

How can the creation of OSSL certs, LE signage, and SDIR associating, be done as much automatic as possible from inside the terminal? Of course there is some part in which I need to verify a domain from my email, but beyond that, AFAIU, everything is done from the terminal, thus can be fully automated.

Can you share a Bash script code example (or a utilization of a particular utility, maybe GNU make), that helps achieving that?

Notes

1. I would humbly prefer a dockerless solution (I read here and bedsides the fact it has to do with renewling, it also seems to implement docker which I have no intention to do for a small private server of less than 10 small sites, by means of minimalism).

2. I understand that creating, signing, and site dir associating, requires a different algorithm than renewaling. I am asking only on creating, signing and associating.

Why I even ask this question:

Well, I just want to use HTTP2 on my self-managed, minimal VPS (no kernel/shell customization, no compilations, almost no contrib utilities), and it seems insane to me to manually implement this algorithm for many sites, or each time a new site is added.

Answer 1

It's easy to create and update Let's Encrypt cerificates with dehydrated (https://github.com/lukas2511/dehydrated).

You have to add /.well-known/acme-challenge/ location for each site as Let's Encrypt service will look on challenge responses under this location to verify that you are the owner of sites you have requested certificates for:

location /.well-known/acme-challenge/ { allow all; root /st/hosting/hamilton/htdocs; } 

And use same path in dehydrated config:

egrep -v "^#|^[[:space:]]*$" config                                          
WELLKNOWN="/st/hosting/hamilton/htdocs/.well-known/acme-challenge"
CONTACT_EMAIL=<you@email>

After that put all your domains in domain.txt file: on each line first domain will be CommonName and other names will be AlternativeNames, for example:

head -n1 domains.txt
hamilton.rinet.ru jenkins.hamilton.rinet.ru munin.hamilton.rinet.ru

After that you should put dehydrated -c in cron and use script like this one to install new generated certificates:

#!/bin/sh

CERTS_DIR=/usr/local/etc/dehydrated/certs
NGINX_SSL=/usr/local/etc/nginx/ssl
DOMAINS=$(awk '{ print $1 }' /usr/local/etc/dehydrated/domains.txt)

for d in $DOMAINS; do
  short_d=${d%%.rinet.ru}
  short_d=${short_d%%.ru}
  # short_d=${short_d##www.}
  cp -v ${CERTS_DIR}/$d/fullchain.pem ${NGINX_SSL}/${short_d}.crt
  cp -v ${CERTS_DIR}/$d/privkey.pem ${NGINX_SSL}/${short_d}.key
done

# Also update certs for Dovecot
cp -v ${CERTS_DIR}/hamilton.rinet.ru/fullchain.pem /usr/local/etc/dovecot/certs/certs/server.crt
cp -v ${CERTS_DIR}/hamilton.rinet.ru/privkey.pem /usr/local/etc/dovecot/certs/private/server.key

Answer 2

First off, I would check out some of the LetsEncrypt clients. Particularly, the ones listed for Nginx. I'd start there before reinventing the wheel since you originally wanted to use LE signed certificates.

If instead, you want to use OpenSSL to create self-signed certificates, you can loop through your list of domain names and execute openssl for each domain with a command similar to:

openssl req -x509 -newkey rsa:2048 -keyout examplekey.pem -out examplecert.pem -nodes -days 365 -set_serial NNNNN -subj "/C=US/L=Any City/OU=FooBar Inc/CN=*.example.com"

Of course for each domain you want to change examplekey.pem, examplecert.pem, and *.example.com. Replace NNNNN with a serial number, increment for each iteration of the loop.

You should be able to easily write a script that loops through the desired domain names and updates the various Nginx configuration files.

Answer 3

I'll add acmetool to the ring of let's encrypt clients here, it's dead simple once you get feed it the paths. acmetool want www.site1.org acmetool want www.site2.net etc. You do have to point the acme request to the right place with a location {} block in nginx... it handles the updates via cron if you like.

Answer 4

Use certbot --nginx -d your.domain.name should do the trick and certbot should automatically update your nginx config

Ok so after you have your Virtualhosts setup you can run for every of the domains where you will use ssl command certbot --nginx -d your.domain.name which will ask you few questions and generate the proper config file. Or you could just run certbot --nginx if you already have hostnames on nginx. It will include automatically configuration files for nginx the old will be saved as .old.

You can check this tutorial too: https://www.digitalocean.com/community/tutorials/how-to-secure-nginx-with-let-s-encrypt-on-ubuntu-16-04 Dont forget to add crontab with certbot --renew.