Let's Encrypt
Obtain or renew a certificate, but do not install it:
email=triaxx@triaxx.io
domains="triaxx_io triaxx_net"
triaxx_io_subdomains="dev mx ns0 ns1 www"
triaxx_net_subdomains="dns mail ns www"
for _domain in ${domains} ; do
eval subdomains=\$${_domain}_subdomains
domain=`echo ${_domain} | sed -e 's,_,\.,g'`
domain_args="--domain ${domain}"
for _subdomain in ${subdomains} ; do
domain_args="${domain_args} --domain ${_subdomain}.${domain}"
done
certbot certonly \
--non-interactive \
--agree-tos \
--email ${email} \
--nginx \
${domain_args} \
--expand
done
Plan the automatic (monthly) update:
crontab -e
0 0 1 * * /usr/bin/certbot renew
Restart NGINX when new certificate is deployed:
cat > /etc/letsencrypt/renewal-hooks/deplay << EOF
#!/usr/bin/env bash
/usr/bin/rc-service nginx reload
EOF