Triaxx Web Log

Let's Encrypt

Obtain or renew a certificate, but do not install it:

email=triaxx@triaxx.io
domains="triaxx_io triaxx_net"
triaxx_io_subdomains="dev mx ns0 ns1 www"
triaxx_net_subdomains="dns mail ns www"

for _domain in ${domains} ; do 
  eval subdomains=\$${_domain}_subdomains
  domain=`echo ${_domain} | sed -e 's,_,\.,g'`
  domain_args="--domain ${domain}"
  for _subdomain in ${subdomains} ; do
    domain_args="${domain_args} --domain ${_subdomain}.${domain}"
  done
  certbot certonly    \
    --non-interactive \
    --agree-tos       \
    --email ${email}  \
    --nginx           \
    ${domain_args}    \
    --expand
done

Plan the automatic (monthly) update:

crontab -e
0  0  1  *  *  /usr/bin/certbot renew

Restart NGINX when new certificate is deployed:

cat > /etc/letsencrypt/renewal-hooks/deplay << EOF
#!/usr/bin/env bash

/usr/bin/rc-service nginx reload
EOF