Letsencrypt Wildcard SSL Cert - Revision history

Wikisailor: /* Lychee Installation */

2026-02-02T04:23:41Z

Lychee Installation

← Older revision		Revision as of 04:23, 2 February 2026
Line 62:		Line 62:
	==== Lychee Installation====		==== Lychee Installation====

	''' Update ''' Lychee has been destroyed in favour of a new Linux desktop		''' Update ''' '''[[Lychee]]''' has been destroyed in favour of a new Linux desktop

	We need to be logged in to Lychee for this part		We need to be logged in to Lychee for this part

Wikisailor: /* Introduction */

2026-02-02T04:23:03Z

Introduction

← Older revision		Revision as of 04:23, 2 February 2026
Line 3:		Line 3:
	The time has come when we need to have SSL certs that can be used independently of Cloudflare. Cloudflare's proxy for webservers does work well but on the free tier they only listen to 443 and anything else will be rejected and return an invalid response. For some services like VPN (either OpenVPN or Wireguard) it does not matter as they will do their own encryption. However, services like Jellyfin use alternate ports for both http and https traffic so cannot be proxied by Cloudflare, to date it has not really mattered because streaming to remote locations is not really required too much and if it is we can use a VPN link if privacy is an issue. It would be nice to do Jellyfin over https but not really required.		The time has come when we need to have SSL certs that can be used independently of Cloudflare. Cloudflare's proxy for webservers does work well but on the free tier they only listen to 443 and anything else will be rejected and return an invalid response. For some services like VPN (either OpenVPN or Wireguard) it does not matter as they will do their own encryption. However, services like Jellyfin use alternate ports for both http and https traffic so cannot be proxied by Cloudflare, to date it has not really mattered because streaming to remote locations is not really required too much and if it is we can use a VPN link if privacy is an issue. It would be nice to do Jellyfin over https but not really required.
	Enter N8N, it also works on non standard ports and does have a SSL engine that should work with Cloudflare but it does not appear to be as easy to setup as first thought and any outside access will certainly need to be secured.		Enter N8N, it also works on non standard ports and does have a SSL engine that should work with Cloudflare but it does not appear to be as easy to setup as first thought and any outside access will certainly need to be secured.
			''' Update''' '''[[Lychee]]''' has been destroyed to make way for a new Linux desktop

	== Certbot Management Cheat Sheet==		== Certbot Management Cheat Sheet==

Wikisailor: /* Certbot Management Cheat Sheet */

2026-02-02T01:51:46Z

Certbot Management Cheat Sheet

← Older revision		Revision as of 01:51, 2 February 2026
Line 7:		Line 7:

	If you need to check on the health of your "idling" certificates, use these commands on Raisin:		If you need to check on the health of your "idling" certificates, use these commands on Raisin:
	* ~~TaskCommandCheck~~ Expiry Dates sudo certbot certificates		* Check Expiry Dates
	* Test the Renewal Process sudo certbot renew --dry-run		sudo certbot certificates
	* Force an Immediate Renewal sudo certbot renew --force-renewal		* Test the Renewal Process
	* View Scheduled Timer systemctl list-timers certbot		sudo certbot renew --dry-run
	* Check Logs for Failures sudo tail -f /var/log/letsencrypt/letsencrypt.log		* Force an Immediate Renewal
			sudo certbot renew --force-renewal
			* View Scheduled Timer
			systemctl list-timers certbot
			* Check Logs for Failures
			sudo tail -f /var/log/letsencrypt/letsencrypt.log

	==Acquire the Wildcard SSL Certificate and key from Letsencrypt==		==Acquire the Wildcard SSL Certificate and key from Letsencrypt==

Wikisailor: /* Introduction */

2026-02-02T01:50:42Z

Introduction

← Older revision		Revision as of 01:50, 2 February 2026
Line 3:		Line 3:
	The time has come when we need to have SSL certs that can be used independently of Cloudflare. Cloudflare's proxy for webservers does work well but on the free tier they only listen to 443 and anything else will be rejected and return an invalid response. For some services like VPN (either OpenVPN or Wireguard) it does not matter as they will do their own encryption. However, services like Jellyfin use alternate ports for both http and https traffic so cannot be proxied by Cloudflare, to date it has not really mattered because streaming to remote locations is not really required too much and if it is we can use a VPN link if privacy is an issue. It would be nice to do Jellyfin over https but not really required.		The time has come when we need to have SSL certs that can be used independently of Cloudflare. Cloudflare's proxy for webservers does work well but on the free tier they only listen to 443 and anything else will be rejected and return an invalid response. For some services like VPN (either OpenVPN or Wireguard) it does not matter as they will do their own encryption. However, services like Jellyfin use alternate ports for both http and https traffic so cannot be proxied by Cloudflare, to date it has not really mattered because streaming to remote locations is not really required too much and if it is we can use a VPN link if privacy is an issue. It would be nice to do Jellyfin over https but not really required.
	Enter N8N, it also works on non standard ports and does have a SSL engine that should work with Cloudflare but it does not appear to be as easy to setup as first thought and any outside access will certainly need to be secured.		Enter N8N, it also works on non standard ports and does have a SSL engine that should work with Cloudflare but it does not appear to be as easy to setup as first thought and any outside access will certainly need to be secured.

			== Certbot Management Cheat Sheet==

			If you need to check on the health of your "idling" certificates, use these commands on Raisin:
			* TaskCommandCheck Expiry Dates sudo certbot certificates
			* Test the Renewal Process sudo certbot renew --dry-run
			* Force an Immediate Renewal sudo certbot renew --force-renewal
			* View Scheduled Timer systemctl list-timers certbot
			* Check Logs for Failures sudo tail -f /var/log/letsencrypt/letsencrypt.log

	==Acquire the Wildcard SSL Certificate and key from Letsencrypt==		==Acquire the Wildcard SSL Certificate and key from Letsencrypt==

Wikisailor: /* Obtain Let's Encrypt Wildcard Certificates (on Raisin) */

2026-02-02T01:45:15Z

Obtain Let's Encrypt Wildcard Certificates (on Raisin)

← Older revision		Revision as of 01:45, 2 February 2026
Line 212:		Line 212:

	With the display of the cert and key the auto renewal and push to Lychee is complete		With the display of the cert and key the auto renewal and push to Lychee is complete

			== Updated Information after Lychee VM removal ==

			Lychee has been removed as a VM so all of the setup for Letsencrypt for Lychee has been purged.
			====Current "Ready" State====
			As of February 2026, the Certbot installation on Raisin is fully configured but currently "idling" because Nginx is using Cloudflare Origin Certificates.
			* The Engine: Certbot is installed via snap (the 2026 standard) and is linked to the Cloudflare DNS API.
			* The Credentials: Secure API tokens for both seaoffate.net and seaoffate.uk are stored in /etc/letsencrypt/cloudflare/.
			* The Certificates: Valid wildcard certificates for both domains are currently stored in /etc/letsencrypt/live/. Even if Nginx isn't using them, Certbot is successfully renewing them in the background.
			====The Renewal Logic (The "Hooks")====
			The system is now "Clean."
			* Success: A dry-run confirms that the renewal process works perfectly without trying to talk to any external VMs (like the old Lychee).
			* Trigger: When a renewal happens, Raisin only performs one action: sudo systemctl reload nginx. This is set in the /etc/letsencrypt/renewal/*.conf files.

			===How to Switch from Cloudflare to Let's Encrypt===

			If we ever need to use the Let's Encrypt certs instead of the Cloudflare Origin ones (e.g., for a service not behind the proxy), follow these three steps:
			* Update the Nginx Config
			** Change the certificate paths in your Nginx site configuration in /etc/nginx/sites-available/somewebsite.conf
			# FROM (Cloudflare Origin):
			ssl_certificate /etc/ssl/certs/seaoffatenet.crt;
			ssl_certificate_key /etc/ssl/private/seaoffatenet.key;

			# TO (Let's Encrypt Wildcard):
			ssl_certificate /etc/letsencrypt/live/seaoffate.net/fullchain.pem;
			ssl_certificate_key /etc/letsencrypt/live/seaoffate.net/privkey.pem;
			* Ensure Permission Access
			** Let's Encrypt directories are strictly locked. Ensure Nginx can read them
			sudo chown -R root:www-data /etc/letsencrypt/live/
			sudo chown -R root:www-data /etc/letsencrypt/archive/
			* Verify and Reload
			sudo nginx -t && sudo systemctl reload nginx

			===Summary of "Inactive" Features===

			* Remote Push: Deleted. Raisin no longer attempts to scp certificates to other IPs
			* User Accounts: The certbot-deploy user has been deleted. Any future remote pushing will require creating a new SSH keypair and user.

			===Conclusion===

			To restart using Letsencrypt we would have to create and configure the script to push the new SSL certs to the new VM but as the certbot will is currently working we will not need to set that up again

Wikisailor: /* Lychee Installation */

2026-02-02T00:47:10Z

Lychee Installation

← Older revision		Revision as of 00:47, 2 February 2026
Line 46:		Line 46:

	==== Lychee Installation====		==== Lychee Installation====

			''' Update ''' Lychee has been destroyed in favour of a new Linux desktop

	We need to be logged in to Lychee for this part		We need to be logged in to Lychee for this part

Wikisailor: /* Introduction */

2025-12-05T05:29:00Z

Introduction

← Older revision		Revision as of 05:29, 5 December 2025
Line 1:		Line 1:
	==Introduction==		==Introduction==

	The time has come when we need to have SSL certs that can be used ~~unrepentantly~~ of Cloudflare. Cloudflare's proxy for webservers does work well but on the free tier they only listen to 443 and anything else will be rejected and return an invalid response. For some services like VPN (either OpenVPN or Wireguard) it does not matter as they will do their own encryption. However, services like Jellyfin use alternate ports for both http and https traffic so cannot be proxied by Cloudflare, to date it has not really mattered because streaming to remote locations is not really required too much and if it is we can use a VPN link if privacy is an issue. It would be nice to do Jellyfin over https but not really required.		The time has come when we need to have SSL certs that can be used independently of Cloudflare. Cloudflare's proxy for webservers does work well but on the free tier they only listen to 443 and anything else will be rejected and return an invalid response. For some services like VPN (either OpenVPN or Wireguard) it does not matter as they will do their own encryption. However, services like Jellyfin use alternate ports for both http and https traffic so cannot be proxied by Cloudflare, to date it has not really mattered because streaming to remote locations is not really required too much and if it is we can use a VPN link if privacy is an issue. It would be nice to do Jellyfin over https but not really required.
	Enter N8N, it also works on non standard ports and does have a SSL engine that should work with Cloudflare but it does not appear to be as easy to setup as first thought and any outside access will certainly need to be secured.		Enter N8N, it also works on non standard ports and does have a SSL engine that should work with Cloudflare but it does not appear to be as easy to setup as first thought and any outside access will certainly need to be secured.

Wikisailor: /* Obtain Let's Encrypt Wildcard Certificates (on Raisin) */

2025-06-11T01:35:44Z

Obtain Let's Encrypt Wildcard Certificates (on Raisin)

← Older revision		Revision as of 01:35, 11 June 2025
Line 207:		Line 207:
	sudo cat /home/nigel/npm/letsencrypt/live/seaoffate.net/fullchain.pem \| awk 'BEGIN {c=0;} /BEGIN CERT/{c++} END {print c}' # Check if it's a full chain (should be 2 or more)		sudo cat /home/nigel/npm/letsencrypt/live/seaoffate.net/fullchain.pem \| awk 'BEGIN {c=0;} /BEGIN CERT/{c++} END {print c}' # Check if it's a full chain (should be 2 or more)
	sudo systemctl status nginx # Check if Nginx reloaded recently (look at timestamps in logs)		sudo systemctl status nginx # Check if Nginx reloaded recently (look at timestamps in logs)
	The key and cert should now be echoed to the screen		The key and cert should now be echoed to the screen.

			With the display of the cert and key the auto renewal and push to Lychee is complete

Wikisailor: /* Obtain Let's Encrypt Wildcard Certificates (on Raisin) */

2025-06-11T01:25:29Z

Obtain Let's Encrypt Wildcard Certificates (on Raisin)

← Older revision		Revision as of 01:25, 11 June 2025
Line 195:		Line 195:
	exit 0		exit 0
	</syntaxhighlight>		</syntaxhighlight>

			To test the deploy we need to clear the old log file:
			sudo rm -f /var/log/certbot-deploy-hook/certbot-deploy-hook.log
			Then execute the deploy-hook script but we also need to manually set RENEWED_LINEAGE and RENEWED_DOMAINS for this test run
			sudo RENEWED_LINEAGE="/etc/letsencrypt/live/seaoffate.net" RENEWED_DOMAINS="seaoffate.net *.seaoffate.net" /etc/letsencrypt/renewal-hooks/deploy/push_certs_to_lychee.sh
			This command must now run cleanly without any password prompts or permission errors in the log. Check the log file on raisin for success:
			sudo cat /var/log/certbot-deploy-hook/certbot-deploy-hook.log
			Look for "Starting deploy hook," and "Deploy hook completed successfully." There should be no "ERROR" messages from ssh, scp, or sudo calls within the log.
			'''On Lychee'''
			ls -l /home/nigel/npm/letsencrypt/live/seaoffate.net/ # Check if fullchain.pem and privkey.pem are there
			sudo cat /home/nigel/npm/letsencrypt/live/seaoffate.net/fullchain.pem \| awk 'BEGIN {c=0;} /BEGIN CERT/{c++} END {print c}' # Check if it's a full chain (should be 2 or more)
			sudo systemctl status nginx # Check if Nginx reloaded recently (look at timestamps in logs)
			The key and cert should now be echoed to the screen

Wikisailor: /* Install and setup Certbot */

2025-06-11T01:16:05Z

Install and setup Certbot

← Older revision		Revision as of 01:16, 11 June 2025
Line 54:		Line 54:
	sudo nano /usr/local/sbin/chown_certs_dir.sh		sudo nano /usr/local/sbin/chown_certs_dir.sh
	with the contents		with the contents
			<syntaxhighlight lang="bash">
	#!/bin/bash ;		#!/bin/bash ;
	/usr/bin/chown -R nigel:nigel "$1"		/usr/bin/chown -R nigel:nigel "$1"
			</syntaxhighlight>
	save and exit and set permissions and ownership		save and exit and set permissions and ownership
	sudo chmod 700 /usr/local/sbin/chown_certs_dir.sh		sudo chmod 700 /usr/local/sbin/chown_certs_dir.sh
Line 65:		Line 67:
	#!/bin/bash ;		#!/bin/bash ;
	/usr/bin/chmod -R 700 "$1"		/usr/bin/chmod -R 700 "$1"
			</syntaxhighlight>
	save and exit and set permissions and ownership		save and exit and set permissions and ownership
	sudo chmod 700 /usr/local/sbin/chmod_certs_dir.sh		sudo chmod 700 /usr/local/sbin/chmod_certs_dir.sh
Line 71:		Line 74:
	sudo visudo -f /etc/sudoers.d/nigel_cert_push		sudo visudo -f /etc/sudoers.d/nigel_cert_push
	with the following contents		with the following contents
			<syntaxhighlight lang="bash">
	# Allow nigel to run specific commands for cert push via SSH without password		# Allow nigel to run specific commands for cert push via SSH without password
	# For directory creation		# For directory creation