{"id":21140206,"url":"https://github.com/kurosaki1976/lets-encrypt-acme","last_synced_at":"2025-07-09T04:31:10.848Z","repository":{"id":197259490,"uuid":"298094417","full_name":"kurosaki1976/lets-encrypt-acme","owner":"kurosaki1976","description":"Let's Encrypt Certificates with acme.sh","archived":false,"fork":false,"pushed_at":"2024-01-26T19:52:21.000Z","size":30,"stargazers_count":6,"open_issues_count":0,"forks_count":1,"subscribers_count":3,"default_branch":"master","last_synced_at":"2024-01-26T21:04:01.914Z","etag":null,"topics":["acme","acme-dns","acme-sh","apache2","bind","bind9","debian","iredmail","lets-encrypt","letsencrypt","letsencrypt-certificates","nginx","pfsense","proxmox-mg","proxmox-ve","wildcard","zimbra"],"latest_commit_sha":null,"homepage":"","language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/kurosaki1976.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null}},"created_at":"2020-09-23T21:06:24.000Z","updated_at":"2024-01-26T19:52:25.000Z","dependencies_parsed_at":null,"dependency_job_id":"33cc8ad6-2a3a-4a0f-ae47-447eabe1a59f","html_url":"https://github.com/kurosaki1976/lets-encrypt-acme","commit_stats":null,"previous_names":["kurosaki1976/lets-encrypt-acme"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kurosaki1976%2Flets-encrypt-acme","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kurosaki1976%2Flets-encrypt-acme/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kurosaki1976%2Flets-encrypt-acme/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kurosaki1976%2Flets-encrypt-acme/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/kurosaki1976","download_url":"https://codeload.github.com/kurosaki1976/lets-encrypt-acme/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":225482440,"owners_count":17481214,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["acme","acme-dns","acme-sh","apache2","bind","bind9","debian","iredmail","lets-encrypt","letsencrypt","letsencrypt-certificates","nginx","pfsense","proxmox-mg","proxmox-ve","wildcard","zimbra"],"created_at":"2024-11-20T07:08:46.803Z","updated_at":"2024-11-20T07:08:46.868Z","avatar_url":"https://github.com/kurosaki1976.png","language":null,"funding_links":[],"categories":[],"sub_categories":[],"readme":"# Let's Encrypt SSL wildcard certificates with acme.sh auto renewal\n\n## Author\n\n- [Ixen Rodríguez Pérez - kurosaki1976](ixenrp1976@gmail.com)\n\n## Installation\n\nIn this tutorial the acme.sh installation and the issuing/renewing certificates' process take place on a Bind9 DNS server running GNU/Linux Debian 12 Bookworm.\n\n- Git clone and install\n\n```bash\napt install git socat\ngit clone https://github.com/acmesh-official/acme.sh.git\ncd acme.sh/\n./acme.sh --install \\\n\t--home /opt/acme.sh \\\n\t--config-home /opt/acme.sh/data \\\n\t--cert-home /opt/acme.sh/certs \\\n\t--accountemail \"john.doe@example.tld\" \\\n\t--accountkey /opt/acme.sh/example.tld.key \\\n\t--accountconf /opt/acme.sh/example.tld.conf\n```\n\n## Issuing/renewing certificates automatically with nsupdate\n\n- Generate a key for updating the zone\n\n```bash\ncat \u003e /etc/bind/nsupdate.key \u003c\u003cEOF\n`tsig-keygen -a hmac-sha512 letsencrypt-key`\nEOF\n```\n\n- Secure the key\n\n```bash\nchmod 640 /etc/bind/nsupdate.key\nchown bind.bind /etc/bind/nsupdate.key\n```\n\n- Include the key in Bind9 main configuration file\n\n```bash\nnano /etc/bind/named.conf\n\n...\ninclude \"/etc/bind/nsupdate.key\";\n...\n```\n\n- Configure the zone to allow dynamic updates\n\n```bash\nzone \"example.tld\" {\n    type master;\n    update-policy {\n        grant \"letsencrypt\" name _acme-challenge.example.tld. TXT;\n    };\n}\n```\n\n- Make the DNS server and update key available to acme.sh\n\n```bash\nexport NSUPDATE_SERVER=\"127.0.0.1\"\nexport NSUPDATE_KEY=\"/etc/bind/nsupdate.key\"\nexport NSUPDATE_ZONE=\"example.tld\"\n```\n\n- Issue a wildcard certificate\n\n```bash\nacme.sh --issue -d example.tld -d *.example.tld --days 90 --dns dns_nsupdate --dnssleep 60\n```\n\nIf everything succeeded, it should get two `TXT` records temporarily added to zone `example.tld`, similarily to:\n\n```bash\n_acme-challenge.example.tld. 60 IN TXT \"W_-Qk9a2e5xlMWEJHfbl5Sp_vw8T1oLsIaIthzDgcDs\"\n_acme-challenge.example.tld. 60 IN TXT \"NQ9KX3PSo0T_qhIKyAYQoBq7XRng3WwfnV58YyeI9k0\"\n```\n\n\u003e **TIP**: To allow Let’s Encrypt certificate authority the issuance of SSL certificates for `example.tld`, add the following `CAA` records:\n\u003e\n\u003e ```bash\n\u003e example.tld. 60 IN CAA 0 issuewild \"letsencrypt.org\"\n\u003e                    CAA 0 iodef \"mailto:john.doe@example.tld\"\n\u003e ```\n\n## Automate certificate renewal\n\n```bash\ncrontab -e\n\n0 0 1 */2 * \"/opt/acme.sh\"/acme.sh --renew -d example.tld -d *.example.tld --days 90 --dns dns_nsupdate --dnssleep 60 \u003e /dev/null\n```\n\n## Stop certificate renewal\n\n```bash\nacme.sh --remove -d example.tld -d *.example.tld\n```\n\n## Deploy the Let's Encrypt SSL Certificate on services\n\n### Let's Encrypt SSL Certificate on Zimbra\n\n```bash\nmkdir /opt/zimbra/ssl/letsencrypt\nmv example.tld.key fullchain.cer /opt/zimbra/ssl/letsencrypt/\ncd /opt/zimbra/ssl/letsencrypt/\nwget https://letsencrypt.org/certs/trustid-x3-root.pem.txt\ncat fullchain.cer trustid-x3-root.pem.txt \u003e chain.pem\nchown zimbra.zimbra *\n```\n```bash\nsu - zimbra\n$ cd /opt/zimbra/ssl/letsencrypt/\n$ /opt/zimbra/bin/zmcertmgr verifycrt comm example.tld.key fullchain.cer chain.pem\ncp -a /opt/zimbra/ssl/zimbra /opt/zimbra/ssl/zimbra.$(date \"+%Y%m%d\")\ncp example.tld.key /opt/zimbra/ssl/zimbra/commercial/commercial.key\n```\n```bash\nsu - zimbra\n$ cd /opt/zimbra/ssl/letsencrypt/\n$ /opt/zimbra/bin/zmcertmgr deploycrt comm fullchain.cer chain.pem\n$ zmcontrol restart\n```\n\nTest the certificate\n\n```bash\nsu - zimbra\n$ echo QUIT | openssl s_client -connect mail.example.tld:443 | openssl x509 -noout -text | less\n```\n\n### Let's Encrypt SSL Certificate on iRedMail Server\n\n```bash\nmkdir /opt/letsencrypt\nmv example.tld.{cer,key} /opt/letsencrypt\nchmod 0444 /opt/letsencrypt/example.tld.cer\nchmod 0400 /opt/letsencrypt/example.tld.key\n```\n```bash\nmv /etc/ssl/certs/iRedMail.crt{,.bak}\nmv /etc/ssl/private/iRedMail.key{,.bak}\nln -s /opt/letsencrypt/example.tld.cer /etc/ssl/certs/iRedMail.crt\nln -s /opt/letsencrypt/example.tld.key /etc/ssl/private/iRedMail.key\n```\n\nRestart related services\n\n```bash\nsystemctl restart postfix.service dovecot.service nginx.service\n```\n\n### Let's Encrypt SSL Certificate on Proxmox Mail Gateway\n\n#### Mail certificate\n\n```bash\nmv /etc/pmg/pmg-tls.pem{,.org}\ncat example.tld.key fullchain.cer \u003e /etc/pmg/pmg-tls.pem\nchmod 0600 /etc/pmg/pmg-tls.pem\nchown root.root /etc/pmg/pmg-tls.pem\n```\n\n#### HTTPs certificate\n\n```bash\nmv /etc/pmg/pmg-api.pem{,.org}\ncat example.tld.key fullchain.cer \u003e /etc/pmg/pmg-api.pem\nchmod 0640 /etc/pmg/pmg-api.pem\nchown root.www-data /etc/pmg/pmg-api.pem\n```\n\nRestart related service\n\n```bash\nsystemctl restart pmgproxy.service\n```\n\n### Let's Encrypt SSL Certificate on Proxmox Vitual Environment\n\nUse the Web GUI to deploy the files `fullchain.cer` and `example.tld.key`.\n\n```\n(Datacenter/\"Proxmox Node\"/System/Certificates/Upload Custom Certificate)\n```\n\nTough the recommended method is by using the Web GUI, the command line could be used as well:\n\n```bash\ncp fullchain.cer /etc/pve/local/pveproxy-ssl.pem\ncp example.tld.key /etc/pve/local/pveproxy-ssl.key\nchmod 0640 /etc/pve/local/pveproxy-ssl.*\nchown root.www-data /etc/pve/local/pveproxy-ssl.*\n```\n\nRestart related service\n\n```bash\nsystemctl restart pveproxy.service\n```\n\n### Let's Encrypt SSL Certificate on pfSense Firewall\n\nUse the Web GUI to deploy the files `fullchain.cer` and `example.tld.key`.\n\n```\n(System/Certificate Manager/Certificates/\"Add/Sign Button\"/Method \"Import an existing Certificate\")\n\n(System/Advanced/Admin Access/SSL/TLS Certificate)\n```\n\n### Let's Encrypt SSL Certificate on Web Server\n\n```bash\nmv fullchain.cer /etc/ssl/certs/\nmv example.tld.cer /etc/ssl/certs/\nmv example.tld.key /etc/ssl/private/\nchmod 0444 /etc/ssl/certs/{example.tld,fullchain}.cer\nchmod 0400 /etc/ssl/private/example.tld.key\n```\n\n#### Apache\n\n```bash\nnano /etc/apache2/sites-available/exampleTLD.conf\n\n...\nSSLEngine on\nSSLCertificateFile /etc/ssl/certs/example.tld.cer\nSSLCertificateKeyFile /etc/ssl/private/example.tld.key\nSSLCertificateChainFile \"/etc/ssl/certs/fullchain.cer\"\nSSLProtocol -all +TLSv1.3 +TLSv1.2\nSSLCipherSuite EECDH+AESGCM:EDH+AESGCM\nSSLHonorCipherOrder on\nSSLOpenSSLConfCmd Curves X25519:secp521r1:secp384r1:prime256v1\nSSLOpenSSLConfCmd DHParameters \"/etc/ssl/dh4096.pem\"\nHeader always set Strict-Transport-Security \"max-age=63072000; includeSubDomains; preload\"\nHeader always set X-Frame-Options SAMEORIGIN\nHeader always set X-Content-Type-Options nosniff\nHeader always set Content-Security-Policy \"default-src 'self';\"\nHeader always set X-XSS-Protection \"1; mode=block\"\nHeader always set Set-Cookie \"HttpOnly;Secure\"\nSSLCompression off\nSSLSessionTickets off\n...\n```\n\nTest settings, if syntax returns `OK`, restart the web service:\n\n```bash\napache2ctl -t\nsystemctl restart apache2.service\n```\n\n#### Nginx\n\n```bash\nnano /etc/nginx/sites-available/exampleTLD\n\n...\nssl on;\nssl_certificate /etc/ssl/certs/fullchain.cer;\nssl_certificate_key /etc/ssl/private/example.tld.key;\nssl_dhparam /etc/ssl/dh4096.pem;\nssl_protocols TLSv1.2 TLSv1.3;\nssl_ciphers EECDH+AESGCM:EDH+AESGCM;\nssl_ecdh_curve secp384r1;\nssl_prefer_server_ciphers on;\nssl_session_tickets off;\nadd_header Strict-Transport-Security \"max-age=63072000; includeSubDomains; preload\";\nadd_header X-Frame-Options \"SAMEORIGIN\" always;\nadd_header X-XSS-Protection \"1; mode=block\";\nadd_header X-Content-Type-Options \"nosniff\";\nadd_header Content-Security-Policy \"default-src 'self';\" always;\nadd_header X-XSS-Protection \"1; mode=block\" always;\nadd_header Set-Cookie \"HttpOnly;Secure\" always;\n...\n```\n\nTest settings, if syntax returns `OK`, restart the web service:\n\n```bash\nnginx -t\nsystemctl restart nginx.service\n```\n\n## References\n\n* [An ACME Shell script: acme.sh](https://github.com/acmesh-official/acme.sh)\n* [cerbot](https://certbot.eff.org/)\n* [Installing a Let's Encrypt SSL Certificate](https://wiki.zimbra.com/wiki/Installing_a_LetsEncrypt_SSL_Certificate)\n* [Deploy Commercial SSL Certificate on Proxmox Mail Gateway](https://dhenandi.com/deploy-commercial-ssl-certificate-on-proxmox-mail-gateway/)\n* [Certificate Management](https://pve.proxmox.com/wiki/Certificate_Management)\n* [How-To -- Lets Encrypt and PMG](https://forum.proxmox.com/threads/how-to-lets-encrypt-and-pmg.41493/)\n* [How To Secure Apache with Let's Encrypt on Debian 10](https://www.digitalocean.com/community/tutorials/how-to-secure-apache-with-let-s-encrypt-on-debian-10)\n* [Request a free cert from Let's Encrypt](https://docs.iredmail.org/letsencrypt.html)\n* [Update: Using Free Let’s Encrypt SSL/TLS Certificates with NGINX](https://www.nginx.com/blog/using-free-ssltls-certificates-from-lets-encrypt-with-nginx/)\n* [Installing Let’s Encrypt SSL Certificate with pfSense](https://gainanov.pro/eng-blog/linux/installing-lets-encrypt-pfsense/)\n* [Let's Encrypt on pfSense](https://www.netgate.com/resources/videos/lets-encrypt-on-pfsense.html)\n* [How to issue Let’s Encrypt wildcard certificate with acme.sh and Cloudflare DNS](https://www.cyberciti.biz/faq/issue-lets-encrypt-wildcard-certificate-with-acme-sh-and-cloudflare-dns/)\n* [CAA Records](https://support.dnsimple.com/articles/caa-record/)\n* [CAA Record Helper](https://sslmate.com/caa/)\n* [SSL/TLS Strong Encryption: How-To](https://httpd.apache.org/docs/2.4/ssl/ssl_howto.html)\n* [Apache Module mod_ssl](https://httpd.apache.org/docs/current/mod/mod_ssl.html#sslcacertificatefile)\n* [Cipherli.st Strong Ciphers for Apache, nginx and Lighttpd](https://syslink.pl/cipherlist/)\n* [SSL Server Test](https://www.ssllabs.com/ssltest)\n* [SSL and TLS Deployment Best Practices](https://github.com/ssllabs/research/wiki/SSL-and-TLS-Deployment-Best-Practices)\n* [SSL Server Rating Guide](https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide)\n* [pfSense as Name Server (bind9) with Let’s Encrypt/acme DNS-NSupdate/RFC 2136](https://forum.level1techs.com/t/pfsense-as-name-server-bind9-with-lets-encrypt-acme-dns-nsupdate-rfc-2136/168097)\n* [Creating Wildcard Certificates on pfSense with Let’s Encrypt](https://www.danielcolomb.com/2019/08/29/creating-wildcard-certificates-on-pfsense-with-lets-encrypt/)\n* [pfSense setup ACME Lets Encrypt](https://www.youtube.com/watch?v=Tc_8PAE8S28)\n* [BIND update-policy option](http://www.ipamworldwide.com/ipam/update-policy.html)\n* [Setting up BIND to get the letsencrypt wildcards to work on your system using RFC 2136](https://linux.m2osw.com/setting-bind-get-letsencrypt-wildcards-work-your-system-using-rfc-2136)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkurosaki1976%2Flets-encrypt-acme","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fkurosaki1976%2Flets-encrypt-acme","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkurosaki1976%2Flets-encrypt-acme/lists"}