Let’s Encrypt でワイルドカード証明書

まずはcertbotをインストールしAPIを叩く

sudo yum search --enablerepo=epel certbot

sudo certbot certonly --manual \
--server https://acme-v02.api.letsencrypt.org/directory \
--preferred-challenges dns \
-d *.upper-ricefield.net -d upper-ricefield.net \
-m ******@upper-ricefield.net \
--agree-tos
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator manual, Installer None
Starting new HTTPS connection (1): acme-v02.api.letsencrypt.org
Requesting a certificate for *.upper-ricefield.net and upper-ricefield.net
Performing the following challenges:
dns-01 challenge for upper-ricefield.net

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Please deploy a DNS TXT record under the name
_acme-challenge.upper-ricefield.net with the following value:

FL-dArNldjaskljl*******

Before continuing, verify the record is deployed.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Press Enter to Continue

この状態でDNSへの登録を行う。確認は(別ターミナルで)

dig @8.8.8.8 -t TXT _acme-challenge.upper-ricefield.net

正常に登録できるまではEnterは押さない。以下のようになれば証明書が発行されている。

Waiting for verification...
Cleaning up challenges
Subscribe to the EFF mailing list (email: ***@upper-ricefield.net).
Starting new HTTPS connection (1): supporters.eff.org

IMPORTANT NOTES:
 - Congratulations! Your certificate and chain have been saved at:
   /etc/letsencrypt/live/upper-ricefield.net/fullchain.pem
   Your key file has been saved at:
   /etc/letsencrypt/live/upper-ricefield.net/privkey.pem
   Your certificate will expire on 2022-01-21. To obtain a new or
   tweaked version of this certificate in the future, simply run
   certbot again. To non-interactively renew *all* of your
   certificates, run "certbot renew"
 - If you like Certbot, please consider supporting our work by:

   Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
   Donating to EFF:                    https://eff.org/donate-le

ワイルドカード証明書の場合は renew できないようだ…。

コメントを残す

メールアドレスが公開されることはありません。