You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

214 lines
7.6 KiB

8 years ago
8 years ago
8 years ago
8 years ago
8 years ago
8 years ago
8 years ago
8 years ago
8 years ago
8 years ago
  1. # Using deploy api
  2. Before you can deploy your cert, you must [issue the cert first](https://github.com/Neilpang/acme.sh/wiki/How-to-issue-a-cert).
  3. Here are the scripts to deploy the certs/key to the server/services.
  4. ## 1. Deploy the certs to your cpanel host.
  5. (cpanel deploy hook is not finished yet, this is just an example.)
  6. Then you can deploy now:
  7. ```sh
  8. export DEPLOY_CPANEL_USER=myusername
  9. export DEPLOY_CPANEL_PASSWORD=PASSWORD
  10. acme.sh --deploy -d example.com --deploy-hook cpanel
  11. ```
  12. ## 2. Deploy ssl cert on kong proxy engine based on api.
  13. Before you can deploy your cert, you must [issue the cert first](https://github.com/Neilpang/acme.sh/wiki/How-to-issue-a-cert).
  14. (TODO)
  15. ## 3. Deploy the cert to remote server through SSH access.
  16. Before you can deploy your cert, you must [issue the cert first](https://github.com/Neilpang/acme.sh/wiki/How-to-issue-a-cert).
  17. The ssh deploy plugin allows you to deploy certificates to a remote host
  18. using SSH command to connect to the remote server. The ssh plugin is invoked
  19. with the following command...
  20. ```sh
  21. acme.sh --deploy -d example.com --deploy-hook ssh
  22. ```
  23. Prior to running this for the first time you must tell the plugin where
  24. and how to deploy the certificates. This is done by exporting the following
  25. environment variables. This is not required for subsequent runs as the
  26. values are stored by acme.sh in the domain configuration files.
  27. Required...
  28. ```
  29. export DEPLOY_SSH_USER=username
  30. ```
  31. Optional...
  32. ```
  33. export DEPLOY_SSH_CMD=custom ssh command
  34. export DEPLOY_SSH_SERVER=url or ip address of remote host
  35. export DEPLOY_SSH_KEYFILE=filename for private key
  36. export DEPLOY_SSH_CERTFILE=filename for certificate file
  37. export DEPLOY_SSH_CAFILE=filename for intermediate CA file
  38. export DEPLOY_SSH_FULLCHAIN=filename for fullchain file
  39. export DEPLOY_SSH_REMOTE_CMD=command to execute on remote host
  40. export DEPLOY_SSH_BACKUP=yes or no
  41. ```
  42. **DEPLOY_SSH_USER**
  43. Username at the remote host that SSH will login with. Note that
  44. SSH must be able to login to remote host without a password... SSH Keys
  45. must have been exchanged with the remote host. Validate and test that you
  46. can login to USER@URL from the host running acme.sh before using this script.
  47. The USER@URL at the remote server must also have has permissions to write to
  48. the target location of the certificate files and to execute any commands
  49. (e.g. to stop/start services).
  50. **DEPLOY_SSH_CMD**
  51. You can customize the ssh command used to connect to the remote host. For example
  52. if you need to connect to a specific port at the remote server you can set this
  53. to, for example, "ssh -p 22" or to use `sshpass` to provide password inline
  54. instead of exchanging ssh keys (this is not recommended, using keys is
  55. more secure).
  56. **DEPLOY_SSH_SERVER**
  57. URL or IP Address of the remote server. If not provided then the domain
  58. name provided on the acme.sh --deploy command line is used.
  59. **DEPLOY_SSH_KEYFILE**
  60. Target filename for the private key issued by LetsEncrypt.
  61. **DEPLOY_SSH_CERTFILE**
  62. Target filename for the certificate issued by LetsEncrypt.
  63. If this is the same as the previous filename (for keyfile) then it is
  64. appended to the same file.
  65. **DEPLOY_SSH_CAFILE**
  66. Target filename for the CA intermediate certificate issued by LetsEncrypt.
  67. If this is the same as a previous filename (for keyfile or certfile) then
  68. it is appended to the same file.
  69. **DEPLOY_SSH_FULLCHAIN**
  70. Target filename for the fullchain certificate issued by LetsEncrypt.
  71. If this is the same as a previous filename (for keyfile, certfile or
  72. cafile) then it is appended to the same file.
  73. **DEPLOY_SSH_REMOTE_CMD**
  74. Command to execute on the remote server after copying any certificates. This
  75. could be any additional command required for example to stop and restart
  76. the service.
  77. **DEPLOY_SSH_BACKUP**
  78. Before writing a certificate file to the remote server the existing
  79. certificate will be copied to a backup directory on the remote server.
  80. These are placed in a hidden directory in the home directory of the SSH
  81. user
  82. ```sh
  83. ~/.acme_ssh_deploy/[domain name]-backup-[timestamp]
  84. ```
  85. Any backups older than 180 days will be deleted when new certificates
  86. are deployed. This defaults to "yes" set to "no" to disable backup.
  87. ###Eamples using SSH deploy
  88. The following example illustrates deploying certifcates to a QNAP NAS
  89. (tested with QTS version 4.2.3)
  90. ```sh
  91. export DEPLOY_SSH_USER="admin"
  92. export DEPLOY_SSH_KEYFILE="/etc/stunnel/stunnel.pem"
  93. export DEPLOY_SSH_CERTFILE="/etc/stunnel/stunnel.pem"
  94. export DEPLOY_SSH_CAFILE="/etc/stunnel/uca.pem"
  95. export DEPLOY_SSH_REMOTE_CMD="/etc/init.d/stunnel.sh restart"
  96. acme.sh --deploy -d qnap.example.com --deploy-hook ssh
  97. ```
  98. Note how in this example both the private key and certificate point to
  99. the same file. This will result in the certificate being appended
  100. to the same file as the private key... a common requirement of several
  101. services.
  102. The next example illustates deploying certificates to a Unifi
  103. Contolller (tested with version 5.4.11).
  104. ```sh
  105. export DEPLOY_SSH_USER="root"
  106. export DEPLOY_SSH_KEYFILE="/var/lib/unifi/unifi.example.com.key"
  107. export DEPLOY_SSH_FULLCHAIN="/var/lib/unifi/unifi.example.com.cer"
  108. export DEPLOY_SSH_REMOTE_CMD="openssl pkcs12 -export \
  109. -inkey /var/lib/unifi/unifi.example.com.key \
  110. -in /var/lib/unifi/unifi.example.com.cer \
  111. -out /var/lib/unifi/unifi.example.com.p12 \
  112. -name ubnt -password pass:temppass \
  113. && keytool -importkeystore -deststorepass aircontrolenterprise \
  114. -destkeypass aircontrolenterprise \
  115. -destkeystore /var/lib/unifi/keystore \
  116. -srckeystore /var/lib/unifi/unifi.example.com.p12 \
  117. -srcstoretype PKCS12 -srcstorepass temppass -alias ubnt -noprompt \
  118. && service unifi restart"
  119. acme.sh --deploy -d unifi.example.com --deploy-hook ssh
  120. ```
  121. In this exmple we execute several commands on the remote host
  122. after the certificate files have been copied... to generate a pkcs12 file
  123. compatible with Unifi, to import it into the Unifi keystore and then finaly
  124. to restart the service.
  125. Note also that once the certificate is imported
  126. into the keystore the individual certificate files are no longer
  127. required. We could if we desired delete those files immediately. If we
  128. do that then we should disable backup at the remote host (as there are
  129. no files to backup -- they were erased during deployment). For example...
  130. ```sh
  131. export DEPLOY_SSH_BACKUP=no
  132. # modify the end of the remote command...
  133. && rm /var/lib/unifi/unifi.example.com.key \
  134. /var/lib/unifi/unifi.example.com.cer \
  135. /var/lib/unifi/unifi.example.com.p12 \
  136. && service unifi restart
  137. ```
  138. ## 4. Deploy the cert to local vsftpd server.
  139. ```sh
  140. acme.sh --deploy -d ftp.example.com --deploy-hook vsftpd
  141. ```
  142. The default vsftpd conf file is `/etc/vsftpd.conf`, if your vsftpd conf is not in the default location, you can specify one:
  143. ```sh
  144. export DEPLOY_VSFTPD_CONF="/etc/vsftpd.conf"
  145. acme.sh --deploy -d ftp.example.com --deploy-hook vsftpd
  146. ```
  147. The default command to restart vsftpd server is `service vsftpd restart`, if it doesn't work, you can specify one:
  148. ```sh
  149. export DEPLOY_VSFTPD_RELOAD="/etc/init.d/vsftpd restart"
  150. acme.sh --deploy -d ftp.example.com --deploy-hook vsftpd
  151. ```
  152. ## 5. Deploy the cert to local exim4 server.
  153. ```sh
  154. acme.sh --deploy -d ftp.example.com --deploy-hook exim4
  155. ```
  156. The default exim4 conf file is `/etc/exim/exim.conf`, if your exim4 conf is not in the default location, you can specify one:
  157. ```sh
  158. export DEPLOY_EXIM4_CONF="/etc/exim4/exim4.conf.template"
  159. acme.sh --deploy -d ftp.example.com --deploy-hook exim4
  160. ```
  161. The default command to restart exim4 server is `service exim4 restart`, if it doesn't work, you can specify one:
  162. ```sh
  163. export DEPLOY_EXIM4_RELOAD="/etc/init.d/exim4 restart"
  164. acme.sh --deploy -d ftp.example.com --deploy-hook exim4
  165. ```