-
Notifications
You must be signed in to change notification settings - Fork 0
Open
Description
The SSL certificate needs to be renewed every 3 months. Renewing it is as
simple as calling certbot renew, but this only runs over http.
The way I have been accomodate this is:
- stop the server
- change the launch script to map port 80 (instead of 443) to the server port
- create a firewall rule (through the Amazon interface) to allow port 80
- change the
www.jsfile to use http instead of https - start the server
- Run
certbot renewto get the new certificate - Reverse all the above changes
A better solution would be to have a separate server that only listens for
certificate renewals. I would need to:
- create a permanent firewall rule for port 80 with the source restricted
to the letsencrypt servers - create a renewal server that exposes the .well-known directory
- create a launch script to map port 80 to the renewal server port
- remove the .well-known and static directories from the existing server
and launch script
If this works correctly, I could add a cron job to automatically renew
the certificate
Metadata
Metadata
Assignees
Labels
No labels