waja / gist:4cc1e9ca87c0495397c7e51f647bd408

Deploying [dehydrated](http://dehydrated.de) for apache2 on Debian Jessie: ``` wget https://gist.githubusercontent.com/waja/8df78afb09691e4f383d818685f48885/raw/deploy_dehydrated.sh \ -O /tmp/deploy_dehydrated.sh && \ bash /tmp/deploy_dehydrated.sh <registration email> ``` Now you need to create ```/etc/dehydrated/domains.txt``` like [documented](https://github.com/lukas2511/dehydrated/blob/master/docs/domains_txt.md). Running the cronjob for initial request of certs: ``` /etc/cron.daily/dehydrated_autorenew ``` Linking certs and keys into usual places: ``` for CERT in $(awk {'print $1'} /etc/dehydrated/domains.txt); do\ [ -f /var/lib/dehydrated/certs/${CERT}/privkey.pem ] && ! [ -L /etc/ssl/private/${CERT}.key ] && \ ln -s /var/lib/dehydrated/certs/${CERT}/privkey.pem /etc/ssl/private/${CERT}.key;\ [ -f /var/lib/dehydrated/certs/${CERT}/fullchain.pem ] && ! [ -L /etc/ssl/certs/${CERT}.pem ] && \ ln -s /var/lib/dehydrated/certs/${CERT}/fullchain.pem /etc/ssl/certs/${CERT}.pem;\ done ```

#!/bin/bash CRON="/etc/cron.daily/dehydrated_autorenew" CONFIGURL="https://gist.githubusercontent.com/waja/8df78afb09691e4f383d818685f48885/raw/local.sh" CONFIGNAME="$(basename ${CONFIGURL})" CONFIGPATH="/etc/dehydrated/conf.d/" HOOKNAME="hook.sh" HOOKPATH="/etc/dehydrated/" SUITE="jessie-backports" PACKAGES="dehydrated dehydrated-apache2" apt-get install -t ${SUITE} ${PACKAGES} if [ ! -x ${CRON} ]; then echo '#!/bin/bash' > ${CRON} echo 'test -x /usr/bin/dehydrated && /usr/bin/dehydrated -c | grep -v -E "(^#|^Processing|Skipping renew|unchanged|Checking expire date of existing cert|^$)"; exit 0' >> ${CRON} chmod +x ${CRON} fi [ -f ${CONFIGPATH}/${CONFIGNAME} ] || wget ${CONFIGURL} -O ${CONFIGPATH}/${CONFIGNAME} sed -i "s/^CONTACT_EMAIL=*/CONTACT_EMAIL=${1}/" ${CONFIGPATH}/${CONFIGNAME} [ -f ${HOOKPATH}/${HOOKNAME} ] || printf '#!/bin/sh\n\n# See also https://github.com/lukas2511/dehydrated/blob/master/docs/examples/hook.sh\n\n[ "$1" != "deploy_cert" ] || /usr/sbin/service apache2 restart' > ${HOOKPATH}/${HOOKNAME} && chmod +x ${HOOKPATH}/${HOOKNAME}

alias.url += ( "/.well-known/acme-challenge/" => "/var/lib/dehydrated/acme-challenges/", )

# Path to certificate authority (default: https://acme-v01.api.letsencrypt.org/directory) #CA="https://acme-v01.api.letsencrypt.org/directory" # Program or function called in certain situations # # After generating the challenge-response, or after failed challenge (in this case altname is empty) # Given arguments: clean_challenge|deploy_challenge altname token-filename token-content # # After successfully signing certificate # Given arguments: deploy_cert domain path/to/privkey.pem path/to/cert.pem path/to/fullchain.pem # # BASEDIR and WELLKNOWN variables are exported and can be used in an external program # default: <unset> HOOK='/etc/dehydrated/hook.sh' # Chain clean_challenge|deploy_challenge arguments together into one hook call per certificate (default: no) HOOK_CHAIN="yes" # Which public key algorithm should be used? Supported: rsa, prime256v1 and secp384r1 #KEY_ALGO=rsa # E-mail to use during the registration (default: <unset>) CONTACT_EMAIL=

# install (transition) package aptitude -t jessie-backports install letsencrypt.sh letsencrypt.sh-apache2 && \ # migrate config over to dehydrated sed -i s/letsencrypt\.sh/dehydrated/g /etc/cron.daily/letsencrypt_autorenew && mv /etc/cron.daily/letsencrypt_autorenew /etc/cron.daily/dehydrated_autorenew && \ mv /var/lib/letsencrypt.sh/certs/ /var/lib/letsencrypt.sh/accounts/ /var/lib/dehydrated/ && \ mv /etc/letsencrypt.sh/conf.d/* /etc/dehydrated/conf.d/ && \ mv /etc/letsencrypt.sh/domains.txt /etc/letsencrypt.sh/hook.sh /etc/dehydrated/ && \ sed -i s/letsencrypt\.sh/dehydrated/g /etc/dehydrated/conf.d/* # migrate certificate links to dehydrated for CERT in $(awk {'print $1'} /etc/dehydrated/domains.txt); do \ test -L /etc/ssl/certs/$CERT.pem && rm /etc/ssl/certs/$CERT.pem; \ test -L /etc/ssl/private/$CERT.key && rm /etc/ssl/private/$CERT.key; \ test -e /var/lib/dehydrated/certs/${CERT}/privkey.pem && \ ln -s /var/lib/dehydrated/certs/${CERT}/privkey.pem /etc/ssl/private/${CERT}.key; \ test -e /var/lib/dehydrated/certs/${CERT}/fullchain.pem && \ ln -s /var/lib/dehydrated/certs/${CERT}/fullchain.pem /etc/ssl/certs/${CERT}.pem; \ done # remove obsolete apache configuration and reload apache2 rm /etc/apache2/conf-available/letsencrypt.sh.conf /etc/apache2/conf-enabled/letsencrypt.sh.conf && /etc/init.d/apache2 reload