[Linux] Installation de Let’s Encrypt

/!\ Rappel

Le certificat SSL, la clé privée ainsi que la chaîne de certification seront générées dans le répertoire: /etc/letsencrypt/live/

son contenu:
cert.pem : le certificat SSL
chain.pem : la chaine de certification
fullchain.pem : le certificat SSL et la chaine de certification concaténée
privkey.pem : la clé privée

/!\ La clé privée ne doit jamais être divulguée à un tiers.

/!\
Ouvrir les ports 80 et 443 pour générer le certificat
Les ports ne doivent pas être utilisés. pensez a stopper Nginx par exemple.

1.Installation du paquet git

$ cd~
$ sudo apt-get install git

Puis on récupère le client

$ sudo git clone https://github.com/letsencrypt/letsencrypt /opt/letsencrypt

/!\ pour mettre à jour le client depuis git, il suffit de faire un pull

$ cd /opt/letsencrypt
$ sudo git pull

2.Production de certificat, renseigner l’émail pour recevoir une alerte quand a l’expiration du certificat.

$ cd /opt/letsencrypt
$ sudo ./letsencrypt-auto certonly --standalone -d example.com

Creating virtual environment…
Installing Python packages…
Installation succeeded.
Saving debug log to /var/log/letsencrypt/letsencrypt.log

Enter email address (used for urgent renewal and security notices) (Enter 'c' to
cancel):

——————————————————————————-
Please read the Terms of Service at
https://letsencrypt.org/documents/LE-SA-v1.1.1-August-1-2016.pdf. You must agree
in order to register with the ACME server at
https://acme-v01.api.letsencrypt.org/directory
——————————————————————————-

(A)gree/(C)ancel:

——————————————————————————-
Would you be willing to share your email address with the Electronic Frontier
Foundation, a founding partner of the Let’s Encrypt project and the non-profit
organization that develops Certbot? We’d like to send you email about EFF and
our work to encrypt the web, protect its users and defend digital rights.
——————————————————————————-

(Y)es/(N)o:

——————————————————————————-
Congratulations! You have successfully enabled https://srv-test.domaine.tld

You should test your configuration at:
https://www.ssllabs.com/ssltest/analyze.html?d=srv-monitor.domaine.local
——————————————————————————-

IMPORTANT NOTES:
– Congratulations! Your certificate and chain have been saved at
/etc/letsencrypt/live/srv-monitor.domaine.local/fullchain.pem. Your cert
will expire on 2017-07-02. To obtain a new or tweaked version of
this certificate in the future, simply run certbot-auto again with
the “certonly” option. To non-interactively renew *all* of your
certificates, run “certbot-auto renew”
– If you like Certbot, please consider supporting our work by:

Donating to ISRG / Let’s Encrypt: https://letsencrypt.org/donate
Donating to EFF: https://eff.org/donate-le

/!\ Si plusieurs domaines on peux générer un seul certificat pour l’ensemble, il faut les rajouter a la suite.
Exemple ./letsencrypt-auto certonly –standalone -d monserveurmail.domaine.tld -d monserveurproxmox.domaine.tld

3.Mise en place

Voir Article Création d’un vhost pour Proxmox

Voir Article Mise en place d’un certificat Let’s Encrypt pour Zimbra

Voir Création d’un vhost pour Openfire