Letsencrypt Centmin Mod Letsencrypt Branch testing discussions

Update: May 28th, 2016: Existing 123.09beta01le* branch work is being scrapped as I am rewriting the Letsencrypt integration from scratch with a new addon called acmetool.sh. Details at Letsencrypt - Welcome to acmetool.sh - new letsencrypt addon for Centmin Mod LEMP stacks | Centmin Mod Community

Letsencrypt integration into Centmin Mod is running on a separate experimental github branch - 123.09beta01le* and the latest current branch is 123.09beta01le4. As at Jan 31, 2016, additional 3rd party letsencrypt client support for shell based le client was added Letsencrypt - Centmin Mod Letsencrypt Branch testing discussions | Centmin Mod Community

---

You should test on test server with test site for now and not production usage as Letsencrypt is still in public beta since Dec 3, 2015 and their client is still in beta and undergoing development and they have rate limiting in place so you can't obtain too many Letsencrypt SSL certificates at one time. See rate limit details and other notes here.

123.09beta01le4 created

• New Centmin Mod experimental 123.09beta01le4 branch created on Jan 21, 2016. Like 123.09beta01le3 branch, it's a merging of branches. The 123.09beta01le4 branch merges 123.09beta01le3 with 123.09beta01-gcc2 (used to test ngx_pagespeed 1.10 compatibilty centos 6 GCC 4.4.7). As such 123.09beta01le4 nginx compilation reverts back from Clang compiler to GCC compiler 4.8.5 for CentOS 7 and devtoolset-3 GCC 4.9.1 for CentOS 6 (to work around ngx_pagespeed 1.10 requirement for GCC >4.8). This is in anticipation of ngx_brotli support and fixed compatibility with ngx_pagespeed 1.10 branch.
• 123.09beta01le3 was a merge (via rebase) 123.09beta01 and 123.09beta01le2 branches for Letsencrypt integration testing on latest 123.09beta01 changes as of Jan 16, 2016.

Examples

• Letsencrypt Free SSL Certificates
• SSL - Letsencrypt Free SSL certificates with web root authentication method | Centmin Mod Community (my public work log)

 

Notes & Tips

/usr/bin/nv command line

With 123.09beta01le3 letsencrypt integration branch, running centmin.sh menu option 2 or 22 or running /usr/bin/nv command line to generate an Nginx vhost can be used to obtain and setup an Nginx HTTP/2 based site with Letsencrypt SSL certificate.

command options for /usr/bin/nv

Code:

nv

Usage: /usr/bin/nv [-d yourdomain.com] [-s y|n|le] [-u ftpusername]

  -d  yourdomain.com or subdomain.yourdomain.com
  -s  ssl self-signed create = y or n or le (for letsencrypt ssl certs)
  -u  your FTP username

  example:

  /usr/bin/nv -d yourdomain.com -s y -u ftpusername
  /usr/bin/nv -d yourdomain.com -s le -u ftpusername

So you can easily via command line generate a new Nginx HTTP/2 site with letsencrypt SSL certificate using the below command:

Code:

nv -d le15.http2ssl.xyz -s le -u USERNAME

output after completion will display relevant paths to nginx vhost and ssl vhost conf files, and paths to both the auto generated self-signed SSL certificates + the Letsencrypt SSL certificate.

for Nginx HTTP/S SSL vhost

Code:

vhost ssl for le15.http2ssl.xyz created successfully

domain: https://le15.http2ssl.xyz
vhost ssl conf file for le15.http2ssl.xyz created: /usr/local/nginx/conf/conf.d/le15.http2ssl.xyz.ssl.conf
/usr/local/nginx/conf/ssl_include.conf created
Self-signed SSL Certificate: /usr/local/nginx/conf/ssl/le15.http2ssl.xyz/le15.http2ssl.xyz.crt
SSL Private Key: /usr/local/nginx/conf/ssl/le15.http2ssl.xyz/le15.http2ssl.xyz.key
SSL CSR File: /usr/local/nginx/conf/ssl/le15.http2ssl.xyz/le15.http2ssl.xyz.csr
Backup SSL Private Key: /usr/local/nginx/conf/ssl/le15.http2ssl.xyz/le15.http2ssl.xyz-backup.key
Backup SSL CSR File: /usr/local/nginx/conf/ssl/le15.http2ssl.xyz/le15.http2ssl.xyz-backup.csr

Letsencrypt SSL Certificate: /etc/letsencrypt/live/le15.http2ssl.xyz/cert.pem
Letsencrypt SSL Certificate Private Key: /etc/letsencrypt/live/le15.http2ssl.xyz/privkey.pem
Letsencrypt SSL Certificate Chain: /etc/letsencrypt/live/le15.http2ssl.xyz/chain.pem
Letsencrypt SSL Certificate Full Chain: /etc/letsencrypt/live/le15.http2ssl.xyz/fullchain.pem
Letsencrypt le15.http2ssl.xyz cronjob file: /usr/local/nginx/conf/ssl/le15.http2ssl.xyz/letsencrypt-le15.http2ssl.xyz-cron

upload files to /home/nginx/domains/le15.http2ssl.xyz/public
vhost log files directory is /home/nginx/domains/le15.http2ssl.xyz/log

auto generated Nginx HTTP/2 based SSL vhost file /usr/local/nginx/conf/conf.d/le15.http2ssl.xyz.ssl.conf contents:

Code:

# Centmin Mod Getting Started Guide
# must read http://centminmod.com/getstarted.html
# For SPDY SSL Setup
# read http://centminmod.com/nginx_configure_https_ssl_spdy.html

# redirect from www to non-www  forced SSL
# uncomment, save file and restart Nginx to enable
# if unsure use return 302 before using return 301
# server {
#   server_name le15.http2ssl.xyz www.le15.http2ssl.xyz;
#    return 302 https://$server_name$request_uri;
# }

server {
  listen 443 ssl http2;
  server_name le15.http2ssl.xyz www.le15.http2ssl.xyz;

  ssl_dhparam /usr/local/nginx/conf/ssl/le15.http2ssl.xyz/dhparam.pem;
  ssl_certificate      /etc/letsencrypt/live/le15.http2ssl.xyz/fullchain.pem;
  ssl_certificate_key  /etc/letsencrypt/live/le15.http2ssl.xyz/privkey.pem;
  include /usr/local/nginx/conf/ssl_include.conf;

  # mozilla recommended
  ssl_ciphers ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA:!CAMELLIA:!DES-CBC3-SHA;
  ssl_prefer_server_ciphers   on;
  #add_header Alternate-Protocol  443:npn-spdy/3;
  # HTTP Public Key Pinning Header uncomment only one that applies include or exclude domains.
  # You'd want to include subdomains if you're using SSL wildcard certificates
  # include subdomain
  #add_header Public-Key-Pins 'pin-sha256="Zy7RMNpe1/u3Mq3prXMvzAWoCY80n2vJ5UmoQycXEO4="; pin-sha256="upuKQf9P0W834U0QQkPXpgHo//Bgqsta4qB05V+IPhY="; max-age=86400; includeSubDomains';
  # exclude subdomains
  #add_header Public-Key-Pins 'pin-sha256="Zy7RMNpe1/u3Mq3prXMvzAWoCY80n2vJ5UmoQycXEO4="; pin-sha256="upuKQf9P0W834U0QQkPXpgHo//Bgqsta4qB05V+IPhY="; max-age=86400';
  #add_header Strict-Transport-Security "max-age=31536000; includeSubdomains;";
  #add_header  X-Content-Type-Options "nosniff";
  #add_header X-Frame-Options DENY;
  #spdy_headers_comp 5;
  ssl_buffer_size 1400;
  ssl_session_tickets on;

  # enable ocsp stapling
  resolver 8.8.8.8 8.8.4.4 valid=10m;
  resolver_timeout 10s;
  ssl_stapling on;
  ssl_stapling_verify on;
  ssl_trusted_certificate /etc/letsencrypt/live/le15.http2ssl.xyz/fullchain.pem;

# ngx_pagespeed & ngx_pagespeed handler
#include /usr/local/nginx/conf/pagespeed.conf;
#include /usr/local/nginx/conf/pagespeedhandler.conf;
#include /usr/local/nginx/conf/pagespeedstatslog.conf;

  # limit_conn limit_per_ip 16;
  # ssi  on;

  access_log /home/nginx/domains/le15.http2ssl.xyz/log/access.log combined buffer=256k flush=60m;
  error_log /home/nginx/domains/le15.http2ssl.xyz/log/error.log;

  root /home/nginx/domains/le15.http2ssl.xyz/public;

  location / {

# block common exploits, sql injections etc
#include /usr/local/nginx/conf/block.conf;

  # Enables directory listings when index file not found
  #autoindex  on;

  # Shows file listing times as local time
  #autoindex_localtime on;

  # Enable for vBulletin usage WITHOUT vbSEO installed
  # More example Nginx vhost configurations at
  # http://centminmod.com/nginx_configure.html
  #try_files    $uri $uri/ /index.php;

  }

  include /usr/local/nginx/conf/staticfiles.conf;
  include /usr/local/nginx/conf/php.conf;
  include /usr/local/nginx/conf/drop.conf;
  #include /usr/local/nginx/conf/errorpage.conf;
  include /usr/local/nginx/conf/vts_server.conf;
}

pay attention to the paths to the Letsencrypt SSL certificates in the Nginx HTTP/2 based SSL config file

Code:

  ssl_dhparam /usr/local/nginx/conf/ssl/le15.http2ssl.xyz/dhparam.pem;
  ssl_certificate      /etc/letsencrypt/live/le15.http2ssl.xyz/fullchain.pem;
  ssl_certificate_key  /etc/letsencrypt/live/le15.http2ssl.xyz/privkey.pem;

  ssl_trusted_certificate /etc/letsencrypt/live/le15.http2ssl.xyz/fullchain.pem;

• /usr/local/nginx/conf/ssl/le15.http2ssl.xyz/dhparam.pem was generated when auto generating the self-signed SSL certificate section of the routine.
• /etc/letsencrypt/live/le15.http2ssl.xyz/fullchain.pem - the concatenated Letsencrypt SSL certificate in Letsencrypt's own directory /etc/letsencrypt/live/le15.http2ssl.xyz/
• /etc/letsencrypt/live/le15.http2ssl.xyz/privkey.pem - the Letsencrypt SSL certificates private key in Letsencrypt's own directory /etc/letsencrypt/live/le15.http2ssl.xyz/

Auto Renewal of Letsencrypt SSL certificate

Letsencrypt SSL certificates have 90 day expiry. So you ideally want to renew them around 60 day mark for safe measure. Using Centmin Mod 123.09beta01le3 branch to generate your Nginx HTTP/2 SSL vhost site with Letsencrypt SSL certificate will also setup an automated cronjob to auto renew your certificate when the expiry date falls between 7 to 30 days remaining.

So for le15.http2ssl.xyz a cronjob was setup with file at /usr/local/nginx/conf/ssl/le15.http2ssl.xyz/letsencrypt-le15.http2ssl.xyz-cron

listing cronjobs

Code:

crontab -l
10 1 */9 * * sleep 882s ; /bin/bash /usr/local/nginx/conf/ssl/le15.http2ssl.xyz/letsencrypt-le15.http2ssl.xyz-cron > /dev/null 2>&1

Contents of cronjob file /usr/local/nginx/conf/ssl/le15.http2ssl.xyz/letsencrypt-le15.http2ssl.xyz-cron

Code:

EMAIL=$(awk '/email/ {print $3}' /etc/letsencrypt/webroot.ini)
ERRORLOG=$(tail /var/log/letsencrypt/letsencrypt.log)
CERT="/etc/letsencrypt/live/le15.http2ssl.xyz/cert.pem"

if [[ -f $CERT ]]; then
  expiry=$(openssl x509 -enddate -noout -in $CERT | cut -d'=' -f2 | awk '{print $2   $1   $4}')
  epochExpirydate=$(date -d${expiry} +%s)
  epochToday=$(date +%s)
  secondsToExpire=$(echo ${epochExpirydate} - ${epochToday} | bc)
  daysToExpire=$(echo ${secondsToExpire} / 60 / 60 / 24 | bc)
  if [ $daysToExpire -lt '30' ]; then
    /root/.local/share/letsencrypt/bin/letsencrypt -c /etc/letsencrypt/webroot.ini --user-agent centminmod-centos6-webroot --webroot-path /home/nginx/domains/le15.http2ssl.xyz/public -d le15.http2ssl.xyz certonly
    if [ $? -ne 0 ]; then
        sleep 1; echo -e "The Lets Encrypt SSL Certificate for le15.http2ssl.xyz has not been renewed! \n \n" $ERRORLOG | dos2unix | mail -s "Lets Encrypt Cert Alert" $EMAIL
      else
        /usr/bin/ngxreload
    fi
  fi
fi
exit 0

Taking Letsencrypt SSL certificate elsewhere

As you can see, Letsencrypt SSL certificate is contained in /etc/letsencrypt/live/le15.http2ssl.xyz/ via symlinked files. So technically, if you want to migrate and test this SSL certificate on another server, all you would need to do is download a copy of the contents and files located in /etc/letsencrypt/live/le15.http2ssl.xyz/ - make sure you do not remove or alter the files in /etc/letsencrypt/live/le15.http2ssl.xyz/ as that can break Letsencrypt clients' operations I suspect.

Code:

ls -lAh /etc/letsencrypt/live/le15.http2ssl.xyz/
total 0
lrwxrwxrwx 1 root root 41 Jan 16 15:52 cert.pem -> ../../archive/le15.http2ssl.xyz/cert1.pem
lrwxrwxrwx 1 root root 42 Jan 16 15:52 chain.pem -> ../../archive/le15.http2ssl.xyz/chain1.pem
lrwxrwxrwx 1 root root 46 Jan 16 15:52 fullchain.pem -> ../../archive/le15.http2ssl.xyz/fullchain1.pem
lrwxrwxrwx 1 root root 44 Jan 16 15:52 privkey.pem -> ../../archive/le15.http2ssl.xyz/privkey1.pem

Easy way to copy and zip up the files to /home/nginx/domains/le15.http2ssl.xyz/backup/letsencrypt-certs.zip would be via these commands.

Code:

cd /etc/letsencrypt/live/le15.http2ssl.xyz/
zip -r /home/nginx/domains/le15.http2ssl.xyz/backup/letsencrypt-certs.zip *

Code:

ls -lAh /home/nginx/domains/le15.http2ssl.xyz/backup/
total 12K
-rw-r--r-- 1 root nginx 8.3K Jan 16 16:35 letsencrypt-certs.zip

Note the Letsencrypt SSL certificate generated has 90 day expiry, so if you're testing on other servers, you'd need to renew and copy over the Letsencrypt SSL certificate before 90 day expiry and pay attention to DNS requirements for Letsencrypt SSL auto renewal.

 

reserved for centmin.sh menu 2

 

reserved for centmin.sh menu 22

 

yeah technically speaking

ah indeed that is one of the dilemmas, yes to auto renew the Letsencrypt on the 123.09beta01le3 based LEMP stack server, you need the domain's DNS pointing that server's IP address. There's work on Letsencrypt staging server for DNS type validation instead of file based in my webroot authentication integration. So eventually you should be able to have a DNS record setup to validate the domain so you can use the Letsencrypt SSL certificate on any server. So looking forward to that.

Yes for webroot authentication the domain DNS has to point to 123.09beta01le3 based server for renewals to validate the domain.
So suggestion I have right now is just for test site usage and not production So if you need to do some testing on a test site for less than 90 days

 

Yay ECC 256bit support has been added to Letsencrypt staging API servers (not public beta ones) instead of RSA 2048-4096bit SSL certificates that are default now ECDSA testing on staging - Let's Encrypt Community Support

SSL - ECC 256 bit vs RSA 2048 bit SSL | Centmin Mod Community

 

Found a bug in 123.09beta01le3 for auto generated cronjob file the CERT variable improperly escaped the ${vhostname} variable

incorrect

Code:

CERT="/etc/letsencrypt/live/${vhostname}/cert.pem"

correct should the name of the vhost domain that is being renewed ie. le15.http2ssl.xyz

Code:

CERT="/etc/letsencrypt/live/le15.http2ssl.xyz/cert.pem"

If you have already setup some vhosts, check and manually correct the cronjob's CERT variable to the right vhost domain name.

correct in this commit fix letsencrypt auto cron renewal variables · centminmod/centminmod@160e6c6 · GitHub

 

dns challenge and ecdsa certs are in Letsencrypt staging API server for testing but not on Letsencrypt public beta staging API server. So you can test on staging but the certs are not web browser trusted

see

• DNS challenge is in staging - Feature Requests - Let's Encrypt Community Support
• ECDSA testing on staging - Let's Encrypt Community Support and my attempts at --csr and webroot-path webroot-map errors - Client - Let's Encrypt Community Support

 

there's a command line flag to switch to staging API for tests

there's actually more than one command flag including --test-cert

Code:

--test-cert, --staging
                        Use the staging server to obtain test (invalid) certs;
                        equivalent to --server https://acme-
                        staging.api.letsencrypt.org/directory (default: False)

Centmin Mod's integration in 123.09beta01le3 uses webroot.ini config file at /etc/letsencrypt/webroot.ini

Code:

# Always use the staging/testing server
#server = https://acme-staging.api.letsencrypt.org/directory

# for beta invitees
server = https://acme-v01.api.letsencrypt.org/directory

staging server is commented out and uses live/beta invitees API

 

Letsencrypt has posted some guidelines for writing on renewal scripts How It Works - Let's Encrypt - Free SSL/TLS Certificates Already have my own but won't hurt reading up

 

123.09beta01le4 created

• New Centmin Mod experimental 123.09beta01le4 branch created on Jan 21, 2016. Like 123.09beta01le3 branch, it's a merging of branches. The 123.09beta01le4 branch merges 123.09beta01le3 with 123.09beta01-gcc2 (used to test ngx_pagespeed 1.10 compatibilty centos 6 GCC 4.4.7). As such 123.09beta01le4 nginx compilation reverts back from Clang compiler to GCC compiler 4.8.5 for CentOS 7 and devtoolset-3 GCC 4.9.1 for CentOS 6 (to work around ngx_pagespeed 1.10 requirement for GCC >4.8). This is in anticipation of ngx_brotli support and fixed compatibility with ngx_pagespeed 1.10 branch.
• 123.09beta01le3 was a merge (via rebase) 123.09beta01 and 123.09beta01le2 branches for Letsencrypt integration testing on latest 123.09beta01 changes as of Jan 16, 2016.

 

Seems like a new bug turned up in latest letsencrypt client install routine on CentOS 6.x the installer can't find the path to virtualenv

Code:

Creating virtual environment...
./letsencrypt-auto: line 167: virtualenv: command not found
setup general /etc/letsencrypt/webroot.ini letsencrypt config file
touch: cannot touch `/etc/letsencrypt/webroot.ini': No such file or directory
addons/letsencrypt.sh: line 163: /etc/letsencrypt/webroot.ini: No such file or directory
grep: /etc/letsencrypt/webroot.ini: No such file or directory

line 167 there abouts

Code:

  DeterminePythonVersion
  echo "Creating virtual environment..."
  if [ "$VERBOSE" = 1 ] ; then
    virtualenv --no-site-packages --python $LE_PYTHON $VENV_PATH
  else
    virtualenv --no-site-packages --python $LE_PYTHON $VENV_PATH > /dev/null
  fi

commited fix to 123.09beta01le4 branch fix letsencrypt client install · centminmod/centminmod@16f4959 · GitHub

 

Just added 3rd party shell based simple le https://github.com/Neilpang/le client support to experimental Centmin Mod 123.09beta01le4 branch. It defaults to STAGING ACME API server for test SSL certs for now which are not trusted in web browsers.

Initial Commits

• add additional 3rd party letsencrypt client support · centminmod/centminmod@3b7c119 · GitHub
• updated 3rd party simple shell based le client routine · centminmod/centminmod@7b4e2d8 · GitHub
• updated 3rd party simple shell based le client routine · centminmod/centminmod@afca95e · GitHub
• updated 3rd party simple shell based le client routine · centminmod/centminmod@d4dc9ed · GitHub
• updated 3rd party simple le client FORCE=1 · centminmod/centminmod@0f18dcd · GitHub

simple shell based le client https://github.com/Neilpang/le installled at /usr/local/bin/le and controlled via setting 2 variables which can be set via persistent config file /etc/centminmod/custom_config.inc:

Code:

LECLIENT_OFFICIAL='n'
LECLIENT_LE='y'

This will switch from default official letsencrypt client to 3rd party shell based simple le client outlined at Neilpang/le: Simplest shell script for LetsEncrypt free Certificate client. Both are mutually exclusive so SSL certificate obtained via official letsencrypt client is saved to one directory and SSL certs obtained via 3rd party shell based simple le client are saved elsewhere in /root/.le/${vhostname}/. A nginx vhost created with official letsencrypt client won't work with 3rd party simple shell based le client created nginx vhost and vice versa.

Example output for centmin.sh menu option 2 for sub.domain.com nginx vhost

Code:

Enter vhost domain name to add (without www. prefix): sub.domain.com

Create a self-signed SSL certificate Nginx vhost? [y/n]: y

To get Letsencrypt SSL certificate, you must already have updated intended
domain vhost name's DNS A record to this server's IP addresss.
If top level domain, DNS A record is needed also for www. version of domain
otherwise, Letsencrypt domain name validation will fail.


sub.domain.com is not a top level domain
your server IP address: SERVERIPADDR
current DNS A record IP address for sub.domain.com is: SERVERIPADDR

Abort this Nginx vhost domain setup to setup proper DNS A record(s) first? [y/n]: n
Obtain Letsencrypt Free SSL certificate (90 day expiry / renew every 80 days) ? [y/n]: y

Code:

installing or updating simple shell based le client

Initialized empty Git repository in /root/tools/le/.git/
Installing to /root/.le
Installing cron job
0 0 * * *  WORKING_DIR="/root/.le" "/root/.le"/le.sh cron > /dev/null
OK
/usr/local/bin/le
https://github.com/Neilpang/le
v1.1.2
Usage: le.sh  [command] ...[args]....
Avalible commands:

install:
  Install le.sh to your system.
issue:
  Issue a cert.
installcert:
  Install the issued cert to apache/nginx or any other server.
renew:
  Renew a cert.
renewAll:
  Renew all the certs.
uninstall:
  Uninstall le.sh, and uninstall the cron job.
version:
  Show version info.
installcronjob:
  Install the cron job to renew certs, you don't need to call this. The 'install' command can automatically install the cron job.
uninstallcronjob:
  Uninstall the cron job. The 'uninstall' command can do this automatically.
createAccountKey:
  Create an account private key, professional use.
createDomainKey:
  Create an domain private key, professional use.
createCSR:
  Create CSR , professional use.

----------------------------------------------------
simple shell based le client is installed at:
/usr/local/bin/le.sh
Symlinked to:
/usr/local/bin/le
----------------------------------------------------

Code:

obtaining Letsencrypt SSL certificate via simple shell le webroot authentication...

STAGE=1 FORCE=1 /usr/local/bin/le issue /home/nginx/domains/sub.domain.com/public sub.domain.com no 2048
Using stage api:https://acme-staging.api.letsencrypt.org
Creating account key
Account key exists, skip
Creating domain key
Generating RSA private key, 2048 bit long modulus
.................................................................+++
.......................................................+++
e is 65537 (0x10001)
Creating csr
Single domain=sub.domain.com
Registering account
Already registered
Verify each domain
Geting token for domain=sub.domain.com
Verifying:sub.domain.com
Success
Verify finished, start to sign.
Cert success.
-----BEGIN CERTIFICATE-----
MpKYiYGCUqw3EA==
-----END CERTIFICATE-----
Your cert is in /root/.le/sub.domain.com/sub.domain.com.cer
The intermediate CA cert is in /root/.le/sub.domain.com/ca.cer

Code:

total 28K
drwxr-xr-x 2 root root 4.0K Jan 31 08:11 .
drwxr-xr-x 5 root root 4.0K Jan 31 08:11 ..
-rw-r--r-- 1 root root 1.1K Jan 31 08:11 ca.cer
-rw-r--r-- 1 root root 1.8K Jan 31 08:11 sub.domain.com.cer
-rw-r--r-- 1 root root  538 Jan 31 08:11 sub.domain.com.conf
-rw-r--r-- 1 root root  903 Jan 31 08:11 sub.domain.com.csr
-rw-r--r-- 1 root root 1.7K Jan 31 08:11 sub.domain.com.key

-rw-r--r-- 1 root root 2.9K Jan 31 08:11 /root/.le/sub.domain.com/sub.domain.com-unified.crt

Code:

-------------------------------------------------------------
vhost for sub.domain.com created successfully

domain: http://sub.domain.com
vhost conf file for sub.domain.com created: /usr/local/nginx/conf/conf.d/sub.domain.com.conf

vhost ssl for sub.domain.com created successfully

domain: https://sub.domain.com
vhost ssl conf file for sub.domain.com created: /usr/local/nginx/conf/conf.d/sub.domain.com.ssl.conf
/usr/local/nginx/conf/ssl_include.conf created
Self-signed SSL Certificate: /usr/local/nginx/conf/ssl/sub.domain.com/sub.domain.com.crt
SSL Private Key: /usr/local/nginx/conf/ssl/sub.domain.com/sub.domain.com.key
SSL CSR File: /usr/local/nginx/conf/ssl/sub.domain.com/sub.domain.com.csr
Backup SSL Private Key: /usr/local/nginx/conf/ssl/sub.domain.com/sub.domain.com-backup.key
Backup SSL CSR File: /usr/local/nginx/conf/ssl/sub.domain.com/sub.domain.com-backup.csr

Letsencrypt SSL Certificate: /root/.le/sub.domain.com/sub.domain.com.cer
Letsencrypt SSL Certificate Private Key: /root/.le/sub.domain.com/sub.domain.com.key
Letsencrypt SSL Certificate CSR: /root/.le/sub.domain.com/sub.domain.com.csr
Letsencrypt SSL Certificate Full Chain: /root/.le/sub.domain.com/sub.domain.com-unified.pem
Letsencrypt SSL simple shell le config: /root/.le/sub.domain.com/sub.domain.com.conf

upload files to /home/nginx/domains/sub.domain.com/public
vhost log files directory is /home/nginx/domains/sub.domain.com/log
-------------------------------------------------------------

Edit: revised a few things in the integration code with Jan 31-Feb 1, 2016 commits Commits · centminmod/centminmod · GitHub