Notes to Self on Renewing Wildcard Letsencrypt Certs Manually With Lego

feedback@janusworx.com (Mario Jason Braganza) — Fri, 31 May 2024 11:12:17 +0530

I want to someday, automate all my domain certificate renewals.
Namecheap doesn’t support it, ergo my move to Porkbun.
And certbot doesn’t support Porkbun, so I’ve moved to Lego.

I still need to someday figure out how to do this automatically, but for now, since all is in place, this is the new manual process.

You’ll need to generate a Porkbun API key along with its associated secret, and store it somewhere safe and secure. (This is a one time thing, the Generating API keys section here describes how)
Another one time step is to get Lego installed and have it generate your certs, and then have your applications, point to where they are.
Command to renew: PORKBUN_SECRET_API_KEY="your-api-*secret*" PORKBUN_API_KEY="your-porkbun-api-key" ./lego --domains your-domain.tld --domains *.domain.tld --email your-email@domain --dns porkbun renew
And the renewal’s done!
Restart yer engines … err your applications¹ et voilà!
If you have multiple machines, figure out a way to securely transfer the certs there too.

Feedback on this post? Mail me at feedback at this domain

P.S. Subscribe to my mailing list!
Forward these posts and letters to your friends and get them to subscribe!
P.P.S. Feed my insatiable reading habit.

in my case Nginx ↩︎

Notes to Self on Renewing Wildcard Certbot Certs

feedback@janusworx.com (Mario Jason Braganza) — Sat, 20 Aug 2022 11:45:54 +0530

(Update, 2024-03-15: I now use lego. will update this post later.)

After struggling to renew my certs for the third time in a row, hopefully these pointers should keep me on track for the next time.

Namecheap does not yet support automatic wildcard renewal for the Letsencrypt/Certbot combo. Check next year.
Have your Namecheap control panel open and ready.
Switch to root or run the command below with sudo
Command to renew: certbot certonly --manual --manual-public-ip-logging-ok --preferred-challenges dns-01 -d *.domain.com -d domain.com
certbot will then, print a couple of lines that you need to add as a TXT record in the Namecheap DNS control panel.
When you do that, make sure you set the TTL of the record, to a minute, so that you can redo stuff quicker, if you mess up.
certbot might ask you to do multiple records. Read the instructions carefully.
When you check to see if the TXT record is set, search for the whole domain name. For e.g. _acme-challenge.domain.blah instead of just domain.blah
If you’ve done all of the above, hopefully things should go smoothly and the certificate should renew.
Restart Nginx and you’re done.
If you have multiple machines, figure out a way to securely transfer the certs there too.

Certbot on Janusworx

Notes to Self on Renewing Wildcard Letsencrypt Certs Manually With Lego

Notes to Self on Renewing Wildcard Certbot Certs