185 lines
5.5 KiB
Markdown
185 lines
5.5 KiB
Markdown
# letsencrypt-cli (for node.js)
|
|
|
|
CLI for node-letsencrypt modeled after the official client.
|
|
|
|
* Free SSL Certificates
|
|
* 90-day certificate lifetime
|
|
* One-off standalone registration / renewal
|
|
* On-the-fly registration / renewal via webroot
|
|
|
|
## Install Node
|
|
|
|
For **Windows**:
|
|
|
|
Choose **Stable** from <https://nodejs.org/en/>
|
|
|
|
For Linux and **OS X**:
|
|
|
|
```
|
|
curl -L bit.ly/iojs-min | bash
|
|
```
|
|
|
|
# Install LetsEncrypt
|
|
|
|
```bash
|
|
npm install -g letsencrypt-cli
|
|
```
|
|
|
|
## Usage
|
|
|
|
These commands are shown using the **testing server**.
|
|
|
|
Want to use the **live server**?
|
|
|
|
1. remove the `--server https://acme-staging.api.letsencrypt.org/directory`
|
|
2. or change it to `--server https://acme-v01.api.letsencrypt.org/directory`
|
|
|
|
**Note**: This has really only been tested with single domains so if
|
|
multiple domains doesn't work for you, file a bug.
|
|
|
|
### Standalone
|
|
|
|
You can run standalone mode to get a cert **on the server** you will be
|
|
using it for over ports 80 and 443 (or 5001) like so:
|
|
|
|
```bash
|
|
letsencrypt certonly \
|
|
--agree-tos --email john.doe@example.com \
|
|
--standalone \
|
|
--domains example.com,www.example.com \
|
|
--server https://acme-staging.api.letsencrypt.org/directory \
|
|
--config-dir ~/letsencrypt/etc
|
|
```
|
|
|
|
Then you can see your certs at `~/letsencrypt/etc/live`.
|
|
|
|
```
|
|
ls ~/letsencrypt/etc/live
|
|
```
|
|
|
|
This option is great for testing, but since it requires the use of
|
|
the same ports that your webserver needs, it isn't a good choice
|
|
for production.
|
|
|
|
### WebRoot (for production)
|
|
|
|
You can specify the path to where you keep your `index.html` with `webroot`.
|
|
|
|
For example, if I want to get a domain for `example.com` and my `index.html` is
|
|
at `/srv/www/example.com`, then I would use this command:
|
|
|
|
```bash
|
|
sudo letsencrypt certonly \
|
|
--agree-tos --email john.doe@example.com \
|
|
--webroot --webroot-path /srv/www/example.com \
|
|
--config-dir /etc/letsencrypt \
|
|
--domains example.com,www.example.com \
|
|
--server https://acme-staging.api.letsencrypt.org/directory
|
|
```
|
|
|
|
Note that we use `sudo` because in this example we are using `/etc/letsencrypt`
|
|
as the cert directory rather than `~/letsencrypt/etc`, which we used in the previous example.
|
|
|
|
Then see your brand new shiny certs:
|
|
|
|
```
|
|
ls /etc/letsencrypt/live/
|
|
```
|
|
|
|
You can use a cron job to run the script above every 80 days (the certificates expire after 90 days)
|
|
so that you always have fresh certificates.
|
|
|
|
## Test with a free domain
|
|
|
|
```bash
|
|
# Install Daplie DNS
|
|
npm install -g ddns-cli
|
|
|
|
# see terms of use
|
|
ddns --help
|
|
|
|
# agree to terms and get domain
|
|
ddns --random --email user@example.com --agree
|
|
|
|
# the default is to use the ip address from which
|
|
# you can the command, but you can also assign the
|
|
# ip manually
|
|
ddns --random --email user@example.com --agree -a '127.0.0.1'
|
|
```
|
|
|
|
Example domain:
|
|
|
|
```
|
|
rubber-duck-42.daplie.me
|
|
```
|
|
|
|
## Run without Root
|
|
|
|
If you'd like to allow node.js to use privileged ports `80` and `443`
|
|
(and everything under 1024 really) without being run as `root` or `sudo`,
|
|
you can use `setcap` to do so. (it may need to be run any time you reinstall node as well)
|
|
|
|
```bash
|
|
sudo setcap cap_net_bind_service=+ep /usr/local/bin/node
|
|
```
|
|
|
|
By default `node-letsencrypt` assumes your home directory `~/letsencrypt/`, but if
|
|
you really want to use `/etc/letsencrypt`, `/var/lib/letsencrypt/`, and `/var/log/letsencrypt`
|
|
you could change the permissions on them. **Probably a BAD IDEA**. Probabry a security risk.
|
|
|
|
```
|
|
# PROBABLY A BAD IDEA
|
|
sudo chown -R $(whoami) /etc/letsencrypt /var/lib/letsencrypt /var/log/letsencrypt
|
|
```
|
|
|
|
## Command line Options
|
|
|
|
```
|
|
Usage:
|
|
letsencrypt [OPTIONS] [ARGS]
|
|
|
|
Options:
|
|
--email EMAIL Email used for registration and recovery contact. (default: null)
|
|
|
|
--domains URL Domain names to apply. For multiple domains you can enter a comma
|
|
separated list of domains as a parameter. (default: [])
|
|
|
|
--duplicate BOOLEAN Allow getting a certificate that duplicates an existing one
|
|
|
|
--agree-tos BOOLEAN Agree to the Let's Encrypt Subscriber Agreement
|
|
|
|
--debug BOOLEAN show traces and logs
|
|
|
|
--tls-sni-01-port NUMBER Port number to perform tls-sni-01 challenge.
|
|
Boulder in testing mode defaults to 5001. (default: 443 and 5001)
|
|
|
|
--http-01-port [NUMBER] Port used in the SimpleHttp challenge. (Default is 80)
|
|
|
|
--rsa-key-size [NUMBER] Size (in bits) of the RSA key. (Default is 2048)
|
|
|
|
--cert-path STRING Path to where new cert.pem is saved
|
|
(Default is :conf/live/:hostname/cert.pem)
|
|
|
|
--fullchain-path [STRING] Path to where new fullchain.pem (cert + chain) is saved
|
|
(Default is :conf/live/:hostname/fullchain.pem)
|
|
|
|
--chain-path [STRING] Path to where new chain.pem is saved
|
|
(Default is :conf/live/:hostname/chain.pem)
|
|
|
|
--domain-key-path STRING Path to privkey.pem to use for domain (default: generate new)
|
|
|
|
--config-dir STRING Configuration directory. (Default is ~/letsencrypt/etc/)
|
|
|
|
--server [STRING] ACME Directory Resource URI. (Default is https://acme-v01.api.letsencrypt.org/directory))
|
|
|
|
--standalone [BOOLEAN] Obtain certs using a "standalone" webserver. (Default is true)
|
|
|
|
--webroot BOOLEAN Obtain certs by placing files in a webroot directory.
|
|
|
|
--webroot-path STRING public_html / webroot path.
|
|
|
|
-h, --help Display help and usage details
|
|
```
|
|
|
|
Note: some of the options may not be fully implemented. If you encounter a problem, please report a bug on the issues page.
|