Search for a command to run...
I'm a technology enthusiast with a passion for software development and emerging tech. I strive to integrate new technologies into my projects to create innovative solutions. Beyond my professional interests, I'm also an avid photographer, capturing scenes from around the world, which allows me to express a different form of creativity.
No comments yet. Be the first to comment.
The original version of TerminalNexus depended on Windows Terminal being installed. It worked, but it meant every setup was slightly different. Corporate machines with WT blocked. Different WT version
I am not affiliated with any of the applications mentioned in this post. I have chosen to discuss them solely based on my positive experiences and the benefits they have offered in my personal tech projects. No, I am not talking about a server rack i...
After working with CLI commands including Git, Linux, WSL and even Windows, I realized it was impossible to keep track of them all across notes tools. Not to mention that copy and paste was getting tiresome. Besides replacing parameters proved to be ...
CommandGit Journey For a number of years, I have been working as a software engineer and have always been interested in developer tools that make my job easier. During my free time, I have created several free automation applications and utilities, a...
Wildcard certificates are highly beneficial because they secure all subdomains of your main domain with a single certificate. This simplifies domain management by eliminating the need to handle individual certificates for each subdomain.
I chose the DNS-01 challenge for validation for my homelab setup because my Internet Service Provider (ISP) blocks port 80, which is necessary for the HTTP-01 challenge. If your ISP imposes similar restrictions, the DNS-01 challenge might be your best option for obtaining an SSL certificate from Let's Encrypt.
First, I created a directory to store the Let's Encrypt logs:
sudo mkdir /var/log/letsencrypt/
Then, I installed Certbot, which simplifies the SSL certificate issuance and management process:
sudo apt install certbot
To initiate the certificate request, I ran the following command:
certbot certonly --manual
During this setup, Certbot prompted me for an email address for important notifications and to agree to the Let's Encrypt Terms of Service.
youremail@example.com
Once that was done, I entered my domain name in the following format to request a wildcard certificate:
*.yourdomain.com
For the DNS-01 challenge, Certbot provided me with a specific TXT record that needed to be added to my domain's DNS settings under the name:
_acme-challenge
The record value looked something like this:
o7mU8KwvI7A1_phmxzrHOIA9jaGSOjkI-ngCRbSdhpc
It's crucial NOT to proceed with the SSL setup until this TXT record has fully propagated across DNS servers worldwide. Depending on your DNS provider, this propagation process can take anywhere from a few minutes to an hour. If you proceed too early, you will have to repeat this process.
To check if the record has propagated, you can use online tools like the Google Admin Toolbox.
Search for your TXT record under _acme-challenge.yourdomain.com and verify that the record's value matches what you added.
Use this command to test for it propagated:
dig -t txt _acme-challenge.yourdomain.com
Output of this command:
;; ANSWER SECTION:
_acme-challenge.yourdomain.com. 0 IN TXT "AxSzdAxR3yyJYok3KkuIRwod82Ld5MhYuH4oJ8"
sudo crontab -e
--post-hook option with Certbot, it ensures that the specified command, such as restarting or reloading Nginx, only runs after a successful renewal of the certificate. This is a safeguard to prevent service disruptions in case the renewal process encounters an issue.certbot renew --quiet --post-hook "systemctl reload nginx"
Dealing with an ISP that blocks port 80 can make securing your website with an SSL certificate a bit tricky. The DNS-01 challenge comes to the rescue, providing a workaround for this hiccup. Just follow these steps, and you'll be able to get and handle an SSL certificate from Let's Encrypt without the need for port 80.