YunoHost/doc
1
0
Fork 0
mirror of https://github.com/YunoHost/doc.git synced 2024-09-03 20:06:26 +02:00
Code Issues Projects Releases Packages Wiki Activity

Translate to english

Browse source
This commit is contained in:
Alexandre Aubin 2017-07-30 01:13:28 +02:00
parent 43182abac4
commit 316ed3dc1f
2 changed files with 66 additions and 92 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

156
certificate.md
View file

@ -13,109 +13,83 @@ It could afraid a lot of users (rightly).
To avoid this confusion, it's possible to get a signed certificate by a "known" authority : **Gandi**, **RapidSSL**, **StartSSL**, **CaCert**.
In these cases, the point is to replace the self-signed certificate with the one that has been certified by a certificate authority, and the users won't have this warning screen anymore.
### Add a signed certificate by an authority
To avoid this confusion, it's possible to get a certificate signed a known
authority named **Let's Encrypt** which provide free certificates directly
recognized by browsers. YunoHost allows to directly install this certificate
from the web administration interface or from the command line.
Get your certificate from your CA, you must get a private key, file key and a public certificate (file .crt)
> Be carefull, the key file is very critical, it's strictly personal and have to be secured.
### Install a Let's Encrypt certificate
Copy this two files on the server, if not.
Before attempting to install a Let's Encrypt certificate, you should make sure
that your DNS is correctly configured (votre.domaine.tld should point to
your server's IP) and that your domain is accessible though HTTP from outside
your local network (i.e. at least port 80 should be forwarded to your server).
```bash
scp CERTIFICAT.crt admin@DOMAIN.TLD:ssl.crt
scp CLE.key admin@DOMAIN.TLD:ssl.key
#### From the web administration interface
Go to the 'Domain' part of the admin interface, then in the section dedicated to
your.domain.tld. You should find a 'SSL certificate' button :
![](./images/domain-certificate-button.png)
In the 'SSL certificate' section, you can see the status of the current
certificate. If you just added the domain, it should be a self-signed
certificate.
![](./images/certificate-before-LE.png)
If your domain is correctly configured, it is then possible to install the
Let's Encrypt certificate via the green button.
![](./images/certificate-after-LE.png)
Once the install is made, you can check that the certificate is live via your
browser by going to your domain in HTTPS. The certificate will automatically
be renewed every three months.
![](./images/certificate-signed-by-LE.png)
#### From the command line interface
Connect to your server through SSH.
You can check the status of your current certificate with :
```
yunohost domain cert-status your.domain.tld
```
From Windows, scp can be used with putty, download [pscp](http://the.earth.li/~sgtatham/putty/latest/x86/pscp.exe)
Install a Let's Encrypt certificate with
```bash
pscp -P 22 CERTIFICAT.crt admin@DOMAIN.TLD:ssl.crt
pscp -P 22 CLE.key admin@DOMAIN.TLD:ssl.key```
```
yunohost domain cert-install your.domain.tld
```
Now the files are in the server. Open a shell on the server use [ssh](https://yunohost.org/#/ssh_fr) or locally.
This should return :
First, create a directory for archive the certificates.
```
Success! The SSOwat configuration has been generated
Success! Successfully installed Let's Encrypt certificate for domain DOMAIN.TLD!
```
```bash
sudo mkdir /etc/yunohost/certs/DOMAIN.TLD/ae_certs
sudo mv ssl.key ssl.crt /etc/yunohost/certs/DOMAIN.TLD/ae_certs/```
Once this is done, you can check that the certificate is live via your
browser by going to your domain in HTTPS. The certificate will automatically
be renewed every three months.
Then go to the parent directory and go on.
##### Troubleshooting
```bash
cd /etc/yunohost/certs/DOMAIN.TLD/```
If due to some bad tweaking, your certificate ends up in a bad state (e.g.
lost the certificate or unable to read the files), you should be able to clean
the situation by regenerating a self-signed certificate :
Make a backup of the YunoHost original certificates , to be safe!
```
yunohost domain cert-install your.domain.tld --self-signed --force
```
```bash
sudo mkdir yunohost_self_signed
sudo mv *.pem *.cnf yunohost_self_signed/```
If YunoHost thinks that your domain is badly configured despite the fact that
you checked the DNS configuration and you have access in HTTP to your server
from outside your local network, then you can :
Depends on the CA, intermediate certificates and root have to be downloaded.
> **StartSSL**
> ```bash
> sudo wget http://www.startssl.com/certs/ca.pem -O ae_certs/ca.pem
> sudo wget http://www.startssl.com/certs/sub.class1.server.ca.pem -O ae_certs/intermediate_ca.pem```
> **Gandi**
> ```bash
> sudo wget https://www.gandi.net/static/CAs/GandiStandardSSLCA.pem -O ae_certs/intermediate_ca.pem```
> **RapidSSL**
> ```bash
> sudo wget https://knowledge.rapidssl.com/library/VERISIGN/INTERNATIONAL_AFFILIATES/RapidSSL/AR1548/RapidSSLCABundle.txt -O ae_certs/intermediate_ca.pem```
> **Cacert**
> ```bash
> sudo wget http://www.cacert.org/certs/root.crt -O ae_certs/ca.pem
> sudo wget http://www.cacert.org/certs/class3.crt -O ae_certs/intermediate_ca.pem```
Intermediate certificates and root must be merged with certificates obtained to create a unified chain certificates.
```bash
cat ae_certs/ssl.crt ae_certs/intermediate_ca.pem ae_certs/ca.pem | sudo tee crt.pem```
The private key have to be converted in PEM format.
```bash
sudo openssl rsa -in ae_certs/ssl.key -out key.pem -outform PEM```
Check certificates syntaxe, check file contents.
```bash
cat crt.pem key.pem```
Certificates and private key look like this :
`-----BEGIN CERTIFICATE-----`
`MIICVDCCAb0CAQEwDQYJKoZIhvcNAQEEBQAwdDELMAkGA1UEBhMCRlIxFTATBgNV`
`BAgTDENvcnNlIGR1IFN1ZDEQMA4GA1UEBxMHQWphY2NpbzEMMAoGA1UEChMDTExC`
`MREwDwYDVQQLEwhCVFMgSU5GTzEbMBkGA1UEAxMSc2VydmV1ci5idHNpbmZvLmZy`
`MB4XDTA0MDIwODE2MjQyNloXDTA0MDMwOTE2MjQyNlowcTELMAkGA1UEBhMCRlIx`
`FTATBgNVBAgTDENvcnNlIGR1IFN1ZDEQMA4GA1UEBxMHQWphY2NpbzEMMAoGA1UE`
`ChMDTExCMREwDwYDVQQLEwhCVFMgSU5GTzEYMBYGA1UEAxMPcHJvZi5idHNpbmZv`
`LmZyMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDSUagxPSv3LtgDV5sygt12`
`kSbN/NWP0QUiPlksOkF2NkPfwW/mf55dD1hSndlOM/5kLbSBo5ieE3TgikF0Iktj`
`BWm5xSqewM5QDYzXFt031DrPX63Fvo+tCKTQoVItdEuJPMahVsXnDyYHeUURRWLW`
`wc0BzEgFZGGw7wiMF6wt5QIDAQABMA0GCSqGSIb3DQEBBAUAA4GBALD640iwKPMf`
`pqdYtfvmLnA7CiEuao60i/pzVJE2LIXXXbwYjNAM+7Lov+dFT+b5FcOUGqLymSG3`
`kSK6OOauBHItgiGI7C87u4EJaHDvGIUxHxQQGsUM0SCIIVGK7Lwm+8e9I2X0G2GP`
`9t/rrbdGzXXOCl3up99naL5XAzCIp6r5`
`-----END CERTIFICATE-----`
At last, secure files of your certificate
```bash
sudo chown root:metronome crt.pem key.pem
sudo chmod 640 crt.pem key.pem
sudo chown root:root -R ae_certs
sudo chmod 600 -R ae_certs```
Reload Nginx configuration to take into account the new certificate.
```bash
sudo service nginx reload```
Your certificate is ready to serve. You can check that every thing is correct byan external service like <a href="https://www.geocerts.com/ssl_checker" target="_blank">geocerts</a>
- add a line `127.0.0.1 your.domain.tld` to the file `/etc/hosts` on your server ;
- if the certificate installation still doesn't work, you can disable the checks with `--no-checks` after the `cert-install` command.

2
certificate_fr.md
View file

@ -47,7 +47,7 @@ trois mois environ.
![](./images/certificate-signed-by-LE.png)
#### Ajout d’un certificat Let's Encrypt via l'interface d'administration
#### Via la ligne de commande
Connectez-vous sur votre serveur en SSH.