7a01793062
* Revert "Revert "markdown format"" * fix formating * fix readme * add .markdownlint.json * add markdownlint-rules-grav-pages * add markdownlint-rules-grav-pages files * add license for Markdown Lint Rules for Grav Pages * fix [figure] mess * fix [figure] mess 2 * fix [figure] mess 3 * maj .gitignore * various fixes * fix markdownlint-rules-grav-pages * second formater pass * various manual fixes * add .markdownlintignore * markdownlintignore: auto-generated pages * disable proper-names for html_elements * another bunch of various markdown fixes * Update pages/02.administer/10.install/20.dns_config/dns_config.es.md Co-authored-by: tituspijean <titus+yunohost@pijean.ovh> --------- Co-authored-by: Alexandre Aubin <4533074+alexAubin@users.noreply.github.com> Co-authored-by: tituspijean <titus+yunohost@pijean.ovh>
3.7 KiB
| title | template | taxonomy | routes | ||||
|---|---|---|---|---|---|---|---|
| Certificate | docs |
|
|
Certificates are used to guarantee the confidentiality and authenticity of the communication between a web browser and your server. In particular, they protect against attackers trying to impersonate your server.
YunoHost provides a self-signed certificate, it means that your server guaranties the certificate validity. It's enough for personal usage, because you trust your own server. But this could be a problem if you want to open access to anonymous like web user for a website.
In practice, visitors will see a screen list this:
Which basically asks the visitor : "Do you trust the server hosting this website?". This can rightfully frighten a lot of people.
To avoid this confusion, it's possible to get a certificate signed a known authority named Let's Encrypt which provide free certificates directly recognized by browsers. YunoHost allows to directly install this certificate from the web administration interface or from the command line.
Install a Let's Encrypt certificate
Before attempting to install a Let's Encrypt certificate, you should make sure that your DNS is correctly configured (your.domain.tld should point to your server's IP) and that your domain is accessible through HTTP from outside your local network (i.e. at least port 80 should be forwarded to your server).
[ui-tabs position="top-left" active="0" theme="lite"] [ui-tab title="From the web interface"]
Go to the 'Domain' part of the admin interface, then in the section dedicated to your.domain.tld. You should find a 'SSL certificate' button:
In the 'SSL certificate' section, you can see the status of the current certificate. If you just added the domain, it should be a self-signed certificate.
If your domain is correctly configured, it is then possible to install the Let's Encrypt certificate via the green button.
Once the install is made, you can check that the certificate is live via your browser by going to your domain in HTTPS. The certificate will automatically be renewed every three months.
[/ui-tab] [ui-tab title="From the command line"]
Connect to your server through SSH.
You can check the status of your current certificate with:
yunohost domain cert-status your.domain.tld
Install a Let's Encrypt certificate with
yunohost domain cert-install your.domain.tld
This should return :
Success! The SSOwat configuration has been generated
Success! Successfully installed Let's Encrypt certificate for domain DOMAIN.TLD!
Once this is done, you can check that the certificate is live via your browser by going to your domain in HTTPS. The certificate will automatically be renewed every three months.
[/ui-tab] [/ui-tabs]
Troubleshooting
If due to some bad tweaking, your certificate ends up in a bad state (e.g. lost the certificate or unable to read the files), you should be able to clean the situation by regenerating a self-signed certificate:
yunohost domain cert-install your.domain.tld --self-signed --force
If YunoHost thinks that your domain is badly configured despite the fact that you checked the DNS configuration and you have access in HTTP to your server from outside your local network, then you can:
- add a line
127.0.0.1 your.domain.tldto the file/etc/hostson your server; - if the certificate installation still doesn't work, you can disable the checks with
--no-checksafter thecert-installcommand.