내용은 해당 내용을 바탕으로 적었습니다.
Synology에서 Wildcard SSL 인증서 자동 갱신하기
certbot과 cloudflare를 이용한 Synology Wildcard SSL 인증서를 발급 받고 자동으로 갱신하는 방법
velog.io
해당 링크내용에 모든 내용이 다 적혀있으나 없는 부분이 있어 작성함.
#!/bin/bash
CONTAINER_NAME=certbot
docker run -it --rm \
--pull=always \
--name="${CONTAINER_NAME}" \
-e "TZ=Asia/Seoul" \
-v '/volume1/docker/ssl/etc:/etc/letsencrypt' \
-v '/volume1/docker/ssl/var:/var/lib/letsencrypt' \
certbot/certbot certonly \
-d 'example.com' \
-d '*.example.com' \
--manual \
--preferred-challenges dns \
--server https://acme-v02.api.letsencrypt.org/directory
질답형 부분
If you really want to skip this, you can run the client with
--register-unsafely-without-email but you will then be unable to receive notice
about impending expiration or revocation of your certificates or problems with
your Certbot installation that will lead to failure to renew.
Enter email address (used for urgent renewal and security notices)
(Enter 'c' to cancel): 이메일 주소 입력
Please read the Terms of Service at
https://letsencrypt.org/documents/LE-SA-v1.4-April-3-2024.pdf. You must agree in
order to register with the ACME server. Do you agree?
Yes/No :
Would you be willing, once your first certificate is successfully issued, to
share your email address with the Electronic Frontier Foundation, a founding
partner of the Let's Encrypt project and the non-profit organization that
develops Certbot? We'd like to send you email about our work encrypting the web,
EFF news, campaigns, and ways to support digital freedom.
Yes/No :
Account registered.
Requesting a certificate for example.com and *.example.com
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Please deploy a DNS TXT record under the name:
_acme-challenge.example.com
위 도메인을 다 적는게 아니다. TXT 레코드에 _acme-challenge만 추가하여 적용한다.
with the following value:
tvKKEbkX_I-z8Q_RwWnKyfVE-q8vd72p2uM8QlRERfw
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Press Enter to Continue --- 여기서 해당 내용을 DNS(도메인 구매한곳에 등록해줘야한다. 해당 내용이 등록한 후 바로 엔터를 치면 안된다.)
https://dnschecker.org/
DNS Checker - DNS Check Propagation Tool
Check DNS Propagation worldwide. DNS Checker provides name server propagation check instantly. Changed nameservers so do a DNS lookup and check if DNS and nameservers have propagated.
dnschecker.org
해당 사이트에서 해당 주소를 입력하여 적용되었는지 확인후 enter 진행.
리눅스/맥
dig TXT _acme-challenge.example.com
윈도우
nslookup -type=TXT _acme-challenge.example.com
응답값에 이런 내용이 나와야한다.
_acme-challenge.example.com. 300 IN TXT "아까 넣은 value값"
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Please deploy a DNS TXT record under the name:
_acme-challenge.example.com
with the following value:
EHTmO_QqBd9oe-QdQjzEwbj3v6oB2nppqa2cuwIusDk
(This must be set up in addition to the previous challenges; do not remove,
replace, or undo the previous challenge tasks yet. Note that you might be
asked to create multiple distinct TXT records with the same name. This is
permitted by DNS standards.)
Before continuing, verify the TXT record has been deployed. Depending on the DNS
provider, this may take some time, from a few seconds to multiple minutes. You can
check if it has finished deploying with aid of online tools, such as the Google
Admin Toolbox: https://toolbox.googleapps.com/apps/dig/#TXT/_acme-challenge.example.com
Look for one or more bolded line(s) below the line ';ANSWER'. It should show the
value(s) you've just added.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Press Enter to Continue ----- 만약 위에서 엔터를 쳤을 경우 해당 내용을 한번 더 추가한다.
그리고 그냥 칠경우
아래와 같다.
Certbot failed to authenticate some domains (authenticator: manual). The Certificate Authority reported these problems:
Domain: example.com
Type: unauthorized
Detail: No TXT record found at _acme-challenge.example.com
Domain: example.com
Type: unauthorized
Detail: No TXT record found at _acme-challenge.example.com
Hint: The Certificate Authority failed to verify the manually created DNS TXT records. Ensure that you created these in the correct location, or try waiting longer for DNS propagation on the next attempt.
Some challenges have failed.
Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details.
실패한 내용...이고,
성공했을 경우
Successfully received certificate.
Certificate is saved at: /etc/letsencrypt/live/example.com/fullchain.pem
Key is saved at: /etc/letsencrypt/live/kexample.com/privkey.pem
This certificate expires on 2025-04-19.
These files will be updated when the certificate renews.
NEXT STEPS:
- This certificate will not be renewed automatically. Autorenewal of --manual certificates requires the use of an authentication hook script (--manual-auth-hook) but one was not provided. To renew this certificate, repeat this same certbot command before the certificate's expiry date.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
If you like Certbot, please consider supporting our work by:
* Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate
* Donating to EFF: https://eff.org/donate-le
이렇게 출력됩니다.