Following the procedure now in the wiki (I made a few edits), it worked perfectly for me. ssllabs.com test shows the new cert and chain, and rates my server as A-. The renewal script also runs without issues, and without requiring any input.
Edit: The letsencrypt client docs say that the EPEL repository must be enabled for CentOS6. I did not find this to be the case. Although I have that repo installed on my server, it is disabled, and I did not enable it when I ran letsencrypt-auto.
So the next matter is setting up the automatic renewal. RequestedDeletion linked to the cron manager contrib, which I wasn't aware of, and which would make editing cron jobs a bit easier, but I don't see any way with that to set a job to run every other month, which would be plenty frequent for certificate renewal. I'd think the cron entry for root should look something like
48 22 3 */2 * /opt/letsencrypt-renew.sh
where letsencrypt-renew.sh is the script that flep posted. This is set to run at 22:48 on the third of every other month (Feb, Apr, Jun, etc.), which will renew the cert well before it expires in 90 days. I've chosen that time of day because my daily backup runs at 23:00, so this would make sure the new cert is in that day's backup rather than waiting until the next day's; you'd obviously want to adjust as appropriate for your installation. The third is a randomly-chosen date.
236 Replies
58144 Views