thurstylark
/
tlwiki
1
0
Fork 0
Code Issues 6 Pull Requests Projects Releases Wiki Activity

Update LetsEncrypt documentation regarding corrected auto-renewal process

This commit is contained in:
David Thurstenson 2017-03-20 18:06:28 -05:00
parent 9791551a77
commit 1fcd48667e
1 changed files with 9 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
LetsEncrypt.wiki
View File

@ -53,6 +53,14 @@ That will get the basic framework ready for your virtualhost definition. Here is
{{{class="prettyprint linenums"
<VirtualHost wiki.thurstylark.com:80>
ServerName wiki.thurstylark.com
DocumentRoot "/srv/wiki/"
<Directory "/srv/wiki/">
AllowOverride None
Options None
Require all granted
</Directory>
# Redirect all except the '.wellk-known' path to https.
# This allows automated renewal of ssl certs by certbot
RedirectMatch permanent ^/(?!\.well-known)(.*) https://wiki.thurstylark.com/$1
@ -79,7 +87,7 @@ That will get the basic framework ready for your virtualhost definition. Here is
A couple things to note here: First, this defines two virtualhosts, one for port 80 and one for port 443. This is in order to redirect _all_ traffic to HTTPS except for a very small exception.
This exception is what you see on line 5 in the code above. Only `*/.well-known/*` is not redirected because this is the dir that certbot uses for domain validation. Certbot will only validate over http, and will fail if given a 301 redirect. This allows validation to complete successfuly without a configuration change, thus aiding our automation efforts. Everything else gets a 301 redirect to HTTPS.
This exception is what you see on line 5 in the code above. Only `*/.well-known/*` is not redirected because this is the dir that certbot uses for domain validation. Certbot will only validate over http, and will fail if given a 301 redirect. This allows validation to complete successfuly without a configuration change, thus aiding our automation efforts. Everything else gets a 301 redirect to HTTPS. Be sure to define `DocumentRoot` with the correct location for *both* VirtualHosts, or certbot will fail to renew things correctly. (found this one out the hard way)
Lines 20-23 configure Apache to look for the necessary files in the right places. The locations listed here are actually symlinks to the real files, which are kept in an archive. These links are maintained by certbot automagically.