Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

updates for proper CA chaining (i.e. lighttpd actually presents the i… #14

Open
wants to merge 2 commits into
base: master
Choose a base branch
from
Open

updates for proper CA chaining (i.e. lighttpd actually presents the i… #14

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
97579a9
updates for proper CA chaining (i.e. lighttpd actually presents the i…
bdwilson Nov 28, 2021
6fd92a1
remove force option
bdwilson Nov 28, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,6 +59,13 @@ If the update *fails* and you need to restart the web server:
sudo /usr/sbin/lighttpd -f /etc/lighttpd/lighttpd.conf
```

<b>If your EdgeOS has outdated Let's Encrypt certificates, you'll need to also update these manually:</b>
```
sudo sed -i 's|^mozilla\/DST_Root_CA_X3\.crt|!mozilla/DST_Root_CA_X3.crt|' /etc/ca-certificates.conf
sudo curl -sk https://letsencrypt.org/certs/isrgrootx1.pem -o /usr/local/share/ca-certificates/ISRG_Root_X1.crt
sudo update-ca-certificates --fresh
```

## Configure router

1. Set domain pointing to router internal IP address
Expand All @@ -80,6 +87,7 @@ sudo /usr/sbin/lighttpd -f /etc/lighttpd/lighttpd.conf

```
set service gui cert-file /config/ssl/server.pem
set service gui ca-file /config/ssl/ca.pem
```

4. Commit and save your configuration
Expand Down
5 changes: 3 additions & 2 deletions reload.acme.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
#!/bin/sh

mkdir -p /config/ssl
cat /tmp/server.key /tmp/full.cer > /config/ssl/server.pem
rm /tmp/server.key /tmp/full.cer
cat /tmp/key.pem /tmp/cert.pem > /config/ssl/server.pem
cp /tmp/fullchain.pem /config/ssl/ca.pem
rm /tmp/key.pem /tmp/cert.pem /tmp/fullchain.pem
6 changes: 3 additions & 3 deletions renew.acme.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -73,9 +73,9 @@ if [ -e "/var/run/lighttpd.pid" ]; then
fi

log "Executing acme.sh."
$ACMEHOME/acme.sh --issue $DNSARG $DOMAINARG --home $ACMEHOME \
--keylength ec-384 --keypath /tmp/server.key --fullchainpath /tmp/full.cer \
--log /var/log/acme.log \
$ACMEHOME/acme.sh --issue $DNSARG $DOMAINARG --home $ACMEHOME --server letsencrypt \
--keylength ec-384 --keypath /tmp/key.pem --certpath /tmp/cert.pem \
--fullchainpath /tmp/fullchain.pem --log /var/log/acme.log \
--reloadcmd /config/scripts/reload.acme.sh \
$INSECURE_FLAG $VERBOSE_FLAG $@

Expand Down