20241014 ◎

Getting a certificate from Let's Encrypt

Challenge Types - Let's Encrypt

When you get a certificate from Let’s Encrypt, our servers validate that you control the domain names in that certificate using “challenges,” as defined by the ACME standard.

HTTP-01 challenge

This is the most common challenge type today.

Let’s Encrypt gives a token to your ACME client, and your ACME client puts a file on your web server at http://<YOUR_DOMAIN>/.well-known/acme-challenge/<TOKEN>. That file contains the token, plus a thumbprint of your account key.

Once your ACME client tells Let’s Encrypt that the file is ready, Let’s Encrypt tries retrieving it (potentially multiple times from multiple vantage points).

If our validation checks get the right responses from your web server, the validation is considered successful and you can go on to issue your certificate. If the validation checks fail, you’ll have to try again with a new certificate.

The HTTP-01 challenge can only be done on port 80. Allowing clients to specify arbitrary ports would make the challenge less secure, and so it is not allowed by the ACME standard.

What happend when I ran certbot renew?

$ pwd
/etc/letsencrypt/renewal
$ cat domain.conf
# renew_before_expiry = 30 days
version = 1.21.0
archive_dir = /etc/letsencrypt/archive/{domain}
cert = /etc/letsencrypt/live/{domain}/cert.pem
privkey = /etc/letsencrypt/live/{domain}/privkey.pem
chain = /etc/letsencrypt/live/{domain}/chain.pem
fullchain = /etc/letsencrypt/live/{domain}/fullchain.pem

# Options used in the renewal process
[renewalparams]
account = 
pref_challs = http-01,
authenticator = standalone
server = https://acme-v02.api.letsencrypt.org/directory

As I can see authenticator = standalone, I did not use NGINX or other server softwares.

User Guide - Certbot 2.11.0 documentation | Standalone

Use standalone mode to obtain a certificate if you don’t want to use (or don’t currently have) existing server software. The standalone plugin does not rely on any other server software running on the machine where you obtain the certificate.

To obtain a certificate using a “standalone” webserver, you can use the standalone plugin by including certonly and --standalone on the command line. This plugin needs to bind to port 80 in order to perform domain validation, so you may need to stop your existing webserver.

This is why I could get a certificate from Let's Encrypt without running NGINX :upside_down_face:

Struggles with NGINX configuration

server {
  listen 80;
  listen [::]:80;
  server_name example.com;
  root /home/mastodon/live/public;
  location /.well-known/acme-challenge/ { allow all; }
  location / { return 301 https://$host$request_uri; }
}

I have this nginx.conf. A file should be created at /home/mastodon/live/.well-known/acme-challenge, and the challenge to download this file should succeed, but it does not.

I consulted with ChatGPT, but could not find out what Imissing. I don't have any friends who are familiar with these sort of network configurations… shoot!

I suddenly remember the days when my mother said family members should help each other, then demanding too much from me while not offering help to myself.

Now, I'm almost done with all my relatives and don't communicate with them, but I feel that I lost my excuses. When I was in a poor (not limited in wealth) family, I could blame my upbringing for my mistakes or misfortune, but now I'm expected to take responsibility for all the outcomes.

I cannot deny that I'm less sad now, but I am still trying to figure out my life.

At least, I'm proud of what I have achieved so far. Even if anyone else did my life, they couldn't have done better than me.

Mac and Cheese 900 Chips 300 Protein snacks 150 Yogurt 150 M&M's 300 Tajin 200

Total 2000 kcal

push-ups, 30 minutes walk, pull-ups

MUST:

TODO:

index 20241013 20241015