Let's Encrypt Ssl Using Webroot Authenticator
January 11, 2018tls-sni challenge disabled
If you try to obtain SSL using sudo certbot --nginx -d mydomain.com -d www.mydomain.com, you might bump into the following error due to tls-sni challenge disabled.
Client with the currently selected authenticator does not support any combination of challenges that will satisfy the CA.
NOTE: The above problem can be solved by Upgrading Cerbot to 0.21.1.
Alternatively, you can setup ssl for nginx using --authenticator webroot.
First, setup nginx to handle /.well-known/acme-challenge/* request.
Multiple domains can share their acme-challenge in the same location, either in /usr/share/nginx/letsencrypt or /var/www/letsencrypt.
server {
...
location /.well-known/acme-challenge/ {
root /usr/share/nginx/letsencrypt;
}
}Restart nginx.
sudo service nginx restartExecute certbot to use --authenticator webroot.
sudo certbot --authenticator webroot --webroot-path /usr/share/nginx/letsencrypt -d www.mydomain.comNote: the authenticator will create authentication files at /usr/share/nginx/letsencrypt/.well-known/acme-challenge/* and access http://www.mydomain.com/.well-known/acme-challenge/* to retrieve such file for authentication.
Note: /usr/share/nginx/letsencrypt/.well-known/acme-challenge/ is deleted automatically after authentication, whether success or fail.
- android
- android-ktx
- android-studio
- bootstrap
- coding-interview
- coroutines
- crashlytics
- css
- dagger2
- datastore
- eslint
- firebase
- firestore
- flask
- fontawesome
- git
- glide
- google-app-engine
- google-drive
- google-maps
- google-places
- google-play
- hugo
- java
- java-time
- javascript
- kotlin
- lets-encrypt
- linux
- markdown
- moshi
- nginx
- npm
- pip
- python
- room
- rxjava
- selenium
- ssl
- static-site-generator
- sublime-text
- ubuntu
- unit-test
- uwsgi
- vue-cli
- vuejs
- web-development
- web-hosting
- webpack
- windows
- workmanager