Updating my SSL cert

I described how to create SSL certs using acme.sh & Let's Encrypt in a previous post.

I've subsequently updated the cert to use ECC crypto and now want to update it so that the root domain is also included in my wildcard cert.

First remove the current cert:

acme.sh --remove --ecc  -d *.durrant.me.uk

Now issue the new one:

acme.sh --issue --keylength ec-256 -d durrant.me.uk -d *.durrant.me.uk --dns dns_cf

And finally install it:

acme.sh --install-cert --ecc -d durrant.me.uk  --key-file /etc/pki/tls/private/durrant.me.uk.key --cert-file /etc/pki/tls/certs/durrant.me.uk.cer --reloadcmd "sudo systemctl restart httpd.service"

A few notes.

• To use ECC , it's as simple as specifying --keylength ec-256 when requesting it. Make sure to always specify --ecc in issue & install operations to tell acme.sh to use the ECC one otherwise it will default to RSA if you have that cert too.
• For the installation to work make sure the user running acme.sh has sudo privilege to restart the web server and permissions to write to the cert & key file. (chown acme does it for me)

Useful commands to check SSL certs

Here's some useful stuff to examine SSL certs.
I've pulled some of this from here

Check a key

• openssl rsa -in key.file -check
• openssl ec -in key.file (For an EC cert)

Check a cert

• openssl x509 -in cert.file -text -noout

 Test an SSL connection

• openssl s_client -connect some.site.com:443
• openssl s_client -connect some.site.com:443 -servername some.site.com
  (If website uses SNI)

Using acme.sh to automate SSL certs

I'm using https://acme.sh/ to automate the creation and deployment of SSL certs from https://letsencrypt.org/ on my websites. I prefer this method to using certbot as it doesn't require any additional packages to be installed on the server as it is all done in script.

Some notes on how to create the certs and have them load automatically into Apache.
I'm not detailing how to install acme as that's straightforward and covered on the acme website.

I have the acme script installed on the web server as root as it makes copying the certs / keys to the appropriate directories easier.

I use the dns-01 challenge mechanism to issue certs as Cloudflare has an API that supports it.
This is a great way to do it as it means you don't need to copy content to the web servers to authenticate the cert issuing request.

Need the following in ~/.acme.sh/account.conf for it to work:

SAVED_CF_Key='<API key>'
SAVED_CF_Email='<email address>'

Issue the cert

acme.sh --issue --dns dns_cf -d foobar.durrant.me.uk

Add the cert / key locations to Apache
Note that the cer file contains both the site cert and the intermediate cert. Apache understands if you point both parameters at the same file which saves having to maintain two separate files.

SSLCertificateFile /etc/pki/tls/certs/foobar.durrant.me.uk.cer
SSLCertificateKeyFile /etc/pki/tls/private/foobar.durrant.me.uk.key
SSLCertificateChainFile /etc/pki/tls/certs/foobar.durrant.me.uk.cer

Install the certs

acme.sh --install-cert -d foobar.durrant.me.uk --key-file /etc/pki/tls/private/foobar.durrant.me.uk.key --fullchain-file /etc/pki/tls/certs/foobar.durrant.me.uk.cer --reloadcmd "systemctl restart httpd.service"

Set the permissions on the key & cert

chmod 600 /etc/pki/tls/private/foobar.durrant.me.uk.key
chmod 600 /etc/pki/tls/certs/foobar.durrant.me.uk.cer

 Certs will automatically be renewed and reinstalled every 2 months.