LetsEncrypt and multiple vhosts

[NathanZachary]

Hello,

Is anyone currently using LetsEncrypt (the official certbot client or otherwise) to automatically obtain certificates for Apache with multiple vhosts? I don't particularly like the idea of certbot being able to modify vhost configurations, but would imagine that it's possible to use it just to grab the new certificates every X days and overwrite them. Does anyone have experience with this process?

Cheers,
Nathan Zachary
_________________
“Truth, like infinity, is to be forever approached but never reached.” --Jean Ayres (1972)
---avatar cropped from =AimanStudio---

[geki]

There is good documentation out there. See webroot variant to fetch only certs. On that site you find infos how to use cron to update every ~90 days.
https://certbot.eff.org/docs/using.html#webroot

Since I have dyndns and letsencrypt has rate-limits I added this script to cron to get the certificates somewhen in the future:

[Fitzcarraldo]

On one of my servers I have more than one vhost running Apache, and use the same Let's Encrypt certificate for them. One vhost is responsible for updating the certificate, and it copies the certificate to the other vhost. I don't use the Let's Encrypt vhost configuration; I just configure the certificate locations in each vhost's config file.

I use a cron job to check for certificate renewal. It does not matter if you check more frequently than every ~90 days; The cron job checks twice-daily, as you can see below in the crontab entry.

[Ant P.]

I use le.pl to generate a wildcard cert. I don't like the idea of something messing with my system config files either, it runs as a confined user and the cert is copied out of its home directory afterwards.
Haven't bothered to automate the process yet beyond a cronjob checking the last update and sending warning emails after 70 days, but it's infrequent enough I don't really care about that.

[NathanZachary]

Thank you both for your responses! I guess what I'm wondering here is if it is possible to just pull one certificate and use it across the virtual hosts. My guess is no, since the FQDNs are different. So, I would likely need to have a list of the domains that are virtual hosts, and have certbot generate a new cert for each of them once every ~90 days and put it in place. As long as the name stays the same, no Apache vhost modifications will be necessary. Does that seem like a feasible plan?

So, for instance, let's say I have domain{1,2,3}.com and they are set up under /etc/apache2/vhosts.d/includes/domain{1,2,3}.com.conf.
The root for each site is /var/www/domains/domain{1,2,3}.com/.
I'm guessing that I could set up a directory for the certificates either under each site (in, say, /var/www/domains/domain{1,2,3}.com/ssl/) or in a location under Apache like /etc/apache2/vhosts/ssl/.
certbot can then generate a certificate for each site and place it in the corresponding directory.
As long as the name of each certificate remains the same, then no Apache modifications/reloads will need to happen.

Does this approach seem valid?

Thanks again for your help!

Cheers,
Nathan Zachary
_________________
“Truth, like infinity, is to be forever approached but never reached.” --Jean Ayres (1972)
---avatar cropped from =AimanStudio---

[Ant P.]

It should be possible to use one cert for multiple hosts, that's what I did before wildcards were added. It'll be the same process whether they're subdomains on one host or different domains entirely.

[NathanZachary]

[Fitzcarraldo]

[Elleni]