====== Information ======

  * Let's Encrypt ((https://letsencrypt.org/))
  * simple-acme ((https://simple-acme.com))
  * [[information;realm_of_espionage|Realm of Espionage]]

===== Prerequisites =====

  * [[windows;10_ltsc_server|Windows 10 (21H2)]]
  * [[servers;windows;freenginx_php_php-cgi|freenginx]]

  * :!: WIP

====== Install ======

===== simple-acme =====

  * https://github.com/simple-acme/simple-acme/releases
  * Last tested: ''simple-acme.v2.4.1.2444.win-arm64.trimmed.zip''

  MOVE /Y "%UserProfile%\Downloads\simple-acme."*".win-arm64.trimmed.zip" "%UserProfile%\Downloads\simple-acme.win-arm64.trimmed.zip" & MKDIR "%SystemDrive%\www\simple-acme" & "%SystemRoot%\System32\tar.exe" -xf "%UserProfile%\Downloads\simple-acme.win-arm64.trimmed.zip" -C "%SystemDrive%\www\simple-acme" && DIR /B "%SystemDrive%\www\simple-acme\wacs.exe"

====== Obtain Certs ======

===== Manual =====

  * https://simple-acme.com/manual/advanced-use/
  * https://simple-acme.com/reference/cli

  * ''M''
  * ''2: Manually enter host names''
  * ''4: Single certificate''
  * ''1: [http] Let simple-acme answer HTTP validation request''
  * ''1: Generate an EC public/private key pair''
  * ''4: Create PEM encoded files''
  * ''File path:''
  * ''6: No (additional) store steps''
  * ''3: No (additional) installation steps''
  * ''3: shortlived''

  "%SystemRoot%\System32\netsh.exe" advfirewall firewall add rule name="simple-acme (HTTP)" dir="in" action="allow" program="%SystemDrive%\www\simple-acme\wacs.exe" protocol="tcp" localport="80"

  "%SystemDrive%\www\simple-acme\wacs.exe"

  realmofespionage.xyz,wiki.realmofespionage.xyz

  C:\simple-acme\certs

  "%SystemRoot%\System32\netsh.exe" advfirewall firewall delete rule name="simple-acme (HTTP)"

====== Scripts ======

  MKDIR "%SystemDrive%\www\scripts\certbot"

  "%SystemRoot%\explorer.exe" "%SystemDrive%\www\scripts\certbot"

===== Renewal =====

  "%SystemRoot%\System32\notepad.exe" "%SystemDrive%\www\scripts\certbot\Renewal.bat"

<code>
@echo off

CD "%Temp%"

CALL "%SystemDrive%\www\scripts\certbot\Update.bat"

CALL "%SystemDrive%\www\scripts\nginx\Stop.bat"

TITLE Certbot Renewal

"%SystemRoot%\System32\netsh.exe" advfirewall firewall add rule name="Certbot (Standalone)" dir="in" action="allow" program="%LocalAppData%\Programs\Python\Python314-arm64\python.exe" protocol="tcp" localport="80"
"%LocalAppData%\Programs\Python\Python314-arm64\Scripts\certbot.exe" "certonly" --config "%SystemDrive%\www\certbot\cli-custom.ini" --quiet
"%SystemRoot%\System32\netsh.exe" advfirewall firewall delete rule name="Certbot (Standalone)"

CALL "%SystemDrive%\www\scripts\nginx\Start.bat"

:: End</code>

  "%SystemDrive%\www\scripts\certbot\Renewal.bat"

===== Update =====

  "%SystemRoot%\System32\notepad.exe" "%SystemDrive%\www\scripts\certbot\Update.bat"

<code>
@echo off

TITLE Certbot Update
CD "%Temp%"

"%LocalAppData%\Programs\Python\Python314-arm64\python.exe" -m "pip" install --upgrade "pip" --quiet

"%LocalAppData%\Programs\Python\Python314-arm64\Scripts\pip.exe" install --upgrade "certbot" --quiet

:: End</code>

  "%SystemDrive%\www\scripts\certbot\Update.bat"

====== Task Scheduler ======

===== Renewal =====

  * Weekly (Sunday) ''07:00:00 AM''

  "%SystemRoot%\System32\schtasks.exe" /Create /SC "WEEKLY" /D "SUN" /TN "Certbot Renewal" /TR "%SystemDrive%\www\scripts\certbot\Renewal.bat" /ST "07:00" /F