Differences

This shows you the differences between two versions of the page.

--- servers:windows:nginx:lets_encrypt [2025/02/26 22:08] – Sean Rhone
+++ servers:windows:nginx:lets_encrypt [2025/06/14 21:10] (current) – Sean Rhone
@@ Line 4: / Line 4: @@
   * Certbot ((https://certbot.eff.org))
   * [[Information:Realm of Espionage]]
-===== TODOs =====
-  * :!: Certbot needs admin for symlinks and needs scripting ((new certs filenames add #; tar archives, remove it, pull-in new certs; test with --test-certs))
 ===== Prerequisites =====
-  * [[windows;11_ltsc|Windows 11 (24H2)]]
+  * [[windows;11_ltsc_server|Windows 11 (24H2)]]
-  * [[servers;windows;nginx_php_php-cgi|nginx]] ((Certbot doesn't necessarily require nginx; if not using nginx then [[servers;windows;nginx_php_php-cgi#firewall|port 443/tcp]] likely needs to be opened))
+  * [[servers;windows;nginx_php_php-cgi|nginx]]
 ====== Install ======
@@ Line 19: / Line 15: @@
   * https://www.python.org/downloads/windows/
-  * Last tested: ''python-3.13.2-amd64.exe''
+  * Last tested: ''python-3.13.4-amd64.exe''
   * Install ''pip''
@@ Line 39: / Line 35: @@
   MKDIR "%SystemDrive%\www\certbot"
-  notepad "%SystemDrive%\www\certbot\cli-custom.ini"
+  "notepad.exe" "%SystemDrive%\www\certbot\cli-custom.ini"
 <code>
@@ Line 65: / Line 61: @@
 hsts = true
 uir = true
-staple-ocsp = true
+staple-ocsp = false
 domains = realmofespionage.xyz, blog.realmofespionage.xyz, files.realmofespionage.xyz, media.realmofespionage.xyz, wiki.realmofespionage.xyz
@@ Line 73: / Line 69: @@
 ====== Obtain Certs Test ======
-****
+  "netsh.exe" advfirewall firewall add rule name="Certbot (Standalone)" dir="in" action="allow" program="%LocalAppData%\Programs\Python\Python313\python.exe" protocol="tcp" localport="80"
   "%LocalAppData%\Programs\Python\Python313\Scripts\certbot.exe" "certonly" --config "%SystemDrive%\www\certbot\cli-custom.ini" --dry-run
+  "netsh.exe" advfirewall firewall delete rule name="Certbot (Standalone)"
 ====== Scripts ======
+  * :!: 2025/03/15: TODO: Certbot needs admin for symlinks; possibly needs different scripting ((new certs filenames add #; tar archives, remove it, pull-in new certs; test with --test-certs)), and updated for temp firewall rule
   MKDIR "%SystemDrive%\www\scripts\certbot"
@@ Line 100: / Line 100: @@
   "%SystemDrive%\www\scripts\certbot\Renewal.bat"
+==== Test Renewal ====
+  "notepad.exe" "%SystemDrive%\www\scripts\certbot\Renewal-test.bat"
+<code>
+:: Stop nginx
+CALL "%SystemDrive%\www\scripts\nginx\Stop.bat"
+:: Renew Certs
+"netsh.exe" advfirewall firewall add rule name="Certbot (Standalone)" dir="in" action="allow" program="%LocalAppData%\Programs\Python\Python313\python.exe" protocol="tcp" localport="80"
+"%LocalAppData%\Programs\Python\Python313\Scripts\certbot.exe" "certonly" --config "%SystemDrive%\www\certbot\cli-custom.ini" --quiet
+"netsh.exe" advfirewall firewall delete rule name="Certbot (Standalone)"
+"explorer.exe" "%SystemDrive%\Certbot\archive\realmofespionage.xyz"
+"explorer.exe" "%SystemDrive%\www\certbot\certs"
+"notepad.exe" "%SystemDrive%\www\nginx\conf.d\ssl.conf"
+:: End</code>
+  "%SystemDrive%\www\scripts\certbot\Renewal-test.bat"
 ===== Update =====