Apply for a Lego domain certificate

Aug 15, 2023#ssl43

AI Translation

This post is translated from Chinese into English through AI.View Original

AI-generated summary

This is a set of commands for installing and using the Lego tool. It includes downloading and extracting the Lego package, setting environment variables for Cloudflare email and API key, specifying the server and domain, and running the Lego tool to issue or renew certificates. It also includes a command to verify the trustworthiness of a certificate using OpenSSL. The last line mentions a reference for the Lego server.

lego install#

curl -fsSLO https://github.com/go-acme/lego/releases/download/v4.14.0/lego_v4.14.0_linux_amd64.tar.gz
tar xvf lego_*.tar.gz
rm -f CHANGELOG.md LICENSE

Issuance#

export CLOUDFLARE_EMAIL="root@gmail.com"
export CLOUDFLARE_API_KEY="CLOUDFLARE_API_KEY"
export SERVER=${SERVER:-https://acme-v02.api.letsencrypt.org/directory}
export DOMAIN=${DOMAIN:-example.com}
export LEGO_PATH="/root/cert/"
./lego --server="${SERVER}" \
    --dns.resolvers="1.1.1.1:53" \
    --email="${EMAIL}" \
    --accept-tos \
    --dns="cloudflare" \
    --domains="${DOMAIN}" \
    --domains="*.${DOMAIN}" \
    --pem \
    run

Renewal#

Replace "run" with "renew"

Verify the Trustworthiness of the Certificate (debian12)#

openssl verify -CAfile /etc/ssl/certs/ca-certificates.crt -untrusted /root/txtk/certificates/example.com.issuer.crt /root/txtk/certificates/example.com.crt

lego server reference below#

acme_server api