At the end of these steps, you'll have a certificate for www.example.com. If you want to use a different subdomain (example.com, git.example.com, etc.), you can follow this multi-domain configuration example.
1. Set up your new website with http
echo 'dom "example.com" with end;' > ~/.domtool/example.com
2. Set up your environment
These steps are recommended but optional. If you skip them, you'll need to run source ~/.acme.sh/acme.sh.env each time before you generate certs.
The hcoop environment doesn't use a .bashrc file by default, but acme.sh expects one. First create the file
Then load it in each new session. Add the following lines to ~/.bash_profile
if [ -f ~/.bashrc ]; then . ~/.bashrc fi
3. Download and install `acme.sh`
Acme.sh is a client for the ACME protocol, written in pure bash. The third command may complain that you are not allowed to use crontab. This is fine.
git clone https://github.com/acmesh-official/acme.sh.git cd acme.sh ./acme.sh --install
Since afs is publicly accessible, you need to take a few precautions to ensure that your certificate and private key remain private. For all key operations, keep the files in a directory that only you and the admins can read.
Set the correct permissions:
fs sa ~/.acme.sh -clear YOUR_USERNAME all system:administrators all
You'll have to do this once, or you can log out and reconnect (if you set up your .bashrc):
Additionally, acme.sh now uses ZeroSSL as their default CA service, which requires providing an email to the client, linked to a server. If you want to continue using LetsEncrypt, you may want to run the following to change the default CA back to LetsEncrtpy, before continuing:
acme.sh --set-default-ca --server letsencrypt
4. Generate the cert
If the example.com document root is ~/public_html/, run
acme.sh --issue -d example.com -w ~/public_html/
(If the document root is some weird subdirectory, like ~/public_html/weird, set the -w option to that instead.)
At the end, it will print Your cert is in and then a path to a file ending in .cer. Copy this path without the .cer extension. In the next section, replace $FILE with this path.
5. Request cert installation from hcoop admins
Send a SSL certificate permission request. Fields are filled out with:
OpenSSL certificate: $FILE.cer $FILE.key
See section above for context.
You must also request certificate installation whenever you renew the certificate.
6. Update domtool config to use SSL
Now that your cert has been installed, its path will appear on the certificate permission request page, under the heading "Your certificates." Let's say the cert path is /etc/apache2/ssl/user/www.example.com.pem. (That directory is really called user; it's not a username stand-in!) You need to add this path to your domtool configuration.
Here's a simple example config, which redirects all traffic to https in a single domain.
dom "example.com" where SSL = use_cert "/etc/apache2/ssl/user/www.example.com.pem" with web "www" with rewriteRule "^(.*)$" "https://www.example.com$1" [redirectWith temp] end; end;