сертификаты let's encrypt

1.Сразу в каталог бинарников

# cd /usr/local/bin/

2.Качаем скрипт
# wget https://dl.eff.org/certbot-auto6

3.Даем права на исполнение
# chmod a+x certbot-auto

4.запускаем в ручном режиме
# ./certbot-auto certonly --authenticator manual

5.Вводим свой email(думаю не обязательно)
Enter email address (used for urgent renewal and security notices) (Enter 'c' to

Please read the Terms of Service at
https://letsencrypt.org/documents/LE-SA-v1.1.1-August-1-2016.pdf. You must agree
in order to register with the ACME server at
(A)gree/(C)ancel: A

Would you be willing to share your email address with the Electronic Frontier
Foundation, a founding partner of the Let's Encrypt project and the non-profit
organization that develops Certbot? We'd like to send you email about EFF and
our work to encrypt the web, protect its users and defend digital rights.
(Y)es/(N)o: N

8.Вводим домены через запятую или пробел
Please enter in your domain name(s) (comma and/or space separated)  (Enter 'c'
to cancel):speed.****.net
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for speed.****.net
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for speed.****.net

9.Подтверждаем сохранения нашего ip в логах let's encrypt
NOTE: The IP of this machine will be publicly logged as having requested this
certificate. If you're running certbot in manual mode on a machine that is not
your server, please ensure you're okay with that.
Are you OK with your IP being logged?
(Y)es/(N)o: Y

10.Далее внимательно, нам надо, чтобы открывалась страничка нашего домена по ниже приведенной ссылке
и содержала строчку которая еще ниже.
Соответственно заходим в корневую директорию домена создаем там нужные диры и заливаем в файл содержимое(ту самую строчку).
Здесь стоит обратить внимание что название файла и содержимое меняется каждый раз при запуски скрипта.
Make sure your web server displays the following content at
http://speed.****.net/.well-known/acme-challenge/bCZ2XSK0LX3OafmdOSIQ8Jn488nRIL22z1tPFGxlBTo before continuing:
If you don't have HTTP server configured, you can run the following
command on the target server (as root):
mkdir -p /tmp/certbot/public_html/.well-known/acme-challenge
cd /tmp/certbot/public_html
printf "%s" bCZ2XSK0LX3OafmdOSIQ8Jn488nRIL22z1tPFGxlBTo.z2_LeL3BCTFPZZl6wELm--ETSI_T0uqFpkSMAUj6ASg > .well-known/acme-challenge/bCZ2XSK0LX3OafmdOSIQ8Jn488nRIL22z1tPFGxlBTo
# run only once per server:
$(command -v python2 || command -v python2.7 || command -v python2.6) -c \
"import BaseHTTPServer, SimpleHTTPServer; \
s = BaseHTTPServer.HTTPServer(('', 80), SimpleHTTPServer.SimpleHTTPRequestHandler); \
Press Enter to Continue

11.Жмем Enter и всё ок, создаются сертификаты и ключи в каталоге
/etc/letsencrypt/live/<ваш домен>/
Waiting for verification...
Cleaning up challenges
 - Congratulations! Your certificate and chain have been saved at
   /etc/letsencrypt/live/speed.****.net/fullchain.pem. Your cert will
   expire on 2017-10-02. To obtain a new or tweaked version of this
   certificate in the future, simply run certbot-auto again. To
   non-interactively renew *all* of your certificates, run
   "certbot-auto renew"
 - If you like Certbot, please consider supporting our work by:
   Donating to ISRG / Let's Encrypt:   <a href="https://letsencrypt.org/donate<br />
" title="https://letsencrypt.org/donate<br />
">https://letsencrypt.org/donate<br />
</a>   Donating to EFF:                    https://eff.org/donate-le


Много ручной

Много ручной работы.
Сертификаты выдаются на 90 дней. Надо настраивать автообновление.