{"id":819,"date":"2016-02-10T20:53:44","date_gmt":"2016-02-11T04:53:44","guid":{"rendered":"https:\/\/www.cloudinsidr.com\/content\/?p=819"},"modified":"2018-04-04T02:50:45","modified_gmt":"2018-04-04T10:50:45","slug":"how-to-use-letsencrypt-across-servers-in-manual-configuration-mode-with-a-csr","status":"publish","type":"post","link":"https:\/\/www.cloudinsidr.com\/content\/how-to-use-letsencrypt-across-servers-in-manual-configuration-mode-with-a-csr\/","title":{"rendered":"How to Use Letsencrypt across Servers in the Manual Configuration Mode with a CSR"},"content":{"rendered":"

Generating SSL certificates when Letsencrypt (what is Letsencrypt, who is behind it, and how the heck can you get started<\/a>) is available for your system works in a breeze, but what if you need your certificates for a machine that won’t take Letsencrypt (for whatever reason)? It is still possible: you can either\u00a0grab Letsencrypt from Git, or, for reasons of practicality… create a certificate signing request (CSR) on your target server, transfer it to your letsencrypt instance, generate the certificates you need, then transfer the generated files back to your target instance\u00a0and install the certificates in your software.<\/p>\n

<\/p>\n

Step 1. Adjust the DNS configuration for your target server (the one that needs the certificates)<\/h6>\n

Make sure that requests to the host names that need the certificates are being routed to the IP address of your target server via an A entry. Unless an A entry is in place, letsencrypt (on your other instance) will flat-out refuse to cooperate.<\/p>\n

Step 2. Adjust openssl configuration on your target server (the one that needs the certificates)<\/h6>\n

On the target machine (that is, on the server that will be using the certificates), navigate to the openssl configuration file openssl.cnf<\/strong> located in:<\/p>\n

cd \/etc\/pki\/tls<\/pre>\n
Make a copy of it.<\/p>\n
cp openssl.cnf openssl.cnf-original<\/pre>\n
Now open the original in a text editor of your choice. Enter these two lines:<\/p>\n
[SAN]\r\nsubjectAltName=DNS:domainname1.tld,DNS:host.domainname1.tld,DNS:host2.domainname2.tld<\/pre>\n
Make sure you replace the host names (domainname1.tld, etc.) with the host names that you want to generate your certificates for.<\/p>\n
Step 3. Generate the certificate signing request on the server that will be using the certificates<\/h6>\n
On the target server (that’s the one that needs the certificates but can’t run letsencypt), generate the certificate signing request using the config file that you modified in Step 2 above:<\/p>\n
openssl req -new -newkey rsa:2048 -sha256 -nodes -keyout filename.privkey1.pem -out filename.der -outform der -subj \"\/C=US\/ST=Nevada\/L=Las Vegas\/O=domainname1.tld\" -reqexts SAN<\/pre>\n
Adjust the parameters as needed, especially the country, state, city, and your domain name (entering incorrect information constitutes a breach of the Terms of Service of Letsencrypt, so<\/span> no “test city” here!<\/span>).<\/p>\n
You should see a confirmation. Verify that openssl has generated two files:
\na .pem private key and a .der encoded certificate signing request (CSR). Don’t bother converting them, letsencrypt will do just fine.<\/p>\n
\"Creating<\/a>
Creating a CSR in openssl on the target\u00a0server<\/figcaption><\/figure>\n
Step 4. Transfer the CSR .der file to your letsencrypt machine<\/h6>\n
Transfer the .der file to your letsencrypt machine. One way to do this is using rsync, another good option is FileZilla.<\/p>\n
Step 5. Request your certificate files<\/h6>\n
On the letsencrypt machine, request your certificate files:<\/p>\n
letsencrypt certonly --authenticator manual --server https:\/\/acme-v01.api.letsencrypt.org\/directory --text --email your@emailaddress.com --csr host.domain.com.der<\/pre>\n
Your IP will be publicly logged as having requested the certificate.<\/p>\n
In order to\u00a0authenticate your server, follow the onscreen instructions. You can either save an authentication file to a web server directory and serve it via http, or run a Python\u00a0script that the assistant provides, whichever seems more convenient. You should see a confirmation message announcing the path to your certificate chain.<\/p>\n
\"Letsencrypt:<\/a>
Letsencrypt (on your letsencrypt machine): server authentication methods and a success message<\/figcaption><\/figure>\n
Step 6. Transfer generated files back to the target server<\/h6>\n
Transfer generated files back to the target server and save them with 640 permissions. Configure your software (such as your mail server and your web server) to use the certificates, and don’t forget to renew them within 90 days!<\/p>\n","protected":false},"excerpt":{"rendered":"
Generating SSL certificates when Letsencrypt (what is Letsencrypt, who is behind it, and how the heck can you get started) is available for your system works in a breeze, but what if you need your certificates for a machine that won’t take Letsencrypt (for whatever reason)? It is still possible: you can either\u00a0grab Letsencrypt from […]<\/p>\n","protected":false},"author":101011,"featured_media":76,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_genesis_hide_title":false,"_genesis_hide_breadcrumbs":false,"_genesis_hide_singular_image":false,"_genesis_hide_footer_widgets":false,"_genesis_custom_body_class":"","_genesis_custom_post_class":"","_genesis_layout":"","footnotes":""},"categories":[16,33,111,2,6],"tags":[112,113,38],"yoast_head":"\nHow to Use Letsencrypt across Servers in the Manual Configuration Mode with a CSR - CloudInsidr<\/title>\n<meta name=\"robots\" content=\"index, follow\" \/>\n<meta name=\"googlebot\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<meta name=\"bingbot\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.cloudinsidr.com\/content\/how-to-use-letsencrypt-across-servers-in-manual-configuration-mode-with-a-csr\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"How to Use Letsencrypt across Servers in the Manual Configuration Mode with a CSR - CloudInsidr\" \/>\n<meta property=\"og:description\" content=\"Generating SSL certificates when Letsencrypt (what is Letsencrypt, who is behind it, and how the heck can you get started) is available for your system works in a breeze, but what if you need your certificates for a machine that won’t take Letsencrypt (for whatever reason)? It is still possible: you can either\u00a0grab Letsencrypt from […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.cloudinsidr.com\/content\/how-to-use-letsencrypt-across-servers-in-manual-configuration-mode-with-a-csr\/\" \/>\n<meta property=\"og:site_name\" content=\"CloudInsidr\" \/>\n<meta property=\"article:published_time\" content=\"2016-02-11T04:53:44+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2018-04-04T10:50:45+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.cloudinsidr.com\/content\/wp-content\/uploads\/2015\/11\/cloudinsidr_logo_900px-wide.png\" \/>\n\t<meta property=\"og:image:width\" content=\"900\" \/>\n\t<meta property=\"og:image:height\" content=\"326\" \/>\n<meta name=\"twitter:card\" content=\"summary\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.cloudinsidr.com\/content\/#website\",\"url\":\"https:\/\/www.cloudinsidr.com\/content\/\",\"name\":\"CloudInsidr\",\"description\":\"Cyber security, infotech\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":\"https:\/\/www.cloudinsidr.com\/content\/?s={search_term_string}\",\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"ImageObject\",\"@id\":\"https:\/\/www.cloudinsidr.com\/content\/how-to-use-letsencrypt-across-servers-in-manual-configuration-mode-with-a-csr\/#primaryimage\",\"inLanguage\":\"en-US\",\"url\":\"https:\/\/www.cloudinsidr.com\/content\/wp-content\/uploads\/2015\/11\/cloudinsidr_logo_900px-wide.png\",\"width\":900,\"height\":326,\"caption\":\"cloudinsidr.com logo (900px wide)\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.cloudinsidr.com\/content\/how-to-use-letsencrypt-across-servers-in-manual-configuration-mode-with-a-csr\/#webpage\",\"url\":\"https:\/\/www.cloudinsidr.com\/content\/how-to-use-letsencrypt-across-servers-in-manual-configuration-mode-with-a-csr\/\",\"name\":\"How to Use Letsencrypt across Servers in the Manual Configuration Mode with a CSR - CloudInsidr\",\"isPartOf\":{\"@id\":\"https:\/\/www.cloudinsidr.com\/content\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.cloudinsidr.com\/content\/how-to-use-letsencrypt-across-servers-in-manual-configuration-mode-with-a-csr\/#primaryimage\"},\"datePublished\":\"2016-02-11T04:53:44+00:00\",\"dateModified\":\"2018-04-04T10:50:45+00:00\",\"author\":{\"@id\":\"https:\/\/www.cloudinsidr.com\/content\/#\/schema\/person\/21ce63bea726ea64da1beed97e63ba84\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.cloudinsidr.com\/content\/how-to-use-letsencrypt-across-servers-in-manual-configuration-mode-with-a-csr\/\"]}]},{\"@type\":[\"Person\"],\"@id\":\"https:\/\/www.cloudinsidr.com\/content\/#\/schema\/person\/21ce63bea726ea64da1beed97e63ba84\",\"name\":\"Anna E Kobylinska\",\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\/\/www.cloudinsidr.com\/content\/#personlogo\",\"inLanguage\":\"en-US\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/7a3e9bd152f9d5cd41bf2b92df649857?s=96&d=mm&r=g\",\"caption\":\"Anna E Kobylinska\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","_links":{"self":[{"href":"https:\/\/www.cloudinsidr.com\/content\/wp-json\/wp\/v2\/posts\/819"}],"collection":[{"href":"https:\/\/www.cloudinsidr.com\/content\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.cloudinsidr.com\/content\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.cloudinsidr.com\/content\/wp-json\/wp\/v2\/users\/101011"}],"replies":[{"embeddable":true,"href":"https:\/\/www.cloudinsidr.com\/content\/wp-json\/wp\/v2\/comments?post=819"}],"version-history":[{"count":11,"href":"https:\/\/www.cloudinsidr.com\/content\/wp-json\/wp\/v2\/posts\/819\/revisions"}],"predecessor-version":[{"id":1809,"href":"https:\/\/www.cloudinsidr.com\/content\/wp-json\/wp\/v2\/posts\/819\/revisions\/1809"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.cloudinsidr.com\/content\/wp-json\/wp\/v2\/media\/76"}],"wp:attachment":[{"href":"https:\/\/www.cloudinsidr.com\/content\/wp-json\/wp\/v2\/media?parent=819"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.cloudinsidr.com\/content\/wp-json\/wp\/v2\/categories?post=819"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.cloudinsidr.com\/content\/wp-json\/wp\/v2\/tags?post=819"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}