starred/certbot-certbot-2
1
0
Fork 0
mirror of https://github.com/certbot/certbot.git synced 2026-07-30 16:14:44 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'georgio/TLS-SNI-01-Deprecation' into no-more-tls-sni-01

Browse Source
This commit is contained in:
Seth Schoen
2018-12-07 13:36:47 -08:00
parent 353d092585 94f0a915c0
commit bc9865371a
1 changed files with 4 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/challenges.rst
+4 -25
View File
@@ -5,8 +5,7 @@ To receive a certificate from Let's Encrypt certificate authority (CA), you must
prove you control each of the domain names that will be listed in the certificate. A challenge is one of prove you control each of the domain names that will be listed in the certificate. A challenge is one of
three tasks that only someone who controls the domain should be able to accomplish: three tasks that only someone who controls the domain should be able to accomplish:
* Posting a specified file in a specified location on a web site (the HTTP-01 challenge) * Posting a specified file in a specified location on a web site (the HTTP-01 challenge)
* Offering a specified temporary certificate on a web site (the TLS-SNI-01 challenge)
* Posting a specified DNS record in the domain name system (the DNS-01 challenge) * Posting a specified DNS record in the domain name system (the DNS-01 challenge)
It’s possible to complete each type of challenge *automatically* (Certbot directly makes the necessary It’s possible to complete each type of challenge *automatically* (Certbot directly makes the necessary
@@ -16,18 +15,12 @@ design favors performing challenges automatically, and this is the normal case f
Some plugins offer an *authenticator*, meaning that they can satisfy challenges: Some plugins offer an *authenticator*, meaning that they can satisfy challenges:
* Apache plugin: (TLS-SNI-01) Tries to edit your Apache configuration files to temporarily serve
a Certbot-generated certificate for a specified name. Use the Apache plugin when you're running
Certbot on a web server with Apache listening on port 443.
* NGINX plugin: (TLS-SNI-01) Tries to edit your NGINX configuration files to temporarily serve a
Certbot-generated certificate for a specified name. Use the NGINX plugin when you're running
Certbot on a web server with NGINX listening on port 443.
* Webroot plugin: (HTTP-01) Tries to place a file where it can be served over HTTP on port 80 by a * Webroot plugin: (HTTP-01) Tries to place a file where it can be served over HTTP on port 80 by a
web server running on your system. Use the Webroot plugin when you're running Certbot on web server running on your system. Use the Webroot plugin when you're running Certbot on
a web server with any server application listening on port 80 serving files from a folder on disk in response. a web server with any server application listening on port 80 serving files from a folder on disk in response.
* Standalone plugin: (TLS-SNI-01 or HTTP-01) Tries to run a temporary web server listening on either HTTP on * Standalone plugin: (HTTP-01) Tries to run a temporary web server listening on HTTP on
port 80 (for HTTP-01) or HTTPS on port 443 (for TLS-SNI-01). Use the Standalone plugin if no existing program port 80 (for HTTP-01). Use the Standalone plugin if no existing program
is listening to these ports. Choose TLS-SNI-01 or HTTP-01 using the `--preferred-challenges` option. is listening to these ports. Choose HTTP-01 using the `--preferred-challenges` option.
* Manual plugin: (DNS-01 or HTTP-01) Either tells you what changes to make to your configuration or updates * Manual plugin: (DNS-01 or HTTP-01) Either tells you what changes to make to your configuration or updates
your DNS records using an external script (for DNS-01) or your webroot (for HTTP-01). Use the Manual your DNS records using an external script (for DNS-01) or your webroot (for HTTP-01). Use the Manual
plugin if you have the technical knowledge to make configuration changes yourself when asked to do so. plugin if you have the technical knowledge to make configuration changes yourself when asked to do so.
@@ -63,20 +56,6 @@ HTTP-01 Challenge
* When using the Standalone plugin, make sure another program is not already listening to port 80 on the server. * When using the Standalone plugin, make sure another program is not already listening to port 80 on the server.
* When using the Webroot plugin, make sure there is a web server listening on port 80. * When using the Webroot plugin, make sure there is a web server listening on port 80.
TLS-SNI-01 Challenge
~~~~~~~~~~~~~~~~~~~~
* The TLS-SNI-01 challenge doesn’t work with content delivery networks (CDNs)
like CloudFlare and Akamai because the domain name is pointed at the CDN, not directly at your server.
* Make sure port 443 is open, publicly reachable from the Internet, and not blocked by a router or firewall.
* When using the Apache plugin, make sure you are running Apache and no other web server on port 443.
* When using the NGINX plugin, make sure you are running NGINX and no other web server on port 443.
* With either the Apache or NGINX plugin, certbot modifies your web server configuration. If you get
an error after successfully completing the challenge, then you have received a certificate but the
plugin was unable to modify your web server configuration, meaning that you'll have to install the certificate manually.
In that case, please file a bug to help us improve certbot!
* When using the Standalone plugin, make sure another program is not already listening to port 443 on the server.
DNS-01 Challenge DNS-01 Challenge
~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~