The following is the GNU All-permissive License as recommended in https://www.gnu.org/licenses/license-recommendations.en.html

Copying and distribution of this file, with or without modification, are permitted in any medium without royalty provided the copyright notice and this notice are preserved. This file is offered as-is, without any warranty.

Contributions are welcome. See https://savannah.gnu.org/maintenance/fsf/.

[[!toc levels=4]]

OpenSSL

Letsencrypt

Verify a cert

With openssl:

$ ssh foo.gnu.org  openssl x509 -enddate -noout -in /etc/letsencrypt/live/*/cert.pem
notAfter=Oct  5 14:03:00 2016 GMT

With gnutls (install gnutls-bin package):

gnutls-cli food.gnu.org

Check for multiple hosts:

host foo.gnu.org

Sometimes one of them might have an expired cert.

Fetch an active cert / use a netcat-like interface

openssl s_client -connect minetest.libreplanet.org:443

For services that use StartTLS (see man s_client):

openssl s_client -starttls smtp -connect mail.fsf.org:587

For XMPP:

openssl s_client -starttls xmpp -connect jabber.fsf.org:5222 -xmpphost fsf.org

Add domains to letsencrypt cert:

To add more domains to a cert:

export HTTP_PROXY=http://serverproxy0p.fsf.org:8118; export HTTPS_PROXY=http://serverproxy0p.fsf.org:8118; export NO_PROXY=localhost,127.0.0.1

certbot certonly --apache -d shop.fsf.org -d shopserver0p.fsf.org -d gnupress.org -d www.gnupress.org -d ...

While the above command is supported on Trisquel 8, due to security issues with LE, you might want to try:

certbot certonly --standalone -d shop.fsf.org -d shopserver0p.fsf.org -d gnupress.org -d www.gnupress.org -d ...

A dialog should appear. I was able to get verification while pressing cancel each time it asked about a file with the proper vhost.

service apache2 reload

Remove a cert

certbot delete --cert-name olddomain.fsf.org

Create a new CSR

ssh -A root@nessus
cd /etc/ssl/ then run below
openssl req -nodes -newkey rsa:2048 -sha256 -keyout .key -out .csr
Use the .csr for gandi
scp the newly created key to the root@:/etc/ssl/private/

Gandi

request new ssl with the newly created .csr file
use dns zones
add the designated dns zone data to your local /bind/masters/db.
run the ./update-zones
Wait for Gandi to send the notification of the newly created ssls
Retrieve the SSLs and place them on the target site
On the http://wiki.gandi.net/en/ssl/intermediate#sha2_intermediate_certificates copy the http://crt.usertrust.com/USERTrustRSAAddTrustCA.crt local an place it on the targeted site as well
Apache
in most likely root@:/etc/ssl/ cat GandiStandardSSLCA2.pem USERTrustRSAAddTrustCA.crt > GandiChainFile.pem
update the /etc/apaches/sites-available/
Make it look similar to below
- SSLCertificateFile /etc/ssl/certs/lists.defectivebydesign.org.crt
- SSLCertificateKeyFile /etc/ssl/private/lists.defectivebydesign.org.key
- SSLCertificateChainFile /etc/ssl/certs/GandiStandardSSLCA2.pem
then after the apache file is updated run service apache2 reload
Visit the site in a private browser window and verify the cert is updated.

nginx

in most likely root@:/etc/ssl/ cat .crt GandiStandardSSLCA2.pem USERTrustRSAAddTrustCA.crt > GandiChainFileNgninx.crt
in the /etc/ngnix/sites-available/
Make sure the
- server {
- listen 443;
- include /etc/nginx/mediagoblin-common.conf;
- access_log /var/log/nginx/media.libreplanet.org-ssl.access.log;
- error_log /var/log/nginx/media.libreplanet.org-ssl.error.log;
- ssl on;
- ssl_session_cache shared:SSL:10m;
- ssl_session_timeout 10m;
- ssl_certificate /etc/ssl/certs/wildcard.libreplanet.org-full-chain.crt;
- ssl_certificate_key /etc/ssl/private/wildcard.libreplanet.org.key;
save the changes && /etc/init.d/nginx configtest
If the test passes then /etc/init.d/nginx reload

OCSP Stapling

OCSP stapling allows for ssl clients (usually a web browser) to obtain the ssl certificate revocation status directly from our servers, which saves on an extra connection during ssl handshake, and improves on privacy for the users. Since our web servers are firewalled off (so they cannot initiate outbound connections), requests to OSCP validation servers have to go through a proxy. We run two OCSP proxy servers:

serverproxy0p.fsf.org:8002 running https://github.com/philfry/ocsp_proxy. This process would detect the OCSP validator url automatically, and it is compatible with 2.4.18-2ubuntu3.17+8.0trisquel3 or older, using the SSLOCSPProxyURL config variable. This is a caching service
serverproxy0p.fsf.org:8001 running https://github.com/dlecorfec/ocsp-proxy. NOT RECOMMENDED This process has a hardcoded url for the OCSP validator server to target, and it needs to be updated when letsencrypt changes providers. It is only to be used on nginx, or apache2 < 2.4.18-2ubuntu3.17+8.0trisquel3. This is a non-caching service