The following is the GNU All-permissive License as recommended in

Copyright (C) 2024 Free Software Foundation

Copying and distribution of this file, with or without modification, are permitted in any medium without royalty provided the copyright notice and this notice are preserved. This file is offered as-is, without any warranty.

Contributions are welcome. See

[[!toc levels=4]]



See also letsencrypt.

On older servers, try which is a simple bash implementation that does not have all of the python dependencies.

Verify a cert

With openssl:

$ ssh  openssl x509 -enddate -noout -in /etc/letsencrypt/live/*/cert.pem
notAfter=Oct  5 14:03:00 2016 GMT

With gnutls (install gnutls-bin package):


Check for multiple hosts:


Sometimes one of them might have an expired cert.

Fetch an active cert / use a netcat-like interface

openssl s_client -connect

For services that use StartTLS (see man s_client):

openssl s_client -starttls smtp -connect


openssl s_client -starttls xmpp -connect -xmpphost

Add domains to letsencrypt cert:

To add more domains to a cert:

export HTTP_PROXY=; export HTTPS_PROXY=; export NO_PROXY=localhost,

certbot certonly --apache -d -d -d -d -d ...

While the above command is supported on Trisquel 8, due to security issues with LE, you might want to try:

certbot certonly --standalone -d -d -d -d -d ...

A dialog should appear. I was able to get verification while pressing cancel each time it asked about a file with the proper vhost.

service apache2 reload

Remove a cert

certbot delete --cert-name

Create a new CSR

  • ssh -A root@nessus
  • cd /etc/ssl/ then run below
  • openssl req -nodes -newkey rsa:2048 -sha256 -keyout .key -out .csr
  • Use the .csr for gandi
  • scp the newly created key to the root@:/etc/ssl/private/


  • request new ssl with the newly created .csr file
  • use dns zones
  • add the designated dns zone data to your local /bind/masters/db.
  • run the ./update-zones
  • Wait for Gandi to send the notification of the newly created ssls
  • Retrieve the SSLs and place them on the target site
  • On the copy the local an place it on the targeted site as well


  • in most likely root@:/etc/ssl/ cat GandiStandardSSLCA2.pem USERTrustRSAAddTrustCA.crt > GandiChainFile.pem
  • update the /etc/apaches/sites-available/
  • Make it look similar to below
    • SSLCertificateFile /etc/ssl/certs/
    • SSLCertificateKeyFile /etc/ssl/private/
    • SSLCertificateChainFile /etc/ssl/certs/GandiStandardSSLCA2.pem
  • then after the apache file is updated run service apache2 reload
  • Visit the site in a private browser window and verify the cert is updated.


  • in most likely root@:/etc/ssl/ cat .crt GandiStandardSSLCA2.pem USERTrustRSAAddTrustCA.crt > GandiChainFileNgninx.crt
  • in the /etc/ngnix/sites-available/
  • Make sure the
    • server {
    • listen 443;
    • include /etc/nginx/mediagoblin-common.conf;
    • access_log /var/log/nginx/;
    • error_log /var/log/nginx/;
    • ssl on;
    • ssl_session_cache shared:SSL:10m;
    • ssl_session_timeout 10m;

    • ssl_certificate /etc/ssl/certs/;

    • ssl_certificate_key /etc/ssl/private/;
  • save the changes && /etc/init.d/nginx configtest
  • If the test passes then /etc/init.d/nginx reload

OCSP Stapling

OCSP stapling allows for ssl clients (usually a web browser) to obtain the ssl certificate revocation status directly from our servers, which saves on an extra connection during ssl handshake, and improves on privacy for the users. Since our web servers are firewalled off (so they cannot initiate outbound connections), requests to OSCP validation servers have to go through a proxy. We run two OCSP proxy servers:

  • running This process would detect the OCSP validator url automatically, and it is compatible with 2.4.18-2ubuntu3.17+8.0trisquel3 or older, using the SSLOCSPProxyURL config variable. This is a caching service
  • running NOT RECOMMENDED This process has a hardcoded url for the OCSP validator server to target, and it needs to be updated when letsencrypt changes providers. It is only to be used on nginx, or apache2 < 2.4.18-2ubuntu3.17+8.0trisquel3. This is a non-caching service