mirror of
https://github.com/certbot/certbot.git
synced 2026-06-03 13:59:02 -04:00
Merge remote-tracking branch 'origin/rename' into candidate-0.6.0
This commit is contained in:
commit
0fba79806a
13 changed files with 163 additions and 151 deletions
|
|
@ -3,9 +3,9 @@ ChangeLog
|
|||
|
||||
Please note:
|
||||
the change log will only get updated after first release - for now please use the
|
||||
`commit log <https://github.com/letsencrypt/letsencrypt/commits/master>`_.
|
||||
`commit log <https://github.com/certbot/certbot/commits/master>`_.
|
||||
|
||||
To see the changes in a given release, inspect the github milestone for the
|
||||
release. For instance:
|
||||
|
||||
https://github.com/letsencrypt/letsencrypt/issues?utf8=%E2%9C%93&q=milestone%3A0.3.0
|
||||
https://github.com/certbot/certbot/issues?utf8=%E2%9C%93&q=milestone%3A0.3.0
|
||||
|
|
|
|||
|
|
@ -15,4 +15,4 @@ to the Sphinx generated docs is provided below.
|
|||
|
||||
-->
|
||||
|
||||
https://letsencrypt.readthedocs.org/en/latest/contributing.html
|
||||
https://certbot.eff.org/docs/contributing.html
|
||||
|
|
|
|||
67
README.rst
67
README.rst
|
|
@ -11,43 +11,53 @@ For more information regarding the status of the project, please see
|
|||
https://letsencrypt.org. Be sure to checkout the
|
||||
`Frequently Asked Questions (FAQ) <https://community.letsencrypt.org/t/frequently-asked-questions-faq/26#topic-title>`_.
|
||||
|
||||
About the Let's Encrypt Client
|
||||
About Certbot
|
||||
==============================
|
||||
|
||||
The Let's Encrypt Client is a fully-featured, extensible client for the Let's
|
||||
Certbot is a fully-featured, extensible client for the Let's
|
||||
Encrypt CA (or any other CA that speaks the `ACME
|
||||
<https://github.com/ietf-wg-acme/acme/blob/master/draft-ietf-acme-acme.md>`_
|
||||
protocol) that can automate the tasks of obtaining certificates and
|
||||
configuring webservers to use them. This client runs on Unix-based operating
|
||||
systems.
|
||||
|
||||
Until May 2016, Certbot was named simply ``letsencrypt`` or ``letsencrypt-auto``,
|
||||
depending on install method. Instructions on the Internet, and some pieces of the
|
||||
software, may still refer to this older name.
|
||||
|
||||
Contributing
|
||||
------------
|
||||
|
||||
If you'd like to contribute to this project please read `Developer Guide
|
||||
<https://certbot.eff.org/docs/contributing.html>`_.
|
||||
|
||||
Installation
|
||||
------------
|
||||
|
||||
If ``letsencrypt`` is packaged for your Unix OS, you can install it from
|
||||
there, and run it by typing ``letsencrypt``. Because not all operating
|
||||
systems have packages yet, we provide a temporary solution via the
|
||||
``letsencrypt-auto`` wrapper script, which obtains some dependencies
|
||||
from your OS and puts others in a python virtual environment::
|
||||
If ``certbot`` (or ``letsencrypt``) is packaged for your Unix OS, you can install
|
||||
it from there, and run it by typing ``certbot`` (or ``letsencrypt``).
|
||||
Because not all operating systems have packages yet, we provide a temporary
|
||||
solution via the ``certbot-auto`` wrapper script, which obtains some
|
||||
dependencies from your OS and puts others in a python virtual environment::
|
||||
|
||||
user@webserver:~$ git clone https://github.com/letsencrypt/letsencrypt
|
||||
user@webserver:~$ cd letsencrypt
|
||||
user@webserver:~/letsencrypt$ ./letsencrypt-auto --help
|
||||
user@webserver:~$ git clone https://github.com/certbot/certbot
|
||||
user@webserver:~$ cd certbot
|
||||
user@webserver:~/certbot$ ./certbot-auto --help
|
||||
|
||||
Or for full command line help, type::
|
||||
|
||||
./letsencrypt-auto --help all
|
||||
./certbot-auto --help all
|
||||
|
||||
``letsencrypt-auto`` updates to the latest client release automatically. And
|
||||
since ``letsencrypt-auto`` is a wrapper to ``letsencrypt``, it accepts exactly
|
||||
``certbot-auto`` updates to the latest client release automatically. And
|
||||
since ``certbot-auto`` is a wrapper to ``certbot``, it accepts exactly
|
||||
the same command line flags and arguments. More details about this script and
|
||||
other installation methods can be found `in the User Guide
|
||||
<https://letsencrypt.readthedocs.org/en/latest/using.html#installation>`_.
|
||||
<https://certbot.eff.org/docs/using.html#installation>`_.
|
||||
|
||||
How to run the client
|
||||
---------------------
|
||||
|
||||
In many cases, you can just run ``letsencrypt-auto`` or ``letsencrypt``, and the
|
||||
In many cases, you can just run ``certbot-auto`` or ``certbot``, and the
|
||||
client will guide you through the process of obtaining and installing certs
|
||||
interactively.
|
||||
|
||||
|
|
@ -56,7 +66,7 @@ For instance, if you want to obtain a cert for ``example.com``,
|
|||
``www.example.com``, and ``other.example.net``, using the Apache plugin to both
|
||||
obtain and install the certs, you could do this::
|
||||
|
||||
./letsencrypt-auto --apache -d example.com -d www.example.com -d other.example.net
|
||||
./certbot-auto --apache -d example.com -d www.example.com -d other.example.net
|
||||
|
||||
(The first time you run the command, it will make an account, and ask for an
|
||||
email and agreement to the Let's Encrypt Subscriber Agreement; you can
|
||||
|
|
@ -65,7 +75,7 @@ automate those with ``--email`` and ``--agree-tos``)
|
|||
If you want to use a webserver that doesn't have full plugin support yet, you
|
||||
can still use "standalone" or "webroot" plugins to obtain a certificate::
|
||||
|
||||
./letsencrypt-auto certonly --standalone --email admin@example.com -d example.com -d www.example.com -d other.example.net
|
||||
./certbot-auto certonly --standalone --email admin@example.com -d example.com -d www.example.com -d other.example.net
|
||||
|
||||
|
||||
Understanding the client in more depth
|
||||
|
|
@ -73,21 +83,21 @@ Understanding the client in more depth
|
|||
|
||||
To understand what the client is doing in detail, it's important to
|
||||
understand the way it uses plugins. Please see the `explanation of
|
||||
plugins <https://letsencrypt.readthedocs.org/en/latest/using.html#plugins>`_ in
|
||||
plugins <https://certbot.eff.org/docs/using.html#plugins>`_ in
|
||||
the User Guide.
|
||||
|
||||
Links
|
||||
=====
|
||||
|
||||
Documentation: https://letsencrypt.readthedocs.org
|
||||
Documentation: https://certbot.eff.org/docs
|
||||
|
||||
Software project: https://github.com/letsencrypt/letsencrypt
|
||||
Software project: https://github.com/certbot/certbot
|
||||
|
||||
Notes for developers: https://letsencrypt.readthedocs.org/en/latest/contributing.html
|
||||
Notes for developers: https://certbot.eff.org/docs/contributing.html
|
||||
|
||||
Main Website: https://letsencrypt.org/
|
||||
|
||||
IRC Channel: #letsencrypt on `Freenode`_
|
||||
IRC Channel: #letsencrypt on `Freenode`_ or #certbot on `OFTC`_
|
||||
|
||||
Community: https://community.letsencrypt.org
|
||||
|
||||
|
|
@ -103,12 +113,12 @@ email to client-dev+subscribe@letsencrypt.org)
|
|||
|
||||
|
||||
|
||||
.. |build-status| image:: https://travis-ci.org/letsencrypt/letsencrypt.svg?branch=master
|
||||
:target: https://travis-ci.org/letsencrypt/letsencrypt
|
||||
.. |build-status| image:: https://travis-ci.org/certbot/certbot.svg?branch=master
|
||||
:target: https://travis-ci.org/certbot/certbot
|
||||
:alt: Travis CI status
|
||||
|
||||
.. |coverage| image:: https://coveralls.io/repos/letsencrypt/letsencrypt/badge.svg?branch=master
|
||||
:target: https://coveralls.io/r/letsencrypt/letsencrypt
|
||||
.. |coverage| image:: https://coveralls.io/repos/certbot/certbot/badge.svg?branch=master
|
||||
:target: https://coveralls.io/r/certbot/certbot
|
||||
:alt: Coverage status
|
||||
|
||||
.. |docs| image:: https://readthedocs.org/projects/letsencrypt/badge/
|
||||
|
|
@ -151,10 +161,10 @@ Current Features
|
|||
- standalone (runs its own simple webserver to prove you control a domain)
|
||||
- webroot (adds files to webroot directories in order to prove control of
|
||||
domains and obtain certs)
|
||||
- nginx/0.8.48+ (highly experimental, not included in letsencrypt-auto)
|
||||
- nginx/0.8.48+ (highly experimental, not included in certbot-auto)
|
||||
|
||||
* The private key is generated locally on your system.
|
||||
* Can talk to the Let's Encrypt CA or optionally to other ACME
|
||||
* Can talk to the Let's Encrypt CA or optionally to other ACME
|
||||
compliant services.
|
||||
* Can get domain-validated (DV) certificates.
|
||||
* Can revoke certificates.
|
||||
|
|
@ -169,4 +179,5 @@ Current Features
|
|||
|
||||
|
||||
.. _Freenode: https://webchat.freenode.net?channels=%23letsencrypt
|
||||
.. _OFTC: https://webchat.oftc.net?channels=%23certbot
|
||||
.. _client-dev: https://groups.google.com/a/letsencrypt.org/forum/#!forum/client-dev
|
||||
|
|
|
|||
|
|
@ -314,5 +314,5 @@ texinfo_documents = [
|
|||
intersphinx_mapping = {
|
||||
'python': ('https://docs.python.org/', None),
|
||||
'acme': ('https://acme-python.readthedocs.org/en/latest/', None),
|
||||
'certbot': ('https://letsencrypt.readthedocs.org/en/latest/', None),
|
||||
'certbot': ('https://certbot.eff.org/docs/', None),
|
||||
}
|
||||
|
|
|
|||
|
|
@ -311,7 +311,7 @@ texinfo_documents = [
|
|||
intersphinx_mapping = {
|
||||
'python': ('https://docs.python.org/', None),
|
||||
'acme': ('https://acme-python.readthedocs.org/en/latest/', None),
|
||||
'certbot': ('https://letsencrypt.readthedocs.org/en/latest/', None),
|
||||
'certbot': ('https://certbot.eff.org/docs/', None),
|
||||
'certbot-apache': (
|
||||
'https://letsencrypt-apache.readthedocs.org/en/latest/', None),
|
||||
'certbot-nginx': (
|
||||
|
|
|
|||
|
|
@ -307,5 +307,5 @@ texinfo_documents = [
|
|||
intersphinx_mapping = {
|
||||
'python': ('https://docs.python.org/', None),
|
||||
'acme': ('https://acme-python.readthedocs.org/en/latest/', None),
|
||||
'certbot': ('https://letsencrypt.readthedocs.org/en/latest/', None),
|
||||
'certbot': ('https://certbot.eff.org/docs/', None),
|
||||
}
|
||||
|
|
|
|||
|
|
@ -17,15 +17,13 @@ Autoupdates
|
|||
Within certain limits, TLS server software can choose what kind of
|
||||
cryptography to use when a client connects. These choices can affect
|
||||
security, compatibility, and performance in complex ways. Most of
|
||||
these options are independent of a particular certificate. The Let's
|
||||
Encrypt client tries to provide defaults that we think are most useful
|
||||
to our users.
|
||||
these options are independent of a particular certificate. Certbot
|
||||
tries to provide defaults that we think are most useful to our users.
|
||||
|
||||
As described below, the Let's Encrypt client will default to modifying
|
||||
As described below, Certbot will default to modifying
|
||||
server software's cryptographic settings to keep these up-to-date with
|
||||
what we think are appropriate defaults when new versions of the Let's
|
||||
Encrypt client are installed (for example, by an operating system package
|
||||
manager).
|
||||
what we think are appropriate defaults when new versions of the Certbot
|
||||
are installed (for example, by an operating system package manager).
|
||||
|
||||
When this feature is implemented, this document will be updated
|
||||
to describe how to disable these automatic changes.
|
||||
|
|
@ -54,7 +52,7 @@ improve, others' security. But important information that improves our
|
|||
understanding of the state of the art is published regularly.
|
||||
|
||||
When enabling TLS support in a compatible web server (which is a separate
|
||||
step from obtaining a certificate), Let's Encrypt has the ability to
|
||||
step from obtaining a certificate), Certbot has the ability to
|
||||
update that web server's TLS configuration. Again, this is *different
|
||||
from the cryptographic particulars of the certificate itself*; the
|
||||
certificate as of the initial release will be RSA-signed using one of
|
||||
|
|
@ -80,30 +78,29 @@ art. However, the Let's Encrypt certificate authority does *not*
|
|||
dictate end-users' security policy, and any site is welcome to change
|
||||
its preferences in accordance with its own policy or its administrators'
|
||||
preferences, and use different cryptographic mechanisms or parameters,
|
||||
or a different priority order, than the defaults provided by the Let's
|
||||
Encrypt client.
|
||||
or a different priority order, than the defaults provided by Certbot.
|
||||
|
||||
If you don't use the Let's Encrypt client to configure your server
|
||||
directly, because the client doesn't integrate with your server software
|
||||
or because you chose not to use this integration, then the cryptographic
|
||||
defaults haven't been modified, and the cryptography chosen by the server
|
||||
will still be whatever the default for your software was. For example,
|
||||
if you obtain a certificate using *standalone* mode and then manually
|
||||
install it in an IMAP or LDAP server, your cryptographic settings will
|
||||
not be modified by the client in any way.
|
||||
If you don't use Certbot to configure your server directly, because the
|
||||
client doesn't integrate with your server software or because you chose
|
||||
not to use this integration, then the cryptographic defaults haven't been
|
||||
modified, and the cryptography chosen by the server will still be whatever
|
||||
the default for your software was. For example, if you obtain a
|
||||
certificate using *standalone* mode and then manually install it in an IMAP
|
||||
or LDAP server, your cryptographic settings will not be modified by the
|
||||
client in any way.
|
||||
|
||||
|
||||
Sources of defaults
|
||||
-------------------
|
||||
|
||||
Initially, the Let's Encrypt client will configure users' servers to
|
||||
use the cryptographic defaults recommended by the Mozilla project.
|
||||
These settings are well-reasoned recommendations that carefully
|
||||
consider client software compatibility. They are described at
|
||||
Initially, Certbot will configure users' servers to use the cryptographic
|
||||
defaults recommended by the Mozilla project. These settings are well-reasoned
|
||||
recommendations that carefully consider client software compatibility. They
|
||||
are described at
|
||||
|
||||
https://wiki.mozilla.org/Security/Server_Side_TLS
|
||||
|
||||
and the version implemented by the Let's Encrypt client will be the
|
||||
and the version implemented by Certbot will be the
|
||||
version that was most current as of the release date of each client
|
||||
version. Mozilla offers three separate sets of cryptographic options,
|
||||
which trade off security and compatibility differently. These are
|
||||
|
|
@ -113,12 +110,12 @@ to most-backwards compatible). The client will follow the Mozilla defaults
|
|||
for the *Intermediate* configuration by default, at least with regards to
|
||||
ciphersuites and TLS versions. Mozilla's web site describes which client
|
||||
software will be compatible with each configuration. You can also use
|
||||
the Qualys SSL Labs site, which the Let's Encrypt software will suggest
|
||||
the Qualys SSL Labs site, which Certbot will suggest
|
||||
when installing a certificate, to test your server and see whether it
|
||||
will be compatible with particular software versions.
|
||||
|
||||
It will be possible to ask the Let's Encrypt client to instead apply
|
||||
(and track) Modern or Old configurations.
|
||||
It will be possible to ask Certbot to instead apply (and track) Modern
|
||||
or Old configurations.
|
||||
|
||||
The Let's Encrypt project expects to follow the Mozilla recommendations
|
||||
in the future as those recommendations are updated. (For example, some
|
||||
|
|
@ -127,15 +124,15 @@ which uses the ChaCha and Poly1305 algorithms, and which is already
|
|||
implemented by the Chrome browser. Mozilla has delayed recommending
|
||||
``0xcc13`` over compatibility and standardization concerns, but is likely
|
||||
to recommend it in the future once these concerns have been addressed. At
|
||||
that point, the Let's Encrypt client would likely follow the Mozilla
|
||||
recommendations and favor the use of this ciphersuite as well.)
|
||||
that point, Certbot would likely follow the Mozilla recommendations and favor
|
||||
the use of this ciphersuite as well.)
|
||||
|
||||
The Let's Encrypt project may deviate from the Mozilla recommendations
|
||||
in the future if good cause is shown and we believe our users'
|
||||
priorities would be well-served by doing so. In general, please address
|
||||
relevant proposals for changing priorities to the Mozilla security
|
||||
team first, before asking the Let's Encrypt project to change the
|
||||
client's priorities. The Mozilla security team is likely to have more
|
||||
team first, before asking the Certbot developers to change
|
||||
Certbot's priorities. The Mozilla security team is likely to have more
|
||||
resources and expertise to bring to bear on evaluating reasons why its
|
||||
recommendations should be updated.
|
||||
|
||||
|
|
@ -144,8 +141,8 @@ small number of alternative configurations (apart from Modern,
|
|||
Intermediate, and Old) that there's reason to believe would be widely
|
||||
used by sysadmins; this would usually be a preferable course to modifying
|
||||
an existing configuration. For example, if many sysadmins want their
|
||||
servers configured to track a different expert recommendation, Let's
|
||||
Encrypt could add an option to do so.
|
||||
servers configured to track a different expert recommendation, Certbot
|
||||
could add an option to do so.
|
||||
|
||||
|
||||
Resources for recommendations
|
||||
|
|
@ -156,9 +153,9 @@ recommendations with sources of expert guidance on ciphersuites and other
|
|||
cryptographic parameters. We're grateful to everyone who contributed
|
||||
suggestions. The recommendations we received are available at
|
||||
|
||||
https://github.com/letsencrypt/letsencrypt/wiki/Ciphersuite-guidance
|
||||
https://github.com/certbot/certbot/wiki/Ciphersuite-guidance
|
||||
|
||||
Let's Encrypt client users are welcome to review these authorities to
|
||||
Certbot users are welcome to review these authorities to
|
||||
better inform their own cryptographic parameter choices. We also
|
||||
welcome suggestions of other resources to add to this list. Please keep
|
||||
in mind that different recommendations may reflect different priorities
|
||||
|
|
@ -172,26 +169,25 @@ This will probably look something like
|
|||
|
||||
.. code-block:: shell
|
||||
|
||||
letsencrypt --cipher-recommendations mozilla-secure
|
||||
letsencrypt --cipher-recommendations mozilla-intermediate
|
||||
letsencrypt --cipher-recommendations mozilla-old
|
||||
certbot --cipher-recommendations mozilla-secure
|
||||
certbot --cipher-recommendations mozilla-intermediate
|
||||
certbot --cipher-recommendations mozilla-old
|
||||
|
||||
to track Mozilla's *Secure*, *Intermediate*, or *Old* recommendations,
|
||||
and
|
||||
|
||||
.. code-block:: shell
|
||||
|
||||
letsencrypt --update-ciphers on
|
||||
certbot --update-ciphers on
|
||||
|
||||
to enable updating ciphers with each new Let's Encrypt client release,
|
||||
or
|
||||
to enable updating ciphers with each new Certbot release, or
|
||||
|
||||
.. code-block:: shell
|
||||
|
||||
letsencrypt --update-ciphers off
|
||||
certbot --update-ciphers off
|
||||
|
||||
to disable automatic configuration updates. These features have not yet
|
||||
been implemented and this syntax may change then they are implemented.
|
||||
been implemented and this syntax may change when they are implemented.
|
||||
|
||||
|
||||
TODO
|
||||
|
|
@ -200,7 +196,7 @@ TODO
|
|||
The status of this feature is tracked as part of issue #1123 in our
|
||||
bug tracker.
|
||||
|
||||
https://github.com/letsencrypt/letsencrypt/issues/1123
|
||||
https://github.com/certbot/certbot/issues/1123
|
||||
|
||||
Prior to implementation of #1123, the client does not actually modify
|
||||
ciphersuites (this is intended to be implemented as a "configuration
|
||||
|
|
|
|||
16
docs/conf.py
16
docs/conf.py
|
|
@ -64,8 +64,8 @@ source_suffix = '.rst'
|
|||
master_doc = 'index'
|
||||
|
||||
# General information about the project.
|
||||
project = u'Let\'s Encrypt'
|
||||
copyright = u'2014-2015, Let\'s Encrypt Project'
|
||||
project = u'Certbot'
|
||||
copyright = u'2014-2016, Certbot Project'
|
||||
|
||||
# The version info for the project you're documenting, acts as replacement for
|
||||
# |version| and |release|, also used in various other places throughout the
|
||||
|
|
@ -225,7 +225,7 @@ html_static_path = ['_static']
|
|||
#html_search_scorer = 'scorer.js'
|
||||
|
||||
# Output file base name for HTML help builder.
|
||||
htmlhelp_basename = 'LetsEncryptdoc'
|
||||
htmlhelp_basename = 'Certbotdoc'
|
||||
|
||||
# -- Options for LaTeX output ---------------------------------------------
|
||||
|
||||
|
|
@ -247,8 +247,8 @@ latex_elements = {
|
|||
# (source start file, target name, title,
|
||||
# author, documentclass [howto, manual, or own class]).
|
||||
latex_documents = [
|
||||
('index', 'LetsEncrypt.tex', u'Let\'s Encrypt Documentation',
|
||||
u'Let\'s Encrypt Project', 'manual'),
|
||||
('index', 'Certbot.tex', u'Certbot Documentation',
|
||||
u'Certbot Project', 'manual'),
|
||||
]
|
||||
|
||||
# The name of an image file (relative to this directory) to place at the top of
|
||||
|
|
@ -277,7 +277,7 @@ latex_documents = [
|
|||
# One entry per manual page. List of tuples
|
||||
# (source start file, name, description, authors, manual section).
|
||||
man_pages = [
|
||||
('index', 'certbot', u'Let\'s Encrypt Documentation',
|
||||
('index', 'certbot', u'Certbot Documentation',
|
||||
[project], 7),
|
||||
('man/certbot', 'certbot', u'certbot script documentation',
|
||||
[project], 1),
|
||||
|
|
@ -293,8 +293,8 @@ man_pages = [
|
|||
# (source start file, target name, title, author,
|
||||
# dir menu entry, description, category)
|
||||
texinfo_documents = [
|
||||
('index', 'LetsEncrypt', u'Let\'s Encrypt Documentation',
|
||||
u'Let\'s Encrypt Project', 'LetsEncrypt', 'One line description of project.',
|
||||
('index', 'Certbot', u'Certbot Documentation',
|
||||
u'Certbot Project', 'Certbot', 'One line description of project.',
|
||||
'Miscellaneous'),
|
||||
]
|
||||
|
||||
|
|
|
|||
|
|
@ -20,8 +20,8 @@ once:
|
|||
|
||||
.. code-block:: shell
|
||||
|
||||
git clone https://github.com/letsencrypt/letsencrypt
|
||||
cd letsencrypt
|
||||
git clone https://github.com/certbot/certbot
|
||||
cd certbot
|
||||
./letsencrypt-auto-source/letsencrypt-auto --os-packages-only
|
||||
./tools/venv.sh
|
||||
|
||||
|
|
@ -57,8 +57,8 @@ your pull request must have thorough unit test coverage, pass our
|
|||
`integration`_ tests, and be compliant with the :ref:`coding style
|
||||
<coding-style>`.
|
||||
|
||||
.. _github issue tracker: https://github.com/letsencrypt/letsencrypt/issues
|
||||
.. _Good Volunteer Task: https://github.com/letsencrypt/letsencrypt/issues?q=is%3Aopen+is%3Aissue+label%3A%22Good+Volunteer+Task%22
|
||||
.. _github issue tracker: https://github.com/certbot/certbot/issues
|
||||
.. _Good Volunteer Task: https://github.com/certbot/certbot/issues?q=is%3Aopen+is%3Aissue+label%3A%22Good+Volunteer+Task%22
|
||||
|
||||
Testing
|
||||
-------
|
||||
|
|
@ -175,8 +175,8 @@ Configurators may implement just one of those).
|
|||
There are also `~certbot.interfaces.IDisplay` plugins,
|
||||
which implement bindings to alternative UI libraries.
|
||||
|
||||
.. _interfaces.py: https://github.com/letsencrypt/letsencrypt/blob/master/certbot/interfaces.py
|
||||
.. _plugins/common.py: https://github.com/letsencrypt/letsencrypt/blob/master/certbot/plugins/common.py#L34
|
||||
.. _interfaces.py: https://github.com/certbot/certbot/blob/master/certbot/interfaces.py
|
||||
.. _plugins/common.py: https://github.com/certbot/certbot/blob/master/certbot/plugins/common.py#L34
|
||||
|
||||
|
||||
Authenticators
|
||||
|
|
@ -323,7 +323,7 @@ Steps:
|
|||
See `Known Issues`_. If it's not a known issue, fix any errors.
|
||||
|
||||
.. _Known Issues:
|
||||
https://github.com/letsencrypt/letsencrypt/wiki/Known-issues
|
||||
https://github.com/certbot/certbot/wiki/Known-issues
|
||||
|
||||
Updating the documentation
|
||||
==========================
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
Welcome to the Let's Encrypt client documentation!
|
||||
Welcome to the Certbot documentation!
|
||||
==================================================
|
||||
|
||||
.. toctree::
|
||||
|
|
|
|||
|
|
@ -3,4 +3,4 @@ Packaging Guide
|
|||
===============
|
||||
|
||||
Documentation can be found at
|
||||
https://github.com/letsencrypt/letsencrypt/wiki/Packaging.
|
||||
https://github.com/certbot/certbot/wiki/Packaging.
|
||||
|
|
|
|||
117
docs/using.rst
117
docs/using.rst
|
|
@ -10,12 +10,12 @@ User Guide
|
|||
Installation
|
||||
============
|
||||
|
||||
.. _letsencrypt-auto:
|
||||
.. _certbot-auto:
|
||||
|
||||
letsencrypt-auto
|
||||
certbot-auto
|
||||
----------------
|
||||
|
||||
``letsencrypt-auto`` is a wrapper which installs some dependencies
|
||||
``certbot-auto`` is a wrapper which installs some dependencies
|
||||
from your OS standard package repositories (e.g. using `apt-get` or
|
||||
`yum`), and for other dependencies it sets up a virtualized Python
|
||||
environment with packages downloaded from PyPI [#venv]_. It also
|
||||
|
|
@ -25,33 +25,33 @@ To install and run the client, just type...
|
|||
|
||||
.. code-block:: shell
|
||||
|
||||
./letsencrypt-auto
|
||||
./certbot-auto
|
||||
|
||||
.. hint:: During the beta phase, Let's Encrypt enforces strict rate limits on
|
||||
the number of certificates issued for one domain. It is recommended to
|
||||
initially use the test server via `--test-cert` until you get the desired
|
||||
.. hint:: The Let's Encrypt servers enforce rate
|
||||
limits on the number of certificates issued for one domain. It is recommended
|
||||
to initially use the test server via `--test-cert` until you get the desired
|
||||
certificates.
|
||||
|
||||
Throughout the documentation, whenever you see references to
|
||||
``letsencrypt`` script/binary, you can substitute in
|
||||
``letsencrypt-auto``. For example, to get basic help you would type:
|
||||
``certbot`` script/binary, you can substitute in
|
||||
``certbot-auto``. For example, to get basic help you would type:
|
||||
|
||||
.. code-block:: shell
|
||||
|
||||
./letsencrypt-auto --help
|
||||
./certbot-auto --help
|
||||
|
||||
or for full help, type:
|
||||
|
||||
.. code-block:: shell
|
||||
|
||||
./letsencrypt-auto --help all
|
||||
./certbot-auto --help all
|
||||
|
||||
|
||||
``letsencrypt-auto`` is the recommended method of running the Let's Encrypt
|
||||
``certbot-auto`` is the recommended method of running the Certbot
|
||||
client beta releases on systems that don't have a packaged version. Debian,
|
||||
Arch Linux, Gentoo, FreeBSD, and OpenBSD now have native packages, so on those
|
||||
systems you can just install ``letsencrypt`` (and perhaps
|
||||
``letsencrypt-apache``). If you'd like to run the latest copy from Git, or
|
||||
systems you can just install ``certbot`` (and perhaps
|
||||
``certbot-apache``). If you'd like to run the latest copy from Git, or
|
||||
run your own locally modified copy of the client, follow the instructions in
|
||||
the :doc:`contributing`. Some `other methods of installation`_ are discussed
|
||||
below.
|
||||
|
|
@ -60,11 +60,11 @@ below.
|
|||
Plugins
|
||||
=======
|
||||
|
||||
The Let's Encrypt client supports a number of different "plugins" that can be
|
||||
The Certbot client supports a number of different "plugins" that can be
|
||||
used to obtain and/or install certificates. Plugins that can obtain a cert
|
||||
are called "authenticators" and can be used with the "certonly" command.
|
||||
Plugins that can install a cert are called "installers". Plugins that do both
|
||||
can be used with the "letsencrypt run" command, which is the default.
|
||||
can be used with the "certbot run" command, which is the default.
|
||||
|
||||
=========== ==== ==== ===============================================================
|
||||
Plugin Auth Inst Notes
|
||||
|
|
@ -79,7 +79,7 @@ standalone_ Y N Uses a "standalone" webserver to obtain a cert. Requires
|
|||
webserver is not supported or not desired.
|
||||
manual_ Y N Helps you obtain a cert by giving you instructions to perform
|
||||
domain validation yourself.
|
||||
nginx_ Y Y Very experimental and not included in letsencrypt-auto_.
|
||||
nginx_ Y Y Very experimental and not included in certbot-auto_.
|
||||
=========== ==== ==== ===============================================================
|
||||
|
||||
There are also a number of third-party plugins for the client, provided by other developers:
|
||||
|
|
@ -130,16 +130,16 @@ specified ``--webroot-path``. So, for instance,
|
|||
|
||||
::
|
||||
|
||||
letsencrypt certonly --webroot -w /var/www/example/ -d www.example.com -d example.com -w /var/www/other -d other.example.net -d another.other.example.net
|
||||
certbot certonly --webroot -w /var/www/example/ -d www.example.com -d example.com -w /var/www/other -d other.example.net -d another.other.example.net
|
||||
|
||||
would obtain a single certificate for all of those names, using the
|
||||
``/var/www/example`` webroot directory for the first two, and
|
||||
``/var/www/other`` for the second two.
|
||||
|
||||
The webroot plugin works by creating a temporary file for each of your requested
|
||||
domains in ``${webroot-path}/.well-known/acme-challenge``. Then the Let's
|
||||
Encrypt validation server makes HTTP requests to validate that the DNS for each
|
||||
requested domain resolves to the server running letsencrypt. An example request
|
||||
domains in ``${webroot-path}/.well-known/acme-challenge``. Then the Let's Encrypt
|
||||
validation server makes HTTP requests to validate that the DNS for each
|
||||
requested domain resolves to the server running certbot. An example request
|
||||
made to your web server would look like:
|
||||
|
||||
::
|
||||
|
|
@ -173,7 +173,7 @@ specified port using each requested domain name.
|
|||
Manual
|
||||
------
|
||||
|
||||
If you'd like to obtain a cert running ``letsencrypt`` on a machine
|
||||
If you'd like to obtain a cert running ``certbot`` on a machine
|
||||
other than your target webserver or perform the steps for domain
|
||||
validation yourself, you can use the manual plugin. While hidden from
|
||||
the UI, you can use the plugin to obtain a cert by specifying
|
||||
|
|
@ -186,7 +186,7 @@ Nginx
|
|||
|
||||
In the future, if you're running Nginx you will hopefully be able to use this
|
||||
plugin to automatically obtain and install your certificate. The Nginx plugin is
|
||||
still experimental, however, and is not installed with letsencrypt-auto_. If
|
||||
still experimental, however, and is not installed with certbot-auto_. If
|
||||
installed, you can select this plugin on the command line by including
|
||||
``--nginx``.
|
||||
|
||||
|
|
@ -194,7 +194,7 @@ Third-party plugins
|
|||
-------------------
|
||||
|
||||
These plugins are listed at
|
||||
https://github.com/letsencrypt/letsencrypt/wiki/Plugins. If you're
|
||||
https://github.com/certbot/certbot/wiki/Plugins. If you're
|
||||
interested, you can also :ref:`write your own plugin <dev-plugin>`.
|
||||
|
||||
Renewal
|
||||
|
|
@ -204,11 +204,11 @@ Renewal
|
|||
days). Make sure you renew the certificates at least once in 3
|
||||
months.
|
||||
|
||||
The ``letsencrypt`` client now supports a ``renew`` action to check
|
||||
The ``certbot`` client now supports a ``renew`` action to check
|
||||
all installed certificates for impending expiry and attempt to renew
|
||||
them. The simplest form is simply
|
||||
|
||||
``letsencrypt renew``
|
||||
``certbot renew``
|
||||
|
||||
This will attempt to renew any previously-obtained certificates that
|
||||
expire in less than 30 days. The same plugin and options that were used
|
||||
|
|
@ -219,14 +219,14 @@ You can also specify hooks to be run before or after a certificate is
|
|||
renewed. For example, if you want to use the standalone_ plugin to renew
|
||||
your certificates, you may want to use a command like
|
||||
|
||||
``letsencrypt renew --standalone --pre-hook "service nginx stop" --post-hook "service nginx start"``
|
||||
``certbot renew --standalone --pre-hook "service nginx stop" --post-hook "service nginx start"``
|
||||
|
||||
This will stop Nginx so standalone can bind to the necessary ports and
|
||||
then restart Nginx after the plugin is finished. The hooks will only be
|
||||
run if a certificate is due for renewal, so you can run this command
|
||||
frequently without unnecessarily stopping your webserver. More
|
||||
information about renewal hooks can be found by running
|
||||
``letsencrypt --help renew``.
|
||||
``certbot --help renew``.
|
||||
|
||||
If you're sure that this command executes successfully without human
|
||||
intervention, you can add the command to ``crontab`` (since certificates
|
||||
|
|
@ -242,9 +242,9 @@ certificate regardless of its age. (This form is not appropriate to run
|
|||
daily because each certificate will be renewed every day, which will
|
||||
quickly run into the certificate authority rate limit.)
|
||||
|
||||
Note that options provided to ``letsencrypt renew`` will apply to
|
||||
Note that options provided to ``certbot renew`` will apply to
|
||||
*every* certificate for which renewal is attempted; for example,
|
||||
``letsencrypt renew --rsa-key-size 4096`` would try to replace every
|
||||
``certbot renew --rsa-key-size 4096`` would try to replace every
|
||||
near-expiry certificate with an equivalent certificate using a 4096-bit
|
||||
RSA public key. If a certificate is successfully renewed using
|
||||
specified options, those options will be saved and used for future
|
||||
|
|
@ -253,12 +253,12 @@ renewals of that certificate.
|
|||
|
||||
An alternative form that provides for more fine-grained control over the
|
||||
renewal process (while renewing specified certificates one at a time),
|
||||
is ``letsencrypt certonly`` with the complete set of subject domains of
|
||||
is ``certbot certonly`` with the complete set of subject domains of
|
||||
a specific certificate specified via `-d` flags. You may also want to
|
||||
include the ``-n`` or ``--noninteractive`` flag to prevent blocking on
|
||||
user input (which is useful when running the command from cron).
|
||||
|
||||
``letsencrypt certonly -n -d example.com -d www.example.com``
|
||||
``certbot certonly -n -d example.com -d www.example.com``
|
||||
|
||||
(All of the domains covered by the certificate must be specified in
|
||||
this case in order to renew and replace the old certificate rather
|
||||
|
|
@ -271,7 +271,7 @@ The ``certonly`` form attempts to renew one individual certificate.
|
|||
Please note that the CA will send notification emails to the address
|
||||
you provide if you do not renew certificates that are about to expire.
|
||||
|
||||
Let's Encrypt is working hard on improving the renewal process, and we
|
||||
Certbot is working hard on improving the renewal process, and we
|
||||
apologize for any inconveniences you encounter in integrating these
|
||||
commands into your individual environment.
|
||||
|
||||
|
|
@ -302,7 +302,7 @@ The following files are available:
|
|||
Private key for the certificate.
|
||||
|
||||
.. warning:: This **must be kept secret at all times**! Never share
|
||||
it with anyone, including Let's Encrypt developers. You cannot
|
||||
it with anyone, including Certbot developers. You cannot
|
||||
put it into a safe, however - your server still needs to access
|
||||
this file in order for SSL/TLS to work.
|
||||
|
||||
|
|
@ -355,7 +355,7 @@ Configuration file
|
|||
==================
|
||||
|
||||
It is possible to specify configuration file with
|
||||
``letsencrypt-auto --config cli.ini`` (or shorter ``-c cli.ini``). An
|
||||
``certbot-auto --config cli.ini`` (or shorter ``-c cli.ini``). An
|
||||
example configuration file is shown below:
|
||||
|
||||
.. include:: ../examples/cli.ini
|
||||
|
|
@ -374,13 +374,14 @@ By default, the following locations are searched:
|
|||
Getting help
|
||||
============
|
||||
|
||||
If you're having problems you can chat with us on `IRC (#letsencrypt @
|
||||
Freenode) <https://webchat.freenode.net?channels=%23letsencrypt>`_ or
|
||||
get support on our `forums <https://community.letsencrypt.org>`_.
|
||||
If you're having problems you can chat with us on `IRC (#certbot @
|
||||
OFTC) <https://webchat.oftc.net?channels=%23certbot>`_ or at
|
||||
`IRC (#letsencrypt @ freenode) <https://webchat.freenode.net?channels=%23letsencrypt>`_
|
||||
or get support on the Let's Encrypt `forums <https://community.letsencrypt.org>`_.
|
||||
|
||||
If you find a bug in the software, please do report it in our `issue
|
||||
tracker
|
||||
<https://github.com/letsencrypt/letsencrypt/issues>`_. Remember to
|
||||
<https://github.com/certbot/certbot/issues>`_. Remember to
|
||||
give us as much information as possible:
|
||||
|
||||
- copy and paste exact command line used and the output (though mind
|
||||
|
|
@ -388,7 +389,7 @@ give us as much information as possible:
|
|||
information, including your email and domains)
|
||||
- copy and paste logs from ``/var/log/letsencrypt`` (though mind they
|
||||
also might contain personally identifiable information)
|
||||
- copy and paste ``letsencrypt --version`` output
|
||||
- copy and paste ``certbot --version`` output
|
||||
- your operating system, including specific version
|
||||
- specify which installation_ method you've chosen
|
||||
|
||||
|
|
@ -405,10 +406,10 @@ plugins cannot reach it from inside the Docker container.
|
|||
|
||||
You should definitely read the :ref:`where-certs` section, in order to
|
||||
know how to manage the certs
|
||||
manually. https://github.com/letsencrypt/letsencrypt/wiki/Ciphersuite-guidance
|
||||
manually. https://github.com/certbot/certbot/wiki/Ciphersuite-guidance
|
||||
provides some information about recommended ciphersuites. If none of
|
||||
these make much sense to you, you should definitely use the
|
||||
letsencrypt-auto_ method, which enables you to use installer plugins
|
||||
certbot-auto_ method, which enables you to use installer plugins
|
||||
that cover both of those hard topics.
|
||||
|
||||
If you're still not convinced and have decided to use this method,
|
||||
|
|
@ -417,7 +418,7 @@ to, `install Docker`_, then issue the following command:
|
|||
|
||||
.. code-block:: shell
|
||||
|
||||
sudo docker run -it --rm -p 443:443 -p 80:80 --name letsencrypt \
|
||||
sudo docker run -it --rm -p 443:443 -p 80:80 --name certbot \
|
||||
-v "/etc/letsencrypt:/etc/letsencrypt" \
|
||||
-v "/var/lib/letsencrypt:/var/lib/letsencrypt" \
|
||||
quay.io/letsencrypt/letsencrypt:latest auth
|
||||
|
|
@ -447,19 +448,19 @@ Operating System Packages
|
|||
|
||||
.. code-block:: shell
|
||||
|
||||
sudo pacman -S letsencrypt letsencrypt-apache
|
||||
sudo pacman -S letsencrypt
|
||||
|
||||
**Debian**
|
||||
|
||||
If you run Debian Stretch or Debian Sid, you can install letsencrypt packages.
|
||||
If you run Debian Stretch or Debian Sid, you can install certbot packages.
|
||||
|
||||
.. code-block:: shell
|
||||
|
||||
sudo apt-get update
|
||||
sudo apt-get install letsencrypt python-letsencrypt-apache
|
||||
sudo apt-get install certbot python-certbot-apache
|
||||
|
||||
If you don't want to use the Apache plugin, you can omit the
|
||||
``python-letsencrypt-apache`` package.
|
||||
``python-certbot-apache`` package.
|
||||
|
||||
Packages exist for Debian Jessie via backports. First you'll have to follow the
|
||||
instructions at http://backports.debian.org/Instructions/ to enable the Jessie backports
|
||||
|
|
@ -477,7 +478,7 @@ repo, if you have not already done so. Then run:
|
|||
|
||||
**Gentoo**
|
||||
|
||||
The official Let's Encrypt client is available in Gentoo Portage. If you
|
||||
The official Certbot client is available in Gentoo Portage. If you
|
||||
want to use the Apache plugin, it has to be installed separately:
|
||||
|
||||
.. code-block:: shell
|
||||
|
|
@ -486,8 +487,12 @@ want to use the Apache plugin, it has to be installed separately:
|
|||
emerge -av app-crypt/letsencrypt-apache
|
||||
|
||||
Currently, only the Apache plugin is included in Portage. However, if you
|
||||
want the nginx plugin, you can use Layman to add the mrueg overlay which
|
||||
does include the nginx plugin package:
|
||||
Warning!
|
||||
You can use Layman to add the mrueg overlay which does include a package for the
|
||||
Certbot Nginx plugin, however, this plugin is known to be buggy and should only
|
||||
be used with caution after creating a backup up your Nginx configuration.
|
||||
We strongly recommend you use the app-crypt/letsencrypt package instead until
|
||||
the Nginx plugin is ready.
|
||||
|
||||
.. code-block:: shell
|
||||
|
||||
|
|
@ -524,7 +529,7 @@ Note: this change is not required for the other plugins.
|
|||
**Other Operating Systems**
|
||||
|
||||
OS packaging is an ongoing effort. If you'd like to package
|
||||
Let's Encrypt client for your distribution of choice please have a
|
||||
Certbot for your distribution of choice please have a
|
||||
look at the :doc:`packaging`.
|
||||
|
||||
|
||||
|
|
@ -540,19 +545,19 @@ whole process is described in the :doc:`contributing`.
|
|||
environment, e.g. ``sudo python setup.py install``, ``sudo pip
|
||||
install``, ``sudo ./venv/bin/...``. These modes of operation might
|
||||
corrupt your operating system and are **not supported** by the
|
||||
Let's Encrypt team!
|
||||
Certbot team!
|
||||
|
||||
|
||||
Comparison of different methods
|
||||
-------------------------------
|
||||
|
||||
Unless you have a very specific requirements, we kindly ask you to use
|
||||
the letsencrypt-auto_ method. It's the fastest, the most thoroughly
|
||||
Unless you have a very specific requirements, we kindly suggest that you use
|
||||
the certbot-auto_ method. It's the fastest, the most thoroughly
|
||||
tested and the most reliable way of getting our software and the free
|
||||
SSL certificates!
|
||||
TLS/SSL certificates!
|
||||
|
||||
Beyond the methods discussed here, other methods may be possible, such as
|
||||
installing Let's Encrypt directly with pip from PyPI or downloading a ZIP
|
||||
installing Certbot directly with pip from PyPI or downloading a ZIP
|
||||
archive from GitHub may be technically possible but are not presently
|
||||
recommended or supported.
|
||||
|
||||
|
|
|
|||
|
|
@ -307,5 +307,5 @@ texinfo_documents = [
|
|||
intersphinx_mapping = {
|
||||
'python': ('https://docs.python.org/', None),
|
||||
'acme': ('https://acme-python.readthedocs.org/en/latest/', None),
|
||||
'certbot': ('https://letsencrypt.readthedocs.org/en/latest/', None),
|
||||
'certbot': ('https://certbot.eff.org/docs/', None),
|
||||
}
|
||||
|
|
|
|||
Loading…
Reference in a new issue