How to deploy cert to apache httpd?

[GRIFFCOMMca]

@webprofusion

As certificates can contain up to 100 different domains you’d perhaps be best to name the managed certificate how you want it to appear then use that as part of the filename ( $result.ManagedItem.Name )

When testing script be careful to avoid the Let’s Encrypt rate limits, specifically requesting the same cert multiple times (5 times per week). as @jljtgr mentioned the service runs your script as the Local System user so you probably want to refer to OpenSSL.exe by it’s full path.

Hi

I get that, we use the domain name for the certificate name (sub.domain.com.crt), we created a script per SSL for each domain that has the correct name hard coded as the file name.

Ive bumped in to the rate limit thing already with testing, we have the cert so it appears to work ok… I assume when i request a new one, the old one with its chain doesnt die (as we have one live and tested it too often)?

[jljtgr]

What I meant about users and the GUI is that if you open a cmd window as your local user and type openssl it might know what you’re talking about if your PATH variable contains it. But the service runs as SYSTEM, so it likely would have a different PATH variable that doesn’t know where OpenSSL is. This is one possibility of why it would work in testing but not via the service. Similarly, if you had a mapped network drive configured, the SYSTEM user has no visibility of it, so anything depending on that mapped network drive would fail also.

Requesting a new certificate doesn’t invalidate old ones. They remain valid for their normal lifetime.

[GRIFFCOMMca]

@jljtgr

What I meant about users and the GUI is that if you open a cmd window as your local user and type openssl it might know what you’re talking about if your PATH variable contains it.

When using the GUI to request certificates, does this use the service as system or is the GUI doing it under the local account to get the certificate?

[webprofusion]

For most operations the GUI talks to the background service (Certify.Service), which is running as Local System by default. There is a small subset of diagnostic stuff that runs directly from the GUI including (currently) the powershell test button, but really the test function is a bit limited as it’s not the same as running from the service.

Long term we need to decide if the test facility is the right way to do that - really you probably want to run the last real result through the latest script and ‘Test’ should probably be ‘Run’ instead.

[GRIFFCOMMca]

We configured 2 new domains with scripts and they have all worked as expected, so i would guess it will be ok as a service. However i assume (and hope) this script wont be needed in the new version as its just taking the certs and placing them in the Apache SSL folder with the correct name.

We do not test the scripts as we know they will work as expected.