TRIBURG SSL DEPLOYMENT

Auto-generated from the uploaded PDF TRIBURG_SSL_DEPLOYMENT.pdf. This is an extracted-text rendering for searchability; see the original PDF for exact formatting, diagrams, tables, and images.

TRIBURG SSL DEPLOYMENT
80 Port is not allowed - we have allow the port then we are able to get certificates

1. yum install -y python3 python3-venv libaugeas0
2. python3 -m venv /opt/certbot/
3. /opt/certbot/bin/pip install --upgrade pip
4. /opt/certbot/bin/pip install certbot
5. ln -s /opt/certbot/bin/certbot /usr/local/sbin/certbot
6. /usr/local/sbin/certbot certonly -d $(hostname --fqdn) --standalone --preferred-
   chain "ISRG Root X2" --agree-tos --register-unsafely-without-email
7. cat >> /usr/local/sbin/letsencrypt-zimbra << EOF
      #!/bin/bash
      /usr/local/sbin/certbot certonly -d $(hostname --fqdn) --standalone -n --
      preferred-chain "ISRG Root X2" --agree-tos --register-unsafely-without-email
      cp "/etc/letsencrypt/live/$(hostname --fqdn)/privkey.pem"
      /opt/zimbra/ssl/zimbra/commercial/commercial.key
      chown zimbra:zimbra /opt/zimbra/ssl/zimbra/commercial/commercial.key
      wget -O /tmp/ISRG-X2.pem https://letsencrypt.org/certs/isrg-root-x2.pem
      rm -f "/etc/letsencrypt/live/$(hostname --fqdn)/chainZimbra.pem"
      cp "/etc/letsencrypt/live/$(hostname --fqdn)/chain.pem"
      "/etc/letsencrypt/live/$(hostname --fqdn)/chainZimbra.pem"
      cat /tmp/ISRG-X2.pem >> "/etc/letsencrypt/live/$(hostname --
      fqdn)/chainZimbra.pem"
      chown zimbra:zimbra /etc/letsencrypt -R
      cd /tmp
      su zimbra -c '/opt/zimbra/bin/zmcertmgr deploycrt comm
      "/etc/letsencrypt/live/$(hostname --fqdn)/cert.pem"
      "/etc/letsencrypt/live/$(hostname --fqdn)/chainZimbra.pem"'
      rm -f "/etc/letsencrypt/live/$(hostname --fqdn)/chainZimbra.pem"
      EOF

8.    chmod +rx /usr/local/sbin/letsencrypt-zimbra
9.    ln -s /usr/local/sbin/letsencrypt-zimbra /etc/cron.daily/letsencrypt-zimbra
10.   /etc/cron.daily/letsencrypt-zimbra
11.   sudo su zimbra -c '/opt/zimbra/bin/zmcontrol restart'