[Tuto] Obtenir un certificat valide pour Domoticz sous Linux ou Mac

[Chrominator]

Peut-être un problème lié à la version de certbot sur ton système, d'après google

Ça n'affecterait que les dry-run.

Mets à jour certbot, ou alors essaye un renouvellement réel, sans dry-run.

[secator]

merci Chrominator,
j'ai fait un renouvellement direct et ça a marché. ma version certbot est trop vieille ( 0.28.0). Il faut que je trouve comment la mettre à jour en 0.32.0 (je suis une buse en linux).

[Chrominator]

Bonne nouvelle !

(je suis une buse en linux).

Espère une mise à jour venue de ta distribution alors, et assure-toi de la mettre à jour régulièrement...

[Flintstones]

Salut à tous,

Je suis en raspbian 10 buster et une freebox
j'ai suivi la procedure pour créer le certificat SSL, nickel !
Ca fonctionne bien !

Par contre, j'ai essayé de mettre en place la procedure de renouvellement, et ca ne fonctionne pas (ou je n'y arrive pas).
quand je lance : sudo certbot-auto renew --dry-run

Code : Tout sélectionner

Bootstrapping dependencies for Debian-based OSes... (you can skip this with --no-bootstrap)
Atteint :1 http://deb.debian.org/debian stretch-backports InRelease
Atteint :2 http://raspbian.raspberrypi.org/raspbian buster InRelease
Atteint :3 http://archive.raspberrypi.org/debian buster InRelease
Lecture des listes de paquets... Fait
Lecture des listes de paquets... Fait
Construction de l'arbre des dépendances
Lecture des informations d'état... Fait
augeas-lenses est déjà la version la plus récente (1.11.0-3).
ca-certificates est déjà la version la plus récente (20190110).
gcc est déjà la version la plus récente (4:8.3.0-1+rpi2).
libaugeas0 est déjà la version la plus récente (1.11.0-3).
libffi-dev est déjà la version la plus récente (3.2.1-9).
python est déjà la version la plus récente (2.7.16-1).
python-dev est déjà la version la plus récente (2.7.16-1).
python-virtualenv est déjà la version la plus récente (15.1.0+ds-2).
virtualenv est déjà la version la plus récente (15.1.0+ds-2).
libssl-dev est déjà la version la plus récente (1.1.1d-0+deb10u3+rpt1).
openssl est déjà la version la plus récente (1.1.1d-0+deb10u3+rpt1).
0 mis à jour, 0 nouvellement installés, 0 à enlever et 71 non mis à jour.
Creating virtual environment...
Installing Python packages...
Had a problem while installing Python packages.

pip prints the following errors:
=====================================================
Collecting ConfigArgParse==1.0 (from -r /tmp/tmp.tkuyu6XxHd/letsencrypt-auto-requirements.txt (line 12))
  Downloading https://files.pythonhosted.org/packages/66/37/dd9fcb3b19c1dceea450ee994952e311a96dd827bb09ee19169c3427e0d3/ConfigArgParse-1.0.tar.gz (40kB)
Collecting certifi==2019.11.28 (from -r /tmp/tmp.tkuyu6XxHd/letsencrypt-auto-requirements.txt (line 14))
  Downloading https://files.pythonhosted.org/packages/b9/63/df50cac98ea0d5b006c55a399c3bf1db9da7b5a24de7890bc9cfd5dd9e99/certifi-2019.11.28-py2.py3-none-any.whl (156kB)
Collecting cffi==1.13.2 (from -r /tmp/tmp.tkuyu6XxHd/letsencrypt-auto-requirements.txt (line 17))
  Downloading https://files.pythonhosted.org/packages/2d/bf/960e5a422db3ac1a5e612cb35ca436c3fc985ed4b7ed13a1b4879006f450/cffi-1.13.2.tar.gz (460kB)
Collecting chardet==3.0.4 (from -r /tmp/tmp.tkuyu6XxHd/letsencrypt-auto-requirements.txt (line 51))
  Downloading https://files.pythonhosted.org/packages/bc/a9/01ffebfb562e4274b6487b4bb1ddec7ca55ec7510b22e4c51f14098443b8/chardet-3.0.4-py2.py3-none-any.whl (133kB)
Collecting configobj==5.0.6 (from -r /tmp/tmp.tkuyu6XxHd/letsencrypt-auto-requirements.txt (line 54))
  Downloading https://files.pythonhosted.org/packages/64/61/079eb60459c44929e684fa7d9e2fdca403f67d64dd9dbac27296be2e0fab/configobj-5.0.6.tar.gz
Collecting cryptography==2.8 (from -r /tmp/tmp.tkuyu6XxHd/letsencrypt-auto-requirements.txt (line 56))
  Downloading https://files.pythonhosted.org/packages/be/60/da377e1bed002716fb2d5d1d1cab720f298cb33ecff7bf7adea72788e4e4/cryptography-2.8.tar.gz (504kB)
Collecting distro==1.4.0 (from -r /tmp/tmp.tkuyu6XxHd/letsencrypt-auto-requirements.txt (line 78))
  Downloading https://files.pythonhosted.org/packages/ea/35/82f79b92fa4d937146c660a6482cee4f3dfa1f97ff3d2a6f3ecba33e712e/distro-1.4.0-py2.py3-none-any.whl
Collecting enum34==1.1.6 (from -r /tmp/tmp.tkuyu6XxHd/letsencrypt-auto-requirements.txt (line 81))
  Downloading https://files.pythonhosted.org/packages/c5/db/e56e6b4bbac7c4a06de1c50de6fe1ef3810018ae11732a50f15f62c7d050/enum34-1.1.6-py2-none-any.whl
Collecting funcsigs==1.0.2 (from -r /tmp/tmp.tkuyu6XxHd/letsencrypt-auto-requirements.txt (line 86))
  Downloading https://files.pythonhosted.org/packages/69/cb/f5be453359271714c01b9bd06126eaf2e368f1fddfff30818754b5ac2328/funcsigs-1.0.2-py2.py3-none-any.whl
Collecting idna==2.8 (from -r /tmp/tmp.tkuyu6XxHd/letsencrypt-auto-requirements.txt (line 89))
  Downloading https://files.pythonhosted.org/packages/14/2c/cd551d81dbe15200be1cf41cd03869a46fe7226e7450af7a6545bfc474c9/idna-2.8-py2.py3-none-any.whl (58kB)
Collecting ipaddress==1.0.23 (from -r /tmp/tmp.tkuyu6XxHd/letsencrypt-auto-requirements.txt (line 92))
  Downloading https://files.pythonhosted.org/packages/c2/f8/49697181b1651d8347d24c095ce46c7346c37335ddc7d255833e7cde674d/ipaddress-1.0.23-py2.py3-none-any.whl
Collecting josepy==1.2.0 (from -r /tmp/tmp.tkuyu6XxHd/letsencrypt-auto-requirements.txt (line 95))
  Downloading https://files.pythonhosted.org/packages/de/bb/4949857070b6601eacc209478823745cd79d72cf1c0bb8407aebb772677b/josepy-1.2.0-py2.py3-none-any.whl (57kB)
Collecting mock==1.3.0 (from -r /tmp/tmp.tkuyu6XxHd/letsencrypt-auto-requirements.txt (line 98))
  Downloading https://files.pythonhosted.org/packages/b2/50/664a70b87408bb6c14c1af2337efa64eb8d1af80c933531758b8fb41ec25/mock-1.3.0-py2.py3-none-any.whl (56kB)
Collecting parsedatetime==2.5 (from -r /tmp/tmp.tkuyu6XxHd/letsencrypt-auto-requirements.txt (line 101))
  Downloading https://files.pythonhosted.org/packages/4e/26/7612745a21452f6d822c0868ff7168dd8cf592645b2a553a177e1de43901/parsedatetime-2.5-py2-none-any.whl (40kB)
Collecting pbr==5.4.4 (from -r /tmp/tmp.tkuyu6XxHd/letsencrypt-auto-requirements.txt (line 104))
  Downloading https://files.pythonhosted.org/packages/7a/db/a968fd7beb9fe06901c1841cb25c9ccb666ca1b9a19b114d1bbedf1126fc/pbr-5.4.4-py2.py3-none-any.whl (110kB)
Collecting pyOpenSSL==19.1.0 (from -r /tmp/tmp.tkuyu6XxHd/letsencrypt-auto-requirements.txt (line 107))
  Downloading https://files.pythonhosted.org/packages/9e/de/f8342b68fa9e981d348039954657bdf681b2ab93de27443be51865ffa310/pyOpenSSL-19.1.0-py2.py3-none-any.whl (53kB)
Collecting pyRFC3339==1.1 (from -r /tmp/tmp.tkuyu6XxHd/letsencrypt-auto-requirements.txt (line 110))
  Downloading https://files.pythonhosted.org/packages/c1/7a/725f5c16756ec6211b1e7eeac09f469084595513917ea069bc023c40a5e2/pyRFC3339-1.1-py2.py3-none-any.whl
Collecting pycparser==2.19 (from -r /tmp/tmp.tkuyu6XxHd/letsencrypt-auto-requirements.txt (line 113))
  Downloading https://www.piwheels.org/simple/pycparser/pycparser-2.19-py2.py3-none-any.whl (111kB)
Collecting pyparsing==2.4.6 (from -r /tmp/tmp.tkuyu6XxHd/letsencrypt-auto-requirements.txt (line 115))
  Downloading https://files.pythonhosted.org/packages/5d/bc/1e58593167fade7b544bfe9502a26dc860940a79ab306e651e7f13be68c2/pyparsing-2.4.6-py2.py3-none-any.whl (67kB)
Collecting python-augeas==0.5.0 (from -r /tmp/tmp.tkuyu6XxHd/letsencrypt-auto-requirements.txt (line 118))
  Downloading https://files.pythonhosted.org/packages/41/e6/4b6740cb3e31b82252099994cea751c648b846aa7874343c31d68c2215be/python-augeas-0.5.0.tar.gz (90kB)
Collecting pytz==2019.3 (from -r /tmp/tmp.tkuyu6XxHd/letsencrypt-auto-requirements.txt (line 120))
  Downloading https://files.pythonhosted.org/packages/e7/f9/f0b53f88060247251bf481fa6ea62cd0d25bf1b11a87888e53ce5b7c8ad2/pytz-2019.3-py2.py3-none-any.whl (509kB)
Collecting requests==2.22.0 (from -r /tmp/tmp.tkuyu6XxHd/letsencrypt-auto-requirements.txt (line 123))
  Downloading https://files.pythonhosted.org/packages/51/bd/23c926cd341ea6b7dd0b2a00aba99ae0f828be89d72b2190f27c11d4b7fb/requests-2.22.0-py2.py3-none-any.whl (57kB)
Collecting requests-toolbelt==0.9.1 (from -r /tmp/tmp.tkuyu6XxHd/letsencrypt-auto-requirements.txt (line 126))
  Downloading https://files.pythonhosted.org/packages/60/ef/7681134338fc097acef8d9b2f8abe0458e4d87559c689a8c306d0957ece5/requests_toolbelt-0.9.1-py2.py3-none-any.whl (54kB)
Collecting six==1.14.0 (from -r /tmp/tmp.tkuyu6XxHd/letsencrypt-auto-requirements.txt (line 129))
  Downloading https://files.pythonhosted.org/packages/65/eb/1f97cb97bfc2390a276969c6fae16075da282f5058082d4cb10c6c5c1dba/six-1.14.0-py2.py3-none-any.whl
Collecting urllib3==1.25.8 (from -r /tmp/tmp.tkuyu6XxHd/letsencrypt-auto-requirements.txt (line 132))
  Downloading https://files.pythonhosted.org/packages/e8/74/6e4f91745020f967d09332bb2b8b9b10090957334692eb88ea4afe91b77f/urllib3-1.25.8-py2.py3-none-any.whl (125kB)
Collecting zope.component==4.6 (from -r /tmp/tmp.tkuyu6XxHd/letsencrypt-auto-requirements.txt (line 135))
  Downloading https://www.piwheels.org/simple/zope-component/zope.component-4.6-py2.py3-none-any.whl (70kB)
Collecting zope.deferredimport==4.3.1 (from -r /tmp/tmp.tkuyu6XxHd/letsencrypt-auto-requirements.txt (line 137))
  Downloading https://files.pythonhosted.org/packages/63/e3/05b02057b56cd9c59d848b67aff1cc701e1d2237055ebd0d0c1f44331186/zope.deferredimport-4.3.1-py2.py3-none-any.whl
Collecting zope.deprecation==4.4.0 (from -r /tmp/tmp.tkuyu6XxHd/letsencrypt-auto-requirements.txt (line 140))
  Downloading https://files.pythonhosted.org/packages/f9/26/b935bbf9d27e898b87d80e7873a0200cebf239253d0afe7a59f82fe90fff/zope.deprecation-4.4.0-py2.py3-none-any.whl
Collecting zope.event==4.4 (from -r /tmp/tmp.tkuyu6XxHd/letsencrypt-auto-requirements.txt (line 143))
  Downloading https://files.pythonhosted.org/packages/c5/96/361edb421a077a4c208b4a5c212737d78ae03ce67fbbcd01621c49f332d1/zope.event-4.4-py2.py3-none-any.whl
Collecting zope.hookable==5.0.0 (from -r /tmp/tmp.tkuyu6XxHd/letsencrypt-auto-requirements.txt (line 146))
  Downloading https://files.pythonhosted.org/packages/35/7e/d7ffdd410a9b4aa97d175af1718baa6b741ec6a60baa668354dd3da4e26c/zope.hookable-5.0.0.tar.gz
Collecting zope.interface==4.7.1 (from -r /tmp/tmp.tkuyu6XxHd/letsencrypt-auto-requirements.txt (line 186))
  Downloading https://files.pythonhosted.org/packages/c3/05/bf3130eb799548882ce61b7c3d2dbc5d4d5cc6e821efa8786c5273d56844/zope.interface-4.7.1.tar.gz (151kB)
Collecting zope.proxy==4.3.3 (from -r /tmp/tmp.tkuyu6XxHd/letsencrypt-auto-requirements.txt (line 226))
  Downloading https://files.pythonhosted.org/packages/e2/44/bea546c55488c044351e51ebf23bf440b19876e0069a418cadc1bd5736f7/zope.proxy-4.3.3.tar.gz (44kB)
Collecting letsencrypt==0.7.0 (from -r /tmp/tmp.tkuyu6XxHd/letsencrypt-auto-requirements.txt (line 274))
  Downloading https://files.pythonhosted.org/packages/fd/21/0c6f33829fadec8aca0c1ebb4d6f8101c05899356a58d1b2e506cb77cf18/letsencrypt-0.7.0-py2-none-any.whl
Collecting certbot==1.4.0 (from -r /tmp/tmp.tkuyu6XxHd/letsencrypt-auto-requirements.txt (line 278))
  Downloading https://files.pythonhosted.org/packages/bb/27/54db4db958ab9826ae6eb89b146e5cbb86656d15ca41ff7eb672db6ff782/certbot-1.4.0-py2.py3-none-any.whl (231kB)
Collecting acme==1.4.0 (from -r /tmp/tmp.tkuyu6XxHd/letsencrypt-auto-requirements.txt (line 281))
  Downloading https://files.pythonhosted.org/packages/36/21/7f016a6e725c84f820bac987c85e1d2a7e9060a3bc04a9bffe9bc999d1b3/acme-1.4.0-py2.py3-none-any.whl (41kB)
Collecting certbot-apache==1.4.0 (from -r /tmp/tmp.tkuyu6XxHd/letsencrypt-auto-requirements.txt (line 284))
  Downloading https://files.pythonhosted.org/packages/a6/1b/77393ad0bba2ec4c267102fedd837f23f4725e8d89fe83eaa0bd1bfb2b78/certbot_apache-1.4.0-py2.py3-none-any.whl (88kB)
Collecting certbot-nginx==1.4.0 (from -r /tmp/tmp.tkuyu6XxHd/letsencrypt-auto-requirements.txt (line 287))
  Downloading https://files.pythonhosted.org/packages/76/fc/b7f5acf0dbe1e4eb2dd2711fddcb4529e500d956187a3f71d2da89a6eca8/certbot_nginx-1.4.0-py2.py3-none-any.whl (45kB)
Requirement already satisfied: setuptools>=1.0 in /opt/eff.org/certbot/venv/lib/python2.7/site-packages (from josepy==1.2.0->-r /tmp/tmp.tkuyu6XxHd/letsencrypt-auto-requirements.txt (line 95))
THESE PACKAGES DO NOT MATCH THE HASHES FROM THE REQUIREMENTS FILE. If you have updated the package versions, please update the hashes. Otherwise, examine the package contents carefully; someone may have tampered with them.
    pycparser==2.19 from https://www.piwheels.org/simple/pycparser/pycparser-2.19-py2.py3-none-any.whl#sha256=bc15573b7c6edd24407526dbbc7a0bd33d80d8af44231c37f58d73f56ff9cab6 (from -r /tmp/tmp.tkuyu6XxHd/letsencrypt-auto-requirements.txt (line 113)):
        Expected sha256 a988718abfad80b6b157acce7bf130a30876d27603738ac39f140993246b25b3
             Got        bc15573b7c6edd24407526dbbc7a0bd33d80d8af44231c37f58d73f56ff9cab6

    zope.component==4.6 from https://www.piwheels.org/simple/zope-component/zope.component-4.6-py2.py3-none-any.whl#sha256=74f55521dec189c08d98341edce929eba6bb2404662d1878f1b289af46f6f6a5 (from -r /tmp/tmp.tkuyu6XxHd/letsencrypt-auto-requirements.txt (line 135)):
        Expected sha256 ec2afc5bbe611dcace98bb39822c122d44743d635dafc7315b9aef25097db9e6
             Got        74f55521dec189c08d98341edce929eba6bb2404662d1878f1b289af46f6f6a5
=====================================================

Certbot has problem setting up the virtual environment.

We were not be able to guess the right solution from your pip
output.

Consult https://certbot.eff.org/docs/install.html#problems-with-python-virtual-environment
for possible solutions.
You may also find some support resources at https://certbot.eff.org/support/ .

[xavierlp]

Bonjour Flintstones

D'après @chrominator cela serait du à la version de certbot.

Le renouvellement en dryrun échoue mais fonctionnerait sans cette option....

[Chrominator]

C'est étrange que le renouvellement de certificat conduise à une mise à jour de python.

Je suis sous Ubuntu et je ne fais pas comme ça, j'avais rencontré des difficultés avec le renew.

J'établi au niveau de la box une redirection du port 80 vers mon serveur Domoticz (Phoenix) sur son port 8080.
Ensuite voici le script que j'exécute avec sudo :
(On peut faire un essai en passant dry-run en paramètre).

Code : Tout sélectionner

#!/bin/bash
echo "Le port 80 doit rediriger vers phoenix.local...."
echo "Faire le choix 2 Place files in webroot directory (webroot)"
echo "Le chemin racine pour le service www est /home/pi/domoticz/www/"
echo "Appuyez sur Entrée..."
read key
certbot certonly  --preferred-challenges http -d mondomaine.fr $1
if [ $? == 0 ]; then
  /usr/sbin/service monit stop
  /usr/sbin/service domoticz.sh stop
  /home/pi/bin/makecert.sh
  /usr/sbin/service domoticz.sh start
  /usr/sbin/service monit start
fi

Le script /home/pi/bin/makecert.sh est le suivant :

Code : Tout sélectionner

cat /etc/letsencrypt/live/mondomaine.fr-0001/privkey.pem > /home/pi/domoticz/cert_all.pem
cat /etc/letsencrypt/live/mondomaine.fr-0001/fullchain.pem >> /home/pi/domoticz/cert_all.pem
cat /home/pi/domoticz/dhparam.pem >> /home/pi/domoticz/cert_all.pem

Ce qui donne en exec :

Code : Tout sélectionner

pi@phoenix:~$ sudo /home/pi/bin/getcert.sh
Le port 80 doit rediriger vers phoenix.local....
Faire le choix 2 Place files in webroot directory (webroot)
Le chemin racine pour le service www est /home/pi/domoticz/www/
Appuyez sur Entrée...

Saving debug log to /var/log/letsencrypt/letsencrypt.log

How would you like to authenticate with the ACME CA?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
1: Spin up a temporary webserver (standalone)
2: Place files in webroot directory (webroot)
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Select the appropriate number [1-2] then [enter] (press 'c' to cancel): 2
Plugins selected: Authenticator webroot, Installer None
Cert is due for renewal, auto-renewing...
Renewing an existing certificate
Performing the following challenges:
http-01 challenge for mondomaine.fr
Input the webroot for mondomaine.fr: (Enter 'c' to cancel): /home/pi/domoticz/www/
Waiting for verification...
Cleaning up challenges

IMPORTANT NOTES:
 - Congratulations! Your certificate and chain have been saved at:
   /etc/letsencrypt/live/mondomaine.fr-0001/fullchain.pem
   Your key file has been saved at:
   /etc/letsencrypt/live/mondomaine.fr-0001/privkey.pem
   Your cert will expire on 2020-08-05. To obtain a new or tweaked
   version of this certificate in the future, simply run certbot
   again. To non-interactively renew *all* of your certificates, run
   "certbot renew"
 - If you like Certbot, please consider supporting our work by:

   Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
   Donating to EFF:                    https://eff.org/donate-le

Ensuite je désactive la redirection sur la box.

Certains ici ont certainement mis au point un renouvellement tout automatique, on est preneurs si ça marche à tous les coups.

[Flintstones]

Bonjour Flintstones

D'après @chrominator cela serait du à la version de certbot.

Le renouvellement en dryrun échoue mais fonctionnerait sans cette option....

non fonctionne pas non plus sans le dryrun