如何在AWS Load Balancer中续订letsencrypt证书？

Question

我使用letsencrypt生成SSL Cert with standalone选项，然后我成功生成了SSL证书。

我前往AWS Load Balancer在端口433配置一个侦听器，并使用我之前生成的SSL证书导入这种弹出窗口：

然后一切正常，现在我想续订这个SSL证书。我按照instruction更新了我的证书。

我试过了：

./ certbot-auto renew --standalone

=> Checking for new version...
Requesting root privileges to run certbot...
   /root/.local/share/letsencrypt/bin/letsencrypt renew --standalone
No renewals were attempted.

或者再次获得证书 ./ certbot-auto certonly --standalone

Failed authorization procedure. www.atoha.com (tls-sni-01): urn:acme:error:unauthorized :: The client lacks sufficient authorization :: Incorrect validation certificate for TLS-SNI-01 challenge. Requested ef39667c9d782884f8157f30f3e85e81.fb4436208f9bc7c8bdeb19356bb090f2.acme.invalid from 54.179.140.152:443. Received certificate containing 'www.my_domain.com'

IMPORTANT NOTES:
 - The following errors were reported by the server:

   Domain: www.my_domain.com
   Type:   unauthorized
   Detail: Incorrect validation certificate for TLS-SNI-01 challenge.
   Requested ef39667c9d782884f8157f30f3e85e81.fb4436208f9bc7c8bdeb1935
   6bb090f2.acme.invalid from 54.179.140.152:443. Received certificate
   containing 'www.my_domain.com'

   To fix these errors, please make sure that your domain name was
   entered correctly and the DNS A record(s) for that domain
   contain(s) the right IP address.

这意味着我的证书之前已正确生成，现在我想知道如何续订，因为它已接近过期！

谢谢！

Answer 1

你可以试试这个：

bash /opt/letsencrypt/letsencrypt-auto -t --renew-by-default --server https://acme-v01.api.letsencrypt.org/directory certonly --agree-tos --email 'your@email.com' --webroot --webroot-path 'yourwebdirectory_publichtml' -d yourdomain.com -d www.yourdomain.com

其中/opt/letsencrypt/ =您的letsencrypt目录位置

然后将.pem文件的内容放置（复制粘贴）给你的aws elb（我通常在linux中使用cat）：

• 私钥---＆gt; privkey.pem

• 公钥证书---＆gt; fullchain.pem

• 证书链---＆gt;无需填写此

Answer 2

我使用https://github.com/alex/letsencrypt-aws自动处理AWS上的自动续订。它目前唯一没有做的就是删除旧的证书。