Brusch Co Uk

dev.brusch.co.uk

1. Created a wildcard DNS entry in Ionos by creating CNAME record for *.dev to point to bazdev.ydns.eu
2. The renewal of this certificate is handled by certbot on the Nginx Proxy Manager on docker1 (running on metal1).
3. Ensure metal1 is powered up
4. ssh docker1
5. docker exec -it nginxproxymgr-app-1 bash
6. Created wildcard certificate with certbot command certbot -d *.dev.brusch.co.uk --manual --preferred-challenges dns certonly. It will need to be renewed manually by repeating that command, which includes copying the acme-challenge TXT into the DNS server. It was originally executed within the NPM docker host.
7. Create/ update a custom SSL Certificate in Nginx Proxy Manager using privkey_x_.pem and fullchain_x_.pem as Certificate Key and Certificate respectively.

Also *.pi1.brusch.co.uk and *.shed.brusch.co.uk

Same procedure followed for those, on NPM on pi1. The commands are

docker exec -it nginxproxymgr-app-1 bash
certbot -d *.pi1.brusch.co.uk,*.shed.brusch.co.uk --manual --preferred-challenges dns certonly

Then I cat’ed the fiels to save them locally. The next steps are:

• log into NPM (in this case on pi1)
• select SSL Certificates -> Add SSL Certificate -> Custom
• provide name and upload privkey.pem and cert.pem
• apply certificate to relevant hosts.

Lessons Learned

1. One certificate refused to renew because there was a host which used one of the domains in the certificate, but was configured with another SSL certificate on another domain (multiple domain names for the same host). Once the extra domain was removed and the correct SSL certificate configured the SSL cert renewed successfully.