2

I have a new server with Rocky Linux 9.5.

I have Apache installed and am creating the certificates I need with Certbot.

When I run:

certbot --apache -d mydomain

after getting the certificate, and creating the configuration file in the current folder, Cerbot adds a line in httpd.conf.

Is there a way to customize the behavior after the certificate is created? Instead of adding a line in my httpd.conf, I prefer that Cerbot create a static link between two files.

I have read the documentation of Certbot; there are several hooks, but all related to the "renew" function.

Any ideas? Thanks.

Greg Askew
  • 39,132
Roberto
  • 135

2 Answers2

4

Did you check the doc for shell hooks?

--deploy-hook DEPLOY_HOOK

Command to be run in a shell once for each successfully issued certificate.

bluepuma77
  • 151
4

Instead of adding a line in my httpd.conf, I would that Cerbot to create a static link between two files.

If you don't want Apache automation, don't use --apache – use certonly --webroot instead.

certbot certonly --webroot -w /srv/http -d example.com

For web certificates, I like aliasing all vhosts' acme-challenge locations to a single path, that way I can continue using the same -w /srv/http regardless of vhost (or regardless of whether a vhost has been defined or not yet):

Alias /.well-known/acme-challenge /srv/http/.well-known/acme-challenge

(This is technically optional – you can instead define the HTTP vhost first, then get the certificate using the appropriate -w path, then finally define the HTTPS vhost, but that's a bit more work.)

It sounds like you plan on using this for a non-web certificate, i.e. without there ever being an Apache vhost. In that case use the default vhost's DocumentRoot as the webroot path.

Either way, certonly lets you obtain certificates using HTTP-01 challenge without actually making Certbot add anything to the web server's configuration. Then you can use --deploy-hook (if it works) or a custom wrapper script to do the rest.

Also, remember that Certbot is not the only ACME client for Linux. Other implementations (Lego, acme.sh, acmetool...) might be more convenient for certain use cases.

grawity
  • 17,092