SSL

Check certificate
https://www.ssllabs.com/ssltest/analyze.html
http://www.panticz.de/Check-SSL-TLS-server-encryption-support

Determine SSL certificate expiration date

openssl x509 -enddate -noout -in www.example.com.pem

List certificate domains

cat *.{crt,pem} | openssl x509 -text | grep DNS
openssl s_client -showcerts -connect www.example.com:443 | openssl x509 -text  | grep DNS

Remove password from private key

openssl rsa -in www.example.key.pass -out www.example.key

Cat / deploy certificate to remote host

ssh host1.example.com cat /root/certificates/example.com/{fullchain1.pem,privkey1.pem} | ssh ${HOST} "cat > /etc/haproxy/ssl/example.com.pem"

Get certificate information

for CERT in *.pem; do
    openssl x509 -subject -enddate -noout -in ${CERT} | paste - -
done

# show all data
openssl x509 -in cert.pem -text -noout

# show expiration date
openssl x509 -enddate -noout -in cert.pem

# show expiration date from p12 file
openssl pkcs12 -in cert1.p12 -legacy -passout pass: -passin pass: | openssl x509 -noout -enddate

# show start date
openssl x509 -startdate -noout -in cert.pem

# show containing DNS names
openssl x509 -text -noout -in fullchain.pem | grep DNS

# show Issuer
openssl x509 -text -noout -in cert.pem | grep Issuer

Show expiration date for multiple certificates

for DIR in $(find * -maxdepth 0 -type d); do
    echo -n "${DIR}: "
    eval openssl x509 -enddate -noout -in "${DIR}/cert*.pem"
done

Marge certificate

openssl dhparam -out dh_parameters.out 2048

for FILE in __example_com.crt QuoVadis_Global_SSL_ICA_G2.crt QuoVadis_Root_CA_2.crt *.key dh_parameters.out; do
    cat "${FILE}"
    echo
done | sed -e "s/\r//g" | sed '/^$/d' > _.example.com.pem

# deploy certificate
rsync --chmod=400 _.example.com.pem root@www1.example.com:/etc/haproxy/ssl/

Letsencrypt
http://www.panticz.de/letsencrypt

Test mailserver SSL
https://ssl-tools.net/mailservers/

Online certificate test
https://www.ssllabs.com/ssltest/analyze.html

letsencrypt / certbot

Installation
https://certbot.eff.org/

#sudo apt-get install -y software-properties-common
#sudo add-apt-repository -y ppa:certbot/certbot
sudo apt-get update
sudo apt-get install -y certbot

# Install certbot package with Ansible:
https://github.com/panticz/ansible/tree/master/roles/certbot

Create certificate and configure nginx

certbot --nginx -d www.example.com

create wildcard certificate

certbot certonly \
  --manual \
  --manual-public-ip-logging-ok \
  --preferred-challenges dns-01 \
  --register-unsafely-without-email \
  --agree-tos \
  --server https://acme-v02.api.letsencrypt.org/directory \
  -d \*.example.com

Pack certificate

sudo tar --exclude=README -C /etc/letsencrypt/live -czhf /tmp/letsencrypt.tar.gz .

Convert to p12

for DIR in $(find * -maxdepth 0 -type d); do
    openssl pkcs12 -export -passout "pass:" -out "${DIR}/${DIR}.p12" -inkey "${DIR}/privkey1.pem" -in "${DIR}/cert1.pem" -certfile "${DIR}/chain1.pem"
done

Force renew certificate

sudo certbot renew --force-renewal

Docker
https://hub.docker.com/r/certbot/certbot/

# request wildcard certificate and store under /tmp

sudo docker run --rm -i -t -v /tmp:/etc/letsencrypt certbot/certbot certonly \
    --manual --manual-public-ip-logging-ok --register-unsafely-without-email \
    --agree-tos --preferred-challenges dns-01 --server https://acme-v02.api.letsencrypt.org/directory \
    -d \*.example.com
sudo ls -l /tmp/archive/example.com/

User guide
https://certbot.eff.org/docs/using.html

Flush cache

sudo systemd-resolve --flush-caches

check TXT DNS entry

dig _acme-challenge.www.example.com TXT

#
# install
#
# Ubuntu Xenial package

ssl