
## What's the Certbot

When we apply for and use Let's Encrypt's free HTTPS certificate, we need a certificate application and management tool. Then certbot is the officially recommended application tool. We use this tool to apply for and manage our certificates.

certbot supports most Linux distributions and is easy to use. We download and install them directly:

My system here is Ubuntu. If it is CentOS or other distributions, the installation method should be similar. I use the official package to install it directly and quickly.

You can read [here] about what HTTPS is (<https://juejin.im/entry/58d7635e5c497d0057fae036>), and you can read [here] (<https://letsencrypt.org/zh-cn/getting-started/>) about what Let's Encrypt is.

```bash
sudo apt update && sudo apt install certbot
```

After the installation is successful, you need to use the sudo command to run it. Let's run it and see:

```bash
sudo certbot -h
```

## Get certificate

After installing the management tools, we need to apply for a certificate. My web server here is NGINX, and I do not have a static directory for the website, so I use this command to apply:

```bash
sudo certbot certonly --standalone -d example.com -d www.example.com -d m.example.com
```

If your website has a static directory, you can change `--standalone` to `--webroot` and add the `-w` parameter to apply, similar to this:

```bash
sudo certbot certonly --webroot -w /var/www/example -d example.com -d www.example.com
```

When you use `--standalone` to apply for a certificate, you need to turn off nginx, because certbot will enable port 443 to verify your domain name information. If nginx is not turned off, the port will be occupied, so we turn off nginx. I am using ubuntu here. So use this command to shut down nginx:

```bash
sudo services nginx stop
```

## Configure certificate

After the certificate application is completed, the certificate will exist in the `/etc/letsencrypt/live/` directory. Let's check that there are no problems and then open the nginx configuration file to modify the certificate loading path:

```bash
cd /etc/nginx/site-enabled/
```

Edit configuration file

```bash
sudo vim example.com.conf
```

With such content,

```nginx
server {
        server_name example.com www.example.com;
        listen 443;
        ssl on;
        ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

        location / {
           proxy_pass http://127.0.0.1:3999;
           proxy_http_version 1.1;
           proxy_set_header X_FORWARDED_PROTO https;
           proxy_set_header X-Real-IP $remote_addr;
           proxy_set_header X-Forwarded-For $remote_addr;
           proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
           proxy_set_header Host $host;
        }
    }
```

After saving and exiting, use the nginx test command to check whether it work correctly:

```bash
sudo nginx -t
```

If there is no problem, reload it

```bash
sudo service nginx reload
```

Start the nginx

```bash
sudo service nginx start
```

After the startup is successful, you can enter the URL to visit and check whether the certificate activation is successful: `https://example.com` If the certificate is displayed normally, it means success.

## Update certificate

Because the Let's Encrypt certificate is only valid for 90 days, when it expires, we need to refresh the validity period of the certificate before we can continue to use it. Refresh the certificate validity period. Because we are using the `--standalone` mode to install the nginx certificate, we need to refresh the certificate. Sometimes you still need to shut down nginx. Use this command to shut down nginx:

```bash
sudo service nginx stop
```

Then run this command to refresh:

```bash
certbot renew --dry-run
```

Or we can use the system's timer and refresh it when the time is about to end. Let's Encrypt certificate officials say that the certificate expiration time must be less than one month before it can be refreshed. We can configure the refresh time _every_ more than two months That's it. Here we write a cron plan to perform the update operation at 2:15 am every two months.

```bash
15 2 * */2 * root certbot renew --pre-hook "service nginx stop" --post-hook "service nginx start"
```

Then the execution of this command requires the permissions of the root user. We log in as the root user:

```bash
sudo su
```

Then create a file, call it cronfile, and then write this timing plan:

```bash
touch cronfile
```

```bash
echo '15 2 * */2 * root certbot renew --pre-hook "service nginx stop" --post-hook "service nginx start"' > ./cronfile
```

After finishing, run the plan:

```bash
crontab -u root ./cronfile
```

After successful execution, use `-l` to view the plan:

```bash
crontab -l
```

## Finish

Our certificate application ends here, 👏

> This article is reprinted from the blog of [The Universe in the Shell](https://kuokuo.io/2019/08/05/get-lets-encrypt-cert/)


Let's Encrypt makes HTTPS available to everyone for free. In this article, we will introduce how to use the Certbot application tool to configure an SSL certificate for HTTPS of a domain name on a personal server.

Configuring SSL for HTTPS with Certbot + Let's Encrypt + Nginx


### Assignment and Substitution

```bash
a=375
hello=$a
```

### Variables

1. Built-in Variables  
   For example `$HOME $PWD ...`, for more info, see [environ(7)](https://man7.org/linux/man-pages/man7/environ.7.html)
2. Positional Parameters  
   **echo** $para1 $para2 $para3 $para4 $0 $1 $2 $3 $4 $@
3. Special Parameters  
   $? # exit status of a command, function, or the script itself

### Branches

```bash
if [ condition1 ];then
    command_series1
elif [ condition2 ];then
    command_series2
else
    default_command_series3
fi
```

### Loops

### range for

```bash
for arg in `seq 10`; do
  echo $arg
done
```

### for in C-like syntax

```bash
LIMIT=10
for ((a=1; a<=LIMIT; a++)); do
  echo "$a "
done
```

### **while**

```bash
LIMIT=10
a=1
while ((a<=LIMIT)); do
    echo "$a "
    ((a += 1))
done
```

### IO

```bash
command < input-file > output-file    # rewrite
command >> output-file             # appending
```

### Function

```bash
# define a function
function fun_name(){
    command...
}
## or
fun_name(){ # arg1 arg2 arg3
    command...
}


# apply a function
fun_name $arg1 $arg2 $arg3


# dereference
fun_name(){ # arg1
    eval "$1=hello"
}
fun_name arg1
## the above code block is equivalent to
arg1=hello
```

### Debugging

1. take good use of sh(1)  
   for example:  
   sh -n script: checks for syntax  
   sh -v script: echo each command before executing it  
   sh -x script: echo the result of each command in an abbreviated manner
2. use echo
3. use trap

### Parallel

use GNU parallel

### Script with Style

1. Comment your code
2. Avoid using magic number
3. Use exit codes in a systematic and meaningful way
4. Use standardized parameter flags for script invocation


Some basic bash-script code example. It might be help if writing some temporary work-scripts.

NOTE & BLOG

Posts of LINUX

Configuring SSL for HTTPS with Certbot + Let's Encrypt + Nginx

Some Basic Bash-Script Code Block