HOWTO : Sentora (on Centos) Letsencrypt with Python 2.7

[jeremyotten]

As Letsencryp states that 2.6 is no longer supported in the future here is my guide to set it up with 2.7

Install Python 2.7 op Centos (with alternate install which leaves 2.6 also in place)

Code:

yum install gcc cd /usr/src wget https://www.python.org/ftp/python/2.7.10/Python-2.7.10.tgz tar xzf Python-2.7.10.tgz cd Python-2.7.10 ./configure make altinstall

Install numpy for Python (because we can)

Code:

yum install python27-numpy

Install the letsencrypt Virtual Environment based on Python 2.7 this also removes an already installed letsencrypt version

Code:

yum install git cd /root/tools rm -rf /root/tools/letsencrypt rm -rf /etc/letsencrypt rm -rf /var/lib/letsencrypt rm -rf /root/.local/share git clone https://github.com/letsencrypt/letsencrypt cd letsencrypt sed -i "s|--python python2|--python python2.7|" letsencrypt-auto ./letsencrypt-auto --verbose

If you get somekind of ascii error just ignore @ this stage..

Code:

service httpd stop ./letsencrypt-auto certonly --standalone -d <your vhost domain> service httpd start

Changing Sentora port:
On Sentora Panel go to Admin -> Module Admin -> Apache Config > Override a Virtualhost [Select VHost] ->
Tick Port Override.
Forward Port 80 to Overriden Port: 443

Custom Entry:

Code:

SSLEngine on SSLProtocol ALL -SSLv2 -SSLv3 SSLHonorCipherOrder On SSLCipherSuite ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS SSLCertificateFile /etc/letsencrypt/live/support.randomsolutions.nl/cert.pem SSLCertificateKeyFile /etc/letsencrypt/live/support.randomsolutions.nl/privkey.pem SSLCertificateChainFile /etc/letsencrypt/live/support.randomsolutions.nl/chain.pem # Keeping bellow for future upgrades. # Requires Apache >= 2.4 # SSLCompression off

Wait on daemon update or run it manually and restart apache.

Code:

php -q /etc/sentora/panel/bin/daemon.php service httpd restart

When you get an error on starting stating that 443 is already in use

Code:

vi /etc/sentora/configs/apache/httpd-vhosts.conf put a # before listen 443

How to get an A rating on SSLlabs (Qualys) we also need to disable SSLv3 in the main ssl.conf file

Code:

vi /etc/httpd/conf.d/ssl.conf add -SSLv3 behind SSLProtocol ALL -SSLv2

Code:

service httpd start

done

NOW FOR THE AUTOMATIC RENEWAL PART make a Cronjob

Code:

sudo crontab -e 30 2 * * 1 /root/.local/share/letsencrypt/bin/letsencrypt renew >> /var/log/letsencrypt-renew.log 35 2 * * 1 service httpd restart

Save and exit. This will create a new cron job that will execute the letsencrypt-auto renew command every Monday at 2:30 am, and reload Nginx at 2:35am (so the renewed certificate will be used). The output produced by the command will be piped to a log file located at /var/log/le-renewal.log.

You can verify if it was set OK by

Code:

crontab -l

Done! No Thanks