Skip to content

Instantly share code, notes, and snippets.

@mamedov

mamedov/renew_le_certs.sh

Created November 20, 2016 13:15
Show Gist options
  • Star 6 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save mamedov/f3c63322dde1a73537b11c621a4fd02e to your computer and use it in GitHub Desktop.
Save mamedov/f3c63322dde1a73537b11c621a4fd02e to your computer and use it in GitHub Desktop.
Download ZIP
Keep letsencrypt certificates up-to-date on pfSense
Raw
renew_le_certs.sh
#!/bin/sh
readonly cert_folder='/root/.acme.sh/subdomain.example.com'
chflags noschg ${cert_folder}/*.cer ${cert_folder}/*.key
"/root/.acme.sh"/acme.sh --cron --home "/root/.acme.sh"
chflags schg ${cert_folder}/*.cer ${cert_folder}/*.key
/etc/rc.restart_webgui > /dev/null
@mamedov
Copy link
Author

mamedov commented Nov 20, 2016 •
edited

Keep this file running weekly so it keeps your certificate up to date.

Before you start please make sure to create hard links for the following files:

cd /var/etc
ln /root/.acme.sh/subdomain.example.com/fullchain.cer cert.crt
ln /root/.acme.sh/subdomain.example.com/subdomain.example.com.key cert.key

Optional: you can install mailreport package from pfSense to get email reports on each run of this script.
This script can be easily modified to support multiple certificate files manupilation.

@mamedov
Copy link
Author

mamedov commented Nov 20, 2016

The reason of using schg flag is that pfSense webConfigurator keeps rewriting certificate files in a /var/etc folder each restart time. This is a workaround not allowing to change this files.

@hosquiat
Copy link

hosquiat commented Sep 1, 2017

This is great I'm going to try this out today.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment