Let's Encrypt and Certbot Guide

This is an original planning guide. It is not a vendor manual, an official standard, or legal advice. Example addresses use documentation ranges. Review every command before you paste it.

What this hour is for

Certbot proves you control a name. HTTP-01 uses a file on the site. DNS-01 uses a TXT record. The command builder drafts the client line. The DNS helper drafts a name like _acme-challenge and tells you to remove the TXT record after the certificate is issued. Neither tool talks to a certificate authority.

example.com is documentation. Do not request a certificate for a name you do not hold. The token is not a password you reuse. The private key does not go in the ticket.

One name. Remove the challenge record when the later window is done. Do not start the request during the reading.

The change you can finish

Apply nothing while you are writing the note. When the lab window opens, it is one change on the host named in the ticket. Read the draft, then the host, then decide.

Rollback is the file, the package version, or the snapshot you saved first. You do not invent a rollback after the only copy is gone.

Write the name you control.
Pick HTTP-01 or DNS-01.
Draft the command.
If DNS-01, plan to remove the TXT record.
Do not send the request during the reading.
Keep the key and the token out of the ticket.

Mistakes that outlive the command

Let's Encrypt and Certbot Guide goes wrong in a small set of ways. The list is here so the ticket can forbid them before the window.

A name you do not hold.
The TXT record left forever.
The token reused as a password.
The private key in git.
The request sent during the reading.

Decisions to write down

One decision for Let's Encrypt and Certbot Guide: The name is yours. The challenge type is written. The TXT removal is in the note if you chose DNS. No request was sent yet. And no secret is in the ticket.

Checks before you call it done

Confirm this before you call the change done: The name is written. HTTP or DNS is written. The helper text says to remove the TXT. No request was sent. And no key is in the note. If one of those fails, stop.

# Name you control only.
# Remove the TXT after issuance.
# The token is not a password.
# example.com is documentation.

Before you leave the host

Let's Encrypt and Certbot Guide ends when the hostname in the prompt matches the hostname in the ticket. If it does not, you are on the wrong host. Stop. A command that succeeded on the wrong host is not progress.

The draft stays a draft until a person has read the names in it. A generator does not log into the host and does not know which disk is empty. You delete a line that names a host, a path, or an account you did not write down.

192.0.2.10/24, gateway 192.0.2.1, 198.51.100.0/24, 203.0.113.0/24, and 2001:db8::/32 are documentation. example.com is a documentation name. They belong in the note. They are not values you leave on a host because a draft included them.

prompt-for-this is a reminder that a secret is missing. It is not a password, a key, or a token you save in the ticket or in git. The real secret stays in the password store.

One change is the window. If two things move and the result is wrong, you will not know which one did it. The next change waits for its own page.

If the same step fails twice, stop for the day. The failure is the result. Adding a forum command beside a half-applied change produces a host nobody can rebuild. Restore the copy you took first.

A second person reads the hostname and the change aloud. If they cannot find them in the ticket, the note is not done. Silence is not agreement. Then leave the host alone.

This page is a planning guide. It is not a vendor manual, not an official standard, and not permission to touch a host you do not administer. You do not disable a firewall, AppArmor, or SELinux to make a check pass.

Tools for this guide

These tools run in the browser on this site. They do not log into your machines.

Web Server Administration Guide

More in this cluster

The pillar for this page, and the next published pages filed with it.

Companion: Security: How SSL/TLS Works.