elego

elego

Use the simplest Lego to generate SSL

Install pkg

go get github.com/pkg6/elego

Install

// go install 
go install github.com/pkg6/elego/cmd/elego@latest

// Installation releases compressed file
curl -sSL https://raw.githubusercontent.com/pkg6/elego/main/install.sh | bash

// Installation in China
export GO_VERSION=1.23.9 GO_PACKAGE="github.com/pkg6/elego/cmd/elego@latest" FORCE=1
bash -c "$(curl -fsSL https://gitee.com/zhiqiangwang/sh/raw/main/install/goinstall.sh)"

elego Help

elego --help
NAME:
   elego - Let's Encrypt client written in Go

USAGE:
   elego [global options] [command [command options]]

VERSION:
   v0.2.0

COMMANDS:
   init              Initialize elego configuration and directory
   create            Register an account, then create and install a certificate
   list              List all certificates installed on this machine
   deploy            Deploy the local certificate
                     The script is controlled by environment variables
                     Please check https://github.com/pkg6/elego/blob/main/deploy/README.md

   clear             Clean up all temporary files generated
   scheduled:run     Automatically renew and complete deployment through scheduled tasks
   scheduled:list    List scheduled tasks
   scheduled:remove  Delete scheduled tasks based on domain name
   help, h           Shows a list of commands or help for one command

GLOBAL OPTIONS:
   --server string, -s string  CA hostname (and optionally :port). The server certificate must be trusted in order to avoid further modifications to the client. (default: "https://acme-v02.api.letsencrypt.org/directory") [$ELEGO_SERVER]
   --email string, -m string   Email used for registration and recovery contact. (default: "elego@darwin.com") [$ELEGO_EMAIL]
   --path string               Directory to use for storing the data. (default: "/Users/mac/.elego") [$ELEGO_PATH]
   --kid string                Key identifier from External CA. Used for External Account Binding. [$ELEGO_EAB_KID]
   --hmac string               MAC key from External CA. Should be in Base64 URL Encoding without padding format. Used for External Account Binding. [$ELEGO_EAB_HMAC]
   --dns string                Solve a DNS-01 challenge using the specified provider. Can be mixed with other types of challenges.
      The script is controlled by environment variables
      Please check https://github.com/pkg6/elego/blob/main/edns/README.md
   --http.webroot string                                          Set the webroot folder to use for HTTP-01 based challenges to write directly to the .well-known/acme-challenge file. This disables the built-in server and expects the given directory to be publicly served with access to .well-known/acme-challenge
   --http.memcached-host string [ --http.memcached-host string ]  Set the memcached host(s) to use for HTTP-01 based challenges. Challenges will be written to all specified hosts.
   --http.s3-bucket string                                        Set the S3 bucket name to use for HTTP-01 based challenges. Challenges will be written to the S3 bucket.
   --http.port string                                             Set the port and interface to use for HTTP-01 based challenges to listen on. Supported: interface:port or :port. (default: ":80")
   --domain string, -d string                                     Add a domain to the process. Can be specified multiple times.
   --deploy string                                                Set your publishing method. When it is local, it is deployed to the /etc/nginx/ssl/ directory by default. (default: "local")
   --interval duration                                            Check interval (e.g. 12h, 30m, 1h30m) (default: 24h0m0s) [$ELEGO_RENEW_INTERVAL]
   --help, -h                                                     show help
   --version, -v                                                  print the version

0.2.x usage steps

1. Create SSL certificate

   elego create --domain="test.example.com" --http.webroot="/data/wwwroot/test.example.com"
   

2. Deploy certificate

   elego deploy --domain="test.example.com" --deploy="local"
   

3. Add scheduled tasks to the plan

   elego scheduled:run
   

cat > /etc/systemd/system/elego-scheduled.service << EOF
[Unit]
Description=Start Elego Scheduled Task
After=network.target

[Service]
Type=simple
ExecStart=/usr/local/bin/elego scheduled:run
Restart=always
User=root

[Install]
WantedBy=multi-user.target
EOF

systemctl daemon-reexec
systemctl daemon-reload
systemctl start elego-scheduled.service
systemctl enable elego-scheduled.service
systemctl status elego-scheduled.service

Local deployment. env configuration

cat > ~/.elego/.env << EOF
LOCAL_POST_COMMAND="nginx -s reload"
EOF

use webroot

elego create --domain="test.example.com" --http.webroot="/data/wwwroot/test.example.com"

use dns

https://go-acme.github.io/lego/dns/index.html

export CLOUDFLARE_EMAIL=you@example.com
export CLOUDFLARE_API_KEY=b9841238feb177a84330febba8a83208921177bffe733
elego create --domain="test.example.com" --dns="cloudflare"

Reference Environment Variables and Names

dns Environment Link

use deploy

Reference Environment Variables and Names

deploy Environment Link

//By default, it is saved in the /etc/nginx/ssl directory.
//export LOCAL_CERT_PATH="/home/ubuntu/ssl/test.example.com.pem"
//export LOCAL_KEY_PATH="/home/ubuntu/ssl/test.example.com.key"
elego deploy --domain="test.example.com" --deploy="local"

nginx Block Configuration

listen 443 ssl;
ssl_certificate /etc/nginx/ssl/test.example.com.pem;
ssl_certificate_key /etc/nginx/ssl/test.example.com.key;
ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;
ssl_protocols TLSv1.1 TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers on;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 10m;

kids and hmacEncoded

https://cloud.google.com/certificate-manager/docs/public-ca-tutorial?hl=zh-cn

https://zerossl.com/documentation/acme/generate-eab-credentials/