LetsEncrypt SSL Auto Renewal

[beepdot]

Automatic renewal of SSL certs

Regular Domain

wget https://raw.githubusercontent.com/project-sunbird/sunbird-devops/release-4.8.0/utils/certbot/certbot-ingress-cert.yaml
sed -i 's/dev.sunbirded.org/openstaging.sunbird.org/g' certbot-ingress-cert.yaml   # Replace openstaging.sunbird.org as per your environment
kubectl apply -f certbot-ingress-cert.yaml -n staging                              # Replace the namespace as per your environment

Merge Domain

wget https://raw.githubusercontent.com/project-sunbird/sunbird-devops/release-4.8.0/utils/certbot/certbot-ingress-merge-cert.yaml
sed -i 's/merge.dev.sunbirded.org/merge.openstaging.sunbird.org/g' certbot-ingress-merge-cert.yaml         # Replace merge.openstaging.sunbird.org as per your environment
kubectl apply -f certbot-ingress-merge-cert.yaml -n staging                                                # Replace the namespace as per your environment

Note:

• The namespace should be same as where nginx-public-ingress is running
• The SSL will auto renew on the 85th day (Letsencrypt SSL validity is 90 days)
• If the SSL is expiring before 85 days / already expired, update the cronjob to run in the next 5-10m and let it auto renew the SSL
• Change back the cronjob to 85 days or as per your requirement

Pod Logs

• When the cronjob runs, you should see pod logs as below -

kubectl logs certbot-27449635-fj9q5
service/nginx-public-ingress patched
Account registered.
Requesting a certificate for staging.sunbirded.org
Successfully received certificate.
Certificate is saved at: /etc/letsencrypt/live/openstaging.sunbird.org/fullchain.pem
Key is saved at:         /etc/letsencrypt/live/openstaging.sunbird.org/privkey.pem
This certificate expires on 2022-06-09.
These files will be updated when the certificate renews.
NEXT STEPS:
- The certificate will need to be renewed before it expires. Certbot can automatically renew the certificate in the background, but you may need to take steps to enable that functionality. See https://certbot.org/renewal-setup for instructions.
Saving debug log to /var/log/letsencrypt/letsencrypt.log
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
If you like Certbot, please consider supporting our work by:
 * Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
 * Donating to EFF:                    https://eff.org/donate-le
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
secret/ingress-cert patched
secret/ingress-cert patched
service/nginx-public-ingress patched
daemonset.apps/nginx-public-ingress restarted
Waiting for daemon set "nginx-public-ingress" rollout to finish: 0 out of 4 new pods have been updated...
Waiting for daemon set "nginx-public-ingress" rollout to finish: 0 out of 4 new pods have been updated...
Waiting for daemon set "nginx-public-ingress" rollout to finish: 1 out of 4 new pods have been updated...
Waiting for daemon set "nginx-public-ingress" rollout to finish: 1 out of 4 new pods have been updated...
Waiting for daemon set "nginx-public-ingress" rollout to finish: 1 out of 4 new pods have been updated...
Waiting for daemon set "nginx-public-ingress" rollout to finish: 1 out of 4 new pods have been updated...
Waiting for daemon set "nginx-public-ingress" rollout to finish: 2 out of 4 new pods have been updated...
Waiting for daemon set "nginx-public-ingress" rollout to finish: 2 out of 4 new pods have been updated...
Waiting for daemon set "nginx-public-ingress" rollout to finish: 2 out of 4 new pods have been updated...
Waiting for daemon set "nginx-public-ingress" rollout to finish: 3 out of 4 new pods have been updated...
Waiting for daemon set "nginx-public-ingress" rollout to finish: 3 out of 4 new pods have been updated...
Waiting for daemon set "nginx-public-ingress" rollout to finish: 3 out of 4 new pods have been updated...
Waiting for daemon set "nginx-public-ingress" rollout to finish: 3 of 4 updated pods are available...
daemon set "nginx-public-ingress" successfully rolled out

[srajasimman]

Hi @keshavprasadms Thanks for the automation. we have implemented this in our Diksha staging and non-production domains and it's working as expected.
cc: @santhosh-tg

[beepdot]

@gandham-santhosh