HowTo: certificat wildcard Let's Encrypt cu DNS-01

DNS-01 iti da certificate wildcard (*.domeniu) fara sa deschizi portul 80 — ideal pt servicii interne. Emitere si reinnoire automata, pas cu pas.

1. Instalare certbot + plugin DNS

sudo apt -y install certbot python3-certbot-dns-cloudflare

2. Credentiale API DNS

# token API Cloudflare cu drept Edit pe zona DNS
sudo mkdir -p /etc/letsencrypt
sudo tee /etc/letsencrypt/cloudflare.ini >/dev/null <<'EOF'
dns_cloudflare_api_token = TOKEN_AICI
EOF
sudo chmod 600 /etc/letsencrypt/cloudflare.ini

3. Emitere wildcard

# certificat WILDCARD (fara port 80 deschis!)
sudo certbot certonly \
  --dns-cloudflare \
  --dns-cloudflare-credentials /etc/letsencrypt/cloudflare.ini \
  -d 'example.com' -d '*.example.com' \
  --agree-tos -m admin@example.com --non-interactive

4. Reinnoire automata

# reinnoire automata (certbot.timer ruleaza deja de 2x/zi)
sudo certbot renew --dry-run
# reincarca serviciul dupa reinnoire:
sudo certbot renew --deploy-hook 'systemctl reload nginx'

5. Verificare

sudo certbot certificates
sudo openssl x509 -in /etc/letsencrypt/live/example.com/cert.pem -noout -dates

Concluzie

Ai un certificat wildcard, reinnoit automat, fara expunere pe port 80 — perfect pt intranet. Il configuram pentru tine.