On the Raspberry PI
Install letsencrypt in /opt/letsencrypt
Install nginx
Create webserver files in /data/webserver.domain/www
On the Modem
Forward port 443 to the Pi
/data/webserver.domain/bin/createcert.sh
#!/bin/sh
echo "Ensure Port 80 is open and forwarded to the webserver."
echo "This script must be run as root."
/opt/letsencrypt/certbot-auto certonly --webroot -w /data/webserver.domain/www --text -d webserver.domain
Create Certificate
On the Modem
Forward port 80 to the Pi
* Note that you may have to move the modem admin port to 81
On the Pi, as root:
# /data/webserver.domain/bin/createcert.sh
On the Modem
Disable port 80 forwarding
#!/bin/shRoot's crontab file
# Update performed over port 443. If certificate has expired, # 80 must be opened, and preferred-challenges needs to be http
/opt/letsencrypt/certbot-auto renew --preferred-challenges tls-sni --webroot -w /data/ds.vizier.uk/www --
text && service nginx reload
13 2 * * * /data/webserver.domain/bin/updatecert >> /var/log/certbot-cron.log