I am writing a bash script which bootstraps the whole project infrastructure in the freshly installed server and i want to configure ssl installation with letcecrypt certbot. After I execute line:
certbot --nginx -d $( get_server_name ) -d www.$( get_server_name ).com
I get prompted for few questions. Can certbot be run without any interactions while passing some of the params as arguments or something ?
You can run certbot 'silently' by adding the following options:
--non-interactive --agree-tos -m [email protected]
The full list of config options is available here:
--non-interactive is not fail-proof, and the certificate will still fail to generate if the 3 mandatory flags are missing (see my answer for more info).
Nov 6, 2019 at 11:20
Missing command line flags. For non-interactive execution, you will need to specify a plugin on the command line. Run with '--help plugins' to see a list of options, and see https://eff.org/letsencrypt-plugins for more detail on what the plugins do and how to use them.
--apache, or --nginx, or whatever server you're using. I found the "also include --domains" comment insufficient, by the way - wasn't clear to me that the server name needs to follow it. Here's my full command format, which worked (with root): certbot --nginx --non-interactive --agree-tos --domains example.com --email [email protected]
There are several inline flags and "subcommands" (their nickname) provided by Certbot that can help to automate the process of generating free SSL certificates using Bash or shell scripts.
The most relevant flag as mentioned by @match is:
--noninteractive ...or alternatively... --non-interactiveHowever in reality this flag is not very helpful, because it doesn't do very much. If there are critical flags missing from your script, for example, the certificate will still fail to generate. Frankly, I think it would be better for Certbot to cancel the above flag, because it's rather misleading.
Here are the minimum flags required:
--agree-tos--register-unsafely-without-email ...or... -m [email protected]-d example.com and/or -d www.example.comYou also must specify what type of Let's Encrypt installer plugin (environment) you want, for example you can choose from "standalone" or "manual" etc... for most cases, like a WordPress web server, you should choose "webroot" so that Certbot can easily verify ownership via the public root (make sure access to /.well-known* is not blocked):
--webroot -w /var/www/html/
Here is the complete command we use in SlickStack to install SSL certs:
## install Certbot SSL certificate ##
certbot certonly --noninteractive --agree-tos --cert-name slickstack -d ${SITE_TLD} -d www.${SITE_TLD} -d staging.${SITE_TLD} -d dev.${SITE_TLD} --register-unsafely-without-email --webroot -w /var/www/html/
In our case we hardcode the --cert-name to be slickstack because only one website is installed on each VPS server, so it makes other server admin tasks (and scripts) easier to manage. However, if you are installing several domains and SSL certs on the same server, you could change the subcommand --cert-name to be named after each TLD domain instead, etc. This affects the SSL directory names, thus helping to keep your files/folders nice and tidy.
certbot certonly --noninteractive --agree-tos --cert-name ${SITE_TLD} -d ${SITE_DOMAIN_ONE} -d ${SITE_DOMAIN_TWO} -m ${SSL_EMAIL} --webroot -w /var/www/html/
--agree-tos and -m options to get that out of the way, and then subsequently would not need it. That does not seem to be the case. On a different host I never need to use this and it was long enough ago I don't recall what I did.