<a class="reference external image-reference" href="http://www.gnu.org/licenses/agpl-3.0-standalone.html"><img alt="License: AGPL-3" src="https://img.shields.io/badge/licence-AGPL--3-blue.svg"> </a> <a name="request-ssl-certificates-from-letsencrypt-org"></a> <h2>Request SSL certificates from letsencrypt.org</h2> <p>This module was written to have your Odoo installation request SSL certificates from <a class="reference external" href="https://letsencrypt.org">https://letsencrypt.org</a> automatically.</p> <a name="installation"></a> <h3>Installation</h3> <p>After installation, this module generates a private key for your account at letsencrypt.org automatically in <code>$data_dir/letsencrypt/account.key</code>. If you want or need to use your own account key, replace the file.</p> <p>For certificate requests to work, your site needs to be accessible via plain HTTP, see below for configuration examples in case you force your clients to the SSL version.</p> <p>After installation, trigger the cronjob <cite>Update letsencrypt certificates</cite> and watch your log for messages.</p> <p>This addon depends on the <code>openssl</code> binary and the <code>acme_tiny</code> and <code>IPy</code> python modules.</p> <p>For installing the OpenSSL binary you can use your distro package manager. For Debian and Ubuntu, that would be:</p> <blockquote> sudo apt-get install openssl</blockquote> <p>For installing the ACME-Tiny python module, use the PIP package manager:</p> <blockquote> sudo pip install acme-tiny</blockquote> <p>For installing the IPy python module, use the PIP package manager:</p> <blockquote> sudo pip install IPy</blockquote> <a name="configuration"></a> <h3>Configuration</h3> <p>This addons requests a certificate for the domain named in the configuration parameter <code>web.base.url</code> - if this comes back as <code>localhost</code> or the like, the module doesn't request anything.</p> <p>If you want your certificate to contain multiple alternative names, just add them as configuration parameters <code>letsencrypt.altname.N</code> with <code>N</code> starting from <code>0</code>. The amount of domains that can be added are subject to <a class="reference external" href="https://community.letsencrypt.org/t/rate-limits-for-lets-encrypt/6769">rate limiting</a>.</p> <p>Note that all those domains must be publicly reachable on port 80 via HTTP, and they must have an entry for <code>.well-known/acme-challenge</code> pointing to your odoo instance.</p> <a name="usage"></a> <h3>Usage</h3> <p>The module sets up a cronjob that requests and renews certificates automatically.</p> <p>After the first run, you'll find a file called <code>domain.crt</code> in <code>$datadir/letsencrypt</code>, configure your SSL proxy to use this file as certificate.</p> <a class="reference external image-reference" href="https://runbot.odoo-community.org/runbot/149/8.0"><img alt="Try me on Runbot" src="https://odoo-community.org/website/image/ir.attachment/5784_f2813bd/datas" /></a> <p>For further information, please visit:</p> <ul class="simple"> <li><a class="reference external" href="https://www.odoo.com/forum/help-1">https://www.odoo.com/forum/help-1</a></li> </ul> <a name="in-depth-configuration"></a> <h3>In depth configuration</h3> <p>This module uses <code>openssl</code> to generate CSRs suitable to be submitted to letsencrypt.org. In order to do this, it copies <code>/etc/ssl/openssl.cnf</code> to a temporary and adapts it according to its needs (currently, that's just adding a <code>[SAN]</code> section if necessary). If you want the module to use another configuration template, set config parameter <code>letsencrypt.openssl.cnf</code>.</p> <p>After refreshing the certificate, the module attempts to run the content of <code>letsencrypt.reload_command</code>, which is by default <code>sudo service nginx reload</code>. Change this to match your server's configuration.</p> <p>You'll also need a matching sudo configuration, like:</p> <pre> <code>your_odoo_user ALL = NOPASSWD: /usr/sbin/service nginx reload</code> </pre> <p>Further, if you force users to https, you'll need something like for nginx:</p> <pre> <code>if ($scheme = &quot;http&quot;) { set $redirect_https 1; } if ($request_uri ~ ^/.well-known/acme-challenge/) { set $redirect_https 0; } if ($redirect_https) { rewrite ^ https://$server_name$request_uri? permanent; }</code> </pre> <p>and this for apache:</p> <pre> <code>RewriteEngine On RewriteCond %{HTTPS} !=on RewriteCond %{REQUEST_URI} &quot;!^/.well-known/&quot; RewriteRule ^/?(.*) https://%{SERVER_NAME}/$1 [R,L]</code> </pre> <p>In case you need to redirect other nginx sites to your Odoo instance, declare an upstream for your odoo instance and do something like:</p> <pre> <code>location /.well-known { proxy_pass http://yourodooupstream; }</code> </pre> <p>If you're using a multi-database installation (with or without dbfilter option) where /web/databse/selector returns a list of more than one database, then you need to add <code>letsencrypt</code> addon to wide load addons list (by default, only <code>web</code> addon), setting <code>--load</code> option. For example, <code>--load=web,letsencrypt</code></p> <a name="bug-tracker"></a> <h3>Bug Tracker</h3> <p>Bugs are tracked on <a class="reference external" href="https://github.com/OCA/server-tools/issues">GitHub Issues</a>. In case of trouble, please check there if your issue has already been reported. If you spotted it first, help us smashing it by providing a detailed and welcomed feedback <a class="reference external" href="https://github.com/OCA/server-tools/issues/new?body=module:%20letsencrypt%0Aversion:%209.0%0A%0A**Steps%20to%20reproduce**%0A-%20...%0A%0A**Current%20behavior**%0A%0A**Expected%20behavior**">here</a>.</p> <a name="credits"></a> <h3>Credits</h3> <a name="contributors"></a> <h4>Contributors</h4> <ul class="simple"> <li>Holger Brunn &lt;<a class="reference external" href="mailto:hbrunn&#64;therp.nl">hbrunn&#64;therp.nl</a>&gt;</li> <li>Antonio Espinosa &lt;<a class="reference external" href="mailto:antonio.espinosa&#64;tecnativa.com">antonio.espinosa&#64;tecnativa.com</a>&gt;</li> <li>Dave Lasley &lt;<a class="reference external" href="mailto:dave&#64;laslabs.com">dave&#64;laslabs.com</a>&gt;</li> <li>Ronald Portier &lt;<a class="reference external" href="mailto:ronald&#64;therp.nl">ronald&#64;therp.nl</a>&gt;</li> </ul> <a name="acme-implementation"></a> <h4>ACME implementation</h4> <ul class="simple"> <li><a class="reference external" href="https://github.com/diafygi/acme-tiny/blob/master/acme_tiny.py">https://github.com/diafygi/acme-tiny/blob/master/acme_tiny.py</a></li> </ul> <a name="icon"></a> <h4>Icon</h4> <ul class="simple"> <li><a class="reference external" href="https://helloworld.letsencrypt.org">https://helloworld.letsencrypt.org</a></li> </ul> <a name="maintainer"></a> <h4>Maintainer</h4> <a class="reference external image-reference" href="https://odoo-community.org"><img alt="Odoo Community Association" src="https://odoo-community.org/logo.png" /></a> <p>This module is maintained by the OCA.</p> <p>OCA, or the Odoo Community Association, is a nonprofit organization whose mission is to support the collaborative development of Odoo features and promote its widespread use.</p> <p>To contribute to this module, please visit <a class="reference external" href="https://odoo-community.org">https://odoo-community.org</a>.</p>