1) Setup a Local HTTP Server

The following describes setting up a local HTTP server. Note that you can optionally use the temporary web server (or any other supported HTTP server plugins) provided by Certbot. For more information, refer to the Certbot Documentation on Getting certificates (and choosing plugins).

Follow the steps below to setup a local HTTP server (for example Apache with the default working directory /var/www/html):

1. Add the following virtual host under /etc/apache2/sites-available/example.com.conf:
   

   <VirtualHost *:80>

   ServerName example.com

    

   DocumentRoot "/var/www/html/"

    

   </VirtualHost>

   
   

2. Enable the site using the a2ensite command:
   

   sudo a2ensite example.com

   
   

3. Reload the Apache configuration using the reload command:
   

   sudo service apache2 reload

   
   

4. Next, restart Apache:

   sudo /etc/init.d/apache2 restart

   
   

5. Then add the following line to your /etc/hosts file:
   

   127.0.0.1 example.com

   
   

2) Obtain a Certificate using Certbot

To issue a certificate for an identifier (in this case example.com) using Certbot, do the following. It requires that you have Certbot installed on your machine, and that EJBCA is up and running with ACME enabled and with an ACME alias configured with an appropriate end entity profile.

1. To obtain the certificate, run the Certbot certonly sub command:

   sudo certbot --no-verify-ssl certonly --webroot -w /var/www/html/ -d example.com --server https://localhost:8442/ejbca/acme/directory

   Alternatively, to instead issue a certificate for a wildcard domain, enable the Wildcard Certificate Issuance Allowed option on the ACME Configuration Alias page (see Alias Specific Fields) and run the Certbot certonly sub command providing a wildcard domain as identifier:

   sudo certbot --no-verify-ssl certonly --webroot -w /var/www/html/ -d *.example.com --server https://localhost:8442/ejbca/acme/directory

2. If successful, a message similar to the following is displayed:

   IMPORTANT NOTES:
    - Congratulations! Your certificate and chain have been saved at:
    /etc/letsencrypt/live/example.com/fullchain.pem
    Your key file has been saved at:
    /etc/letsencrypt/live/example.com/privkey.pem
    
     Your cert will expire on 2020-08-21. To obtain a new or tweaked version of this certificate in the future, 
     simply run certbot again. To non-interactively renew *all* of your certificates, run "certbot renew"

   If you run the same certbot certonly command twice, Certbot asks if you want to renew the current certificate. To allow renewal using the same Subject DN name, the Enforce Unique DN field on the Edit CA page must be cleared. For more information, see CA Fields.

3. To verify the obtained certificate, go to the EJBCA Admin Web, search for End Entities, and check that there is a End Entity certificate with the status Generated and CN = example.com.

   The error message The client lacks sufficient authorization :: The client lacks sufficient authorization indicates a conflict between the new account creation and existing ACME accounts. To resolve, remove everything under /etc/letsencrypt/live, /etc/letsencrypt/accounts and /etc/letsencrypt/keys and try again.

3) Revoke Certificate

This example covers how to revoke the certificate issued in the previous step.

1. To revoke the issued certificate, run the Certbot revoke command:

   sudo certbot --no-verify-ssl --server https://localhost:8442/ejbca/acme/directory revoke --cert-path /etc/letsencrypt/live/example.com/fullchain.pem

2. When asked to verify deleting the issued certificate, reply with Y. The following success message displays:

   Congratulations! You have successfully revoked the certificate that was located at /etc/letsencrypt/live/example.com/fullchain.pem

3. To verify, go to EJBCA Admin Web and check the status for the corresponding End Entity certificate and ensure that it is revoked.

1) Verifying DNS Server Setup

Ensure that you have a DNS server setup which you can add TXT records to. In this example, dnsmasq is used, included in most Linux distributions.

2) Obtain a Certificate using Certbot

To issue a certificate for an identifier (in this case allow.klaan.nu) using Domain Name System Security Extensions ( DNSSEC ) validation , do the following.

1. To obtain the certificate, run the Certbot certonly sub command and specify the --manual flag to run Certbot interactively and allow preparing the DNS server with the DNS challenge offered by the ACME server:

   sudo certbot --no-verify-ssl certonly --manual --preferred-challenges=dns -d allow.klaan.nu --server https://localhost:8442/ejbca/acme/directory

   Alternatively, to instead issue a certificate for a wildcard domain, enable the Wildcard Certificate Issuance Allowed option on the ACME Configuration Alias page (see Alias Specific Fields) and run the Certbot certonly sub command providing a wildcard domain as identifier:

   sudo certbot --no-verify-ssl certonly --manual --preferred-challenges=dns -d *.allow.klaan.nu --server https://localhost:8442/ejbca/acme/directory

2. Agree to your IP being logged by replying Yes to the following:

   Are you OK with your IP being logged?
   - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
   (Y)es/(N)o:

3. Certbot displays the TXT record challenge offered by the ACME server which have to be provisioned in the DNS server. Before pressing Enter, run the following command to provision the TXT record in dnsmasq:

   sudo dnsmasq --port="1453" --txt-record="_acme-challenge.allow.klaan.nu, pULO3RjCbzqjWH0JK2FQ5BDe-5SI2Eo2Vn1l_fmrtdk" --listen-address="127.0.0.1" --interface="lo" --bind-interfaces

   The port number used above is just an example. Note that the port number must equal the port set for the ACME Alias currently used by the EJBCA ACME server, configured in Admin Web>System Configuration>ACME Configuration. In addition, the DNS Resolver field needs to be set to localhost in the ACME Configuration Alias page, see Alias Specific Fields.

4. After running the above command, press Enter in the Certbot command prompt to continue. A message similar to the following is displayed for a successful certificate issuance:

   IMPORTANT NOTES:
    - Congratulations! Your certificate and chain have been saved at:
      /etc/letsencrypt/live/allow.klaan.nu/fullchain.pem
      Your key file has been saved at:
      /etc/letsencrypt/live/allow.klaan.nu/privkey.pem
      
      Your cert will expire on 2020-08-21. To obtain a new or tweaked version of this certificate in the future, 
      simply run certbot again. To non-interactively renew *all* of your certificates, run "certbot renew"

5. To verify that the certificate is issued in EJBCA, go to the EJBCA Admin Web, and check that the End Entity Search page includes a row with CN = allow.klaan.nu and a valid certificate.

3) Revoke Certificate

This example covers how to revoke the certificate issued in the previous step.

1. To revoke the issued certificate, run the Certbot revoke command:

   sudo certbot --no-verify-ssl --server https://localhost:8442/ejbca/acme/directory revoke --cert-path /etc/letsencrypt/live/allow.klaan.nu/fullchain.pem

2. If successful, the following message displays:

   Congratulations! You have successfully revoked the certificate that was located at /etc/letsencrypt/live/allow.klaan.nu/fullchain.pem

3. To verify, ensure that the certificate is revoked with the reason Unspecified by checking its status in the EJBCA Admin Web End Entity Search page.