# For Octeth v5.5.5 and newer versions
certbot certonly -d oempro.domain.com \
--non-interactive --agree-tos --email [email protected] \
--preferred-challenges http --webroot -w /var/www/html

# For Octeth v5.5.4 and older versions
certbot certonly --standalone -d oempro.domain.com \
--non-interactive --agree-tos --email [email protected] \
--http-01-port=8888

<aside> ℹ️ HEADS UP! If you plan to use multiple domains for open/read tracking (under delivery settings), add each domain in the command above using the -d parameter multiple times.

</aside>

Certbot will verify the domain and then issue the certificate. Here’s an example output:

certbot certonly --standalone -d oempro.domain.com \
     --non-interactive --agree-tos --email [email protected] \
     --http-01-port=8888

Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator standalone, Installer None
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for oempro.domain.com
Waiting for verification...
Cleaning up challenges

IMPORTANT NOTES:
 - Congratulations! Your certificate and chain have been saved at:
   /etc/letsencrypt/live/oempro.domain.com/fullchain.pem
   Your key file has been saved at:
   /etc/letsencrypt/live/oempro.domain.com/privkey.pem
   Your cert will expire on 2020-03-19. To obtain a new or tweaked
   version of this certificate in the future, simply run certbot
   again. To non-interactively renew *all* of your certificates, run
   "certbot renew"
 - Your account credentials have been saved in your Certbot
   configuration directory at /etc/letsencrypt. You should make a
   secure backup of this folder now. This configuration directory will
   also contain certificates and private keys obtained by Certbot so
   making regular backups of this folder is ideal.
 - If you like Certbot, please consider supporting our work by:

   Donating to ISRG / Let's Encrypt:   <https://letsencrypt.org/donate>
   Donating to EFF:                    <https://eff.org/donate-le>

To make the certificate usable by HAProxy, combine the certificates. Navigate to the opt/oempro/_dockerfiles/letsencrypt/live/ folder, and run:

cat mydomain.com/fullchain.pem mydomain.com/privkey.pem | tee mydomain.com/mydomain.com.pem

Edit the _dockerfiles/haproxy.cfg file, uncomment the HTTPS related lines:

# Enable these lines if you have activated LetsEncrypt SSL
#bind *:443 ssl crt /etc/letsencrypt/live/mydomain.com/mydomain.com.pem
#redirect scheme https if !{ ssl_fc }

Ensure that you replace mydomain.com with your actual domain.

<aside> ℹ️ TIP: If you have multiple certificates for HAProxy, add .pem files separated by space. Example:

</aside>

# Enable these lines if you have activated LetsEncrypt SSL (multiple pem files)
#bind *:443 ssl crt /etc/letsencrypt/live/mydomain.com/mydomain.com.pem crt /etc/letsencrypt/live/mydomain.com/mydomain2.com.pem crt /etc/letsencrypt/live/mydomain.com/mydomain3.com.pem
#redirect scheme https if !{ ssl_fc }

If you make changes to the haproxy.cfg file or Dockerfile-haproxy, follow these steps:

docker-compose build haproxy
docker-compose kill haproxy
docker-compose up -d haproxy

Don’t forget to edit /opt/oempro/data/config.inc.php and change the value of APP_URL from http:// to https://

Adding New Domains To The SSL Certificate

To add a new domain to your existing SSL certificate, use the following command to expand your current SSL certificate:

# For Octeth v5.5.5 and newer versions
certbot certonly --expand -d oempro.domain.com \
--non-interactive --agree-tos --email [email protected] \
--preferred-challenges http --webroot -w /var/www/html

# For Octeth v5.5.4 and older versions
certbot certonly --standalone --expand -d existingdomain.com,newdomain.com --non-interactive --agree-tos --email [email protected] --http-01-port=8888

SSL Certificates

New SSL Certificate Initialization

Adding New Domains To The SSL Certificate

SSL Certificate Renewals