Well, I already made a blogpost on letsencrypt certificates in payara1.
In this blogpost I mentioned a python script that automatically renews certificates for payara2. Unfortunately, it's not quite a perfect fit for me, as I do not run payara on port 80, which the script requires.
My setup has an nginx running on port 80, that basically forwards all requests to the https version of the website.
So I could simply turn off nginx, re-certify and turn nginx back on.
This simple bash script is as follows:
Running it will give you:
---- Starting.
Saving debug log to /var/log/letsencrypt/letsencrypt.log
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Processing /etc/letsencrypt/renewal/www.mrbear.org.conf
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Cert is due for renewal, auto-renewing...
Plugins selected: Authenticator standalone, Installer None
Starting new HTTPS connection (1): acme-v02.api.letsencrypt.org
Renewing an existing certificate
Performing the following challenges:
http-01 challenge for www.mrbear.org
Waiting for verification...
Cleaning up challenges
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
new certificate deployed without reload, fullchain is
/etc/letsencrypt/live/www.mrbear.org/fullchain.pem
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Congratulations, all renewals succeeded. The following certs have been renewed:
/etc/letsencrypt/live/www.mrbear.org/fullchain.pem (success)
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
---- Adding certificates...
/home/payara/payara5/glassfish/domains/production/config/keystore.jks
Private key with alias [s1as] added to keystore /home/payara/payara5/glassfish/domains/production/config/keystore.jks.
Command add-pkcs8 executed successfully.
---- Disabling http listener...
server.network-config.network-listeners.network-listener.http-listener-2.enabled=false
Command set executed successfully.
---- Enabling http listener...
server.network-config.network-listeners.network-listener.http-listener-2.enabled=true
Command set executed successfully.
---- Done.
And your certificate is renewed. I am most pleased that this is soo easy in Payara/Glassfish.
In order to properly automate this, the master password must be stored somehow, and it's possible to do this via the --passwordfile=passwordfile.txt commandline parameter.
I found a good blogpost on how to do this at .Lost in Coding3.
And also the blogpost on [4] to get me started on how to do this.
Verifying that the keystore contains the appropriate stuff, can be done as follows:
Enter keystore password:
Keystore type: jks
Keystore provider: SUN
Your keystore contains 2 entries
glassfish-instance, Jan 22, 2019, PrivateKeyEntry,
Certificate fingerprint (SHA1): WZ:B6:4N:8V:AT:YP:QC:9N:VT:HA:WI:NQ:B[:V8:0W:YT:B8:AW:YT:VQ
s1as, Sep 25, 2019, PrivateKeyEntry,
Certificate fingerprint (SHA1): N8:5Y:AN:SV:N8:9W:4T:Y7:9W:V9:W4:VT:8Y:WV:4N:W4:VT:FB:8S:4E
To get more information, try:
Or for a specific alias:
References
- [1] Enabling SSL in Payara with certificate from Let's Encrypt.
- https://randomthoughtsonjavaprogramming.blogspot.com/2019/01/enabling-ssl-in-payara-with-certificate.html
- [2] github - Let's encrypt script to retrieve and upload keys/certificates to Payara
- https://gist.github.com/ratcashdev/1b09877d37e02ef5170bf9e60c377f34
- [3] .Lost in Coding - Configure Payara Server passwords in Docker
- https://ondro.inginea.eu/index.php/configure-passwords-in-payara-server-and-glassfish/
- [4] Payara Blog - TLS certificates with Payara Server and Let's Encrypt
- https://blog.payara.fish/configuring-ssl/tls-certificates-with-payara-server-and-lets-encrypt
