From 3c34827469cd5ceb716a8c3d97284ec22f7cf5eb Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Alper=20Ebi=C3=A7o=C4=9Flu?= <9526587+ebicoglu@users.noreply.github.com> Date: Mon, 30 Sep 2024 09:47:42 +0300 Subject: [PATCH] tidy up document --- docs/en/deployment/ssl.md | 46 ++++++++++++++++++++++++++------------- 1 file changed, 31 insertions(+), 15 deletions(-) diff --git a/docs/en/deployment/ssl.md b/docs/en/deployment/ssl.md index b74de6f626..152bc1d5a2 100644 --- a/docs/en/deployment/ssl.md +++ b/docs/en/deployment/ssl.md @@ -2,9 +2,11 @@ A website needs an SSL certificate in order to keep user data secure, verify ownership of the website, prevent attackers from creating a fake version of the site, and gain user trust. -This document introduces how to get and use SSL certificate(HTTPS) for your application. +This document introduces how to get and use an SSL certificate(HTTPS) for your application. -## Get a SSL Certificate from a Certificate Authority + + +## Get an SSL Certificate from a Certificate Authority You can get a SSL certificate from a certificate authority (CA) such as [Let's Encrypt](https://letsencrypt.org/) or [Cloudflare](https://www.cloudflare.com/learning/ssl/what-is-an-ssl-certificate/) and so on. @@ -14,40 +16,49 @@ Once you have a certificate, you need to configure your web server to use it. Th * [Host ASP.NET Core on Linux with Nginx: HTTPS configuration](https://learn.microsoft.com/en-us/aspnet/core/host-and-deploy/linux-nginx) * [How to Set Up SSL on IIS 7 or later](https://learn.microsoft.com/en-us/iis/manage/configuring-security/how-to-set-up-ssl-on-iis) -### Example to get a free SSL certificate from Let's Encrypt -We will use [acme.sh](https://github.com/acmesh-official/acme.sh) and Cloudflare DNS API to get a free SSL certificate from Let's Encrypt. -> If you have any problem with the following steps, you can refer to the [acme.sh](https://github.com/acmesh-official/acme.sh/wiki/dnsapi) for more information. +### How to get a free SSL certificate from Let's Encrypt? + +Let's Encrypt is **a free, automated, and open certificate authority (CA)**. It gives the digital certificates to enable HTTPS (SSL/TLS) for websites. To get a free SSL certificate, we will use [acme.sh](https://github.com/acmesh-official/acme.sh) and Cloudflare DNS API to get a free SSL certificate from [Let's Encrypt](https://letsencrypt.org/). + +> If you have any problem with the following steps, you can read the [acme.sh](https://github.com/acmesh-official/acme.sh/wiki/dnsapi) tutorial. + + #### Install [acme.sh](https://github.com/acmesh-official/acme.sh) +Ensure that you have `curl` command in your terminal. And run the following command on your terminal: + ```bash curl https://get.acme.sh | sh -s email=my@example.com ``` + + #### [Cloudflare DNS API token](https://dash.cloudflare.com/profile/api-tokens) -``` + You will need to create an API token which either: -(i) has permissions to edit a single specific DNS zone; or -(ii) has permissions to edit multiple DNS zones. +(i) has permission to edit a single specific DNS zone; or +(ii) has permission to edit multiple DNS zones. -You can do this via your Cloudflare profile page, under the API Tokens section. When your create the token, under Permissions, select Zone > DNS > Edit, and under Zone Resources, only include the specific DNS zones within which you need to perform ACME DNS challenges. +You can do this via your Cloudflare profile page under the API Tokens section. When you create the token, under Permissions, select Zone > DNS > Edit, and under Zone Resources, only include the specific DNS zones within which you need to perform ACME DNS challenges. The API token is a 40-character string that may contain uppercase letters, lowercase letters, numbers, and underscores. You must provide it to acme.sh by setting the environment variable CF_Token to its value, e.g. run export CF_Token="Y_jpG9AnfQmuX5Ss9M_qaNab6SQwme3HWXNDzRWs". -(i) Single DNS zone -You must give acme.sh the zone ID of the DNS zone it needs to edit. This is a 32-character hexadecimal string (e.g. 763eac4f1bcebd8b5c95e9fc50d010b4), and should not be confused with the zone name (e.g. example.com). This zone ID can be found via the Cloudflare dashboard, on the zone's Overview page, in the right-hand sidebar. +**(i) Single DNS zone** +You must give acme.sh the zone ID of the DNS zone it needs to edit. This is a 32-character hexadecimal string (e.g. 763eac4f1bcebd8b5c95e9fc50d010b4), and should not be confused with the zone name (e.g. example.com). This zone ID can be found via the Cloudflare dashboard on the zone's Overview page in the right-hand sidebar. You provide this info by setting the environment variable CF_Zone_ID to this zone ID, e.g. run export CF_Zone_ID="763eac4f1bcebd8b5c95e9fc50d010b4". -(ii) Multiple DNS zones +**(ii) Multiple DNS zones** You must give acme.sh the account ID of the Cloudflare account to which the relevant DNS zones belong. This is a 32-character hexadecimal string, and should not be confused with other account identifiers, such as the account email address (e.g. alice@example.com) or global API key (which is also a 32-character hexadecimal string). This account ID can be found via the Cloudflare dashboard, as the end of the URL when logged in, or on the Overview page of any of your zones, in the right-hand sidebar, beneath the zone ID. You provide this info by setting the environment variable CF_Account_ID to this account ID, e.g. run export CF_Account_ID="763eac4f1bcebd8b5c95e9fc50d010b4". -``` + + #### Issue a certificate @@ -110,11 +121,14 @@ openssl pkcs12 -export \ -passout pass: ``` -If you want to set password for the PFX file, you can set the password with `-passout pass:your_password`. +If you want to set a password for the PFX file, you can set the password with `-passout pass:your_password`. + + ## Common Exceptions -You may encounter the following exceptions, That's mean your **certificate is not trusted by the client or the certificate is not valid**. You will see the SSL certificate error in the browser when you try to access the site. +If you encounter the following exceptions, it means your **certificate is not trusted by the client or the certificate is not valid**. +You will may see the following SSL certificate errors in your browser when you try to access the website. ```cs ---> System.Net.Http.HttpRequestException: The SSL connection could not be established, see inner exception. @@ -126,6 +140,8 @@ You may encounter the following exceptions, That's mean your **certificate is no ---> System.Security.Authentication.AuthenticationException: The remote certificate is invalid because of errors in the certificate chain: UntrustedRoot ``` + + ## References * [ABP IIS Deployment](./index.md)