Objectives

In this lab, you will obtain a free LetsEncrypt certificate for your server.

This requires:

• A public DNS domain
• A way to update the DNS dynamically

If your environment supports this, the instructors will have prepared the DNS for you.

Setup

Re-run the sslsetup script on vtp-proxy:

incus exec vtp-proxy -- sslsetup

When you are prompted for your DNS domain, give the domain prepared by your instructors, for example:

Domain name [none]: host1.nsrcwork.shop

When it says you need to register for DNS service on acme.nsrc.org, this has already been done. Give the responses from here:

Username: 315767a0-83cd-4a17-a916-e60cba144651
Password: AEdVRaGb42KDUZ64Nx5W5aXjUuDI0lFtIyAmb-2N
Subdomain: e3d6c3ba-e432-4288-9f15-bdfd75c0f4dc

With luck, you will get a certificate issued!

Testing

Either from the NSRC wifi network, or from your mobile phone, try connecting to your domain name, e.g. host1.nsrcwork.shop

If it works there will be no certificate error from your browser, and you’ll be asked for a username and password. These are the ones you chose when you first ran sslsetup.

If you have forgotten the username, you can retrieve it like this:

incus exec vtp-proxy -- cat /data/nsrc-passwd

The password is securely hashed. If you’ve forgotten the password, you can reset it: replace <username> with the username.

incus exec vtp-proxy -- htpasswd /data/nsrc-passwd <username>

You should then get a webpage. To get to your cndo1 container, prefix the container name as a subdomain: e.g. yourcontainername.host1.nsrcwork.shop