Certbot: Issue and install private CA Manager certificate for Apache, values supplied as command options
Command syntax
At the command-line prompt, use the below command syntax to issue and install a private CA Manager certificate for the Apache web server, supplying certificate values as command options:
sudo certbot --apache --register-unsafely-without-email --eab-kid {MY-KEY-IDENTIFIER} --eab-hmac-key {MY-HMAC-KEY} --server {ACME-URL} --config-dir {MY-CONFIG-DIR} -d {FQDN}Fill in values for the command arguments shown in curly braces, as described below:
Command argument | Description |
|---|---|
| The external account binding key identifier (KID) of the desired certificate profile in DigiCert® Trust Lifecycle Manager. |
| The external account binding HMAC key of the certificate profile. |
| The ACME Directory URL. For hosted DigiCert® ONE accounts, use https://one.digicert.com/mpki/api/v1/acme/v2/directory |
| The local directory path that stores your Certbot configuration files for the current application. The configuration files here control how and where Certbot installs the certificates it downloads. If you omit the |
| The fully qualified domain name you want the certificate to secure. For each FQDN, add an additional |
Example command:
sudo certbot --apache --register-unsafely-without-email --eab-kid zcwmKf9sCnDUZsbCOgnv1ijy46l6UeEYCavSQQirl-g --eab-hmac-key RHZraHBXQUxWTEFGdFhndjRVNmV3S3F6c2VNZDM1QzRURGhjdHF3S1NublJjN3dhVUFObzA0SXJwVHBnU2xnRA --server https://one.digicert.com/mpki/api/v1/acme/v2/directory --config-dir /usr/local/certbot/my_webserver_config/ -d my.host -d alias.my.host
Usage notes
If the requested certificate matches an existing order, DigiCert® Trust Lifecycle Manager applies the default automation action for that order (see ACME automation actions). If there is no matching order, or if the ACME URL includes
?action=enroll, Trust Lifecycle Manager treats it as a new order and enrolls the new certificate for you.This command only works for private certificates issued from CAs in DigiCert® Private CA. For public certificates, you must use additional options to validate the domain through Certbot. For examples, see here (DNS-01 validation method) and here (HTTP-01 validation method).