[{"data":1,"prerenderedAt":452},["ShallowReactive",2],{"\u002Fnext\u002Fadministrer\u002Fexploitation\u002Fcertificat":3,"section:\u002Fnext\u002Fadministrer\u002Fexploitation\u002Fcertificat":451},{"id":4,"title":5,"body":6,"description":438,"extension":439,"meta":440,"navigation":441,"path":447,"seo":448,"stem":449,"__hash__":450},"docs\u002F2.next\u002F5.administrer\u002F03.exploitation\u002F6.certificat.md","Certificat SSL",{"type":7,"value":8,"toc":430},"minimark",[9,13,17,22,75,79,123,126,146,156,160,173,211,215,222,249,260,264,267,274,305,308,322,329,340,344,347,413,426],[10,11,5],"h1",{"id":12},"certificat-ssl",[14,15,16],"p",{},"Vous pouvez générer un certificat gratuit avec Let's Encrypt, ou installer votre propre certificat. Cette page concerne une installation auto-hébergée : sur Dokos Cloud, les certificats sont gérés pour vous.",[18,19,21],"h2",{"id":20},"prérequis","Prérequis",[23,24,25,44,47,50,61],"ol",{},[26,27,28,29,33,34,37,38,43],"li",{},"Le bench est en mode DNS multi-tenant (",[30,31,32],"code",{},"bench config dns_multitenant on","). Sinon, la commande s'arrête avec le message ",[30,35,36],{},"You cannot setup SSL without DNS Multitenancy",". Voir ",[39,40,42],"a",{"href":41},"\u002Fnext\u002Fadministrer\u002Fexploitation\u002Fdomaine","Domaines et multi-tenant",".",[26,45,46],{},"Le nom de domaine pointe vers le serveur (entrée DNS de type A).",[26,48,49],{},"Les ports 80 et 443 du serveur sont ouverts.",[26,51,52,53,56,57,60],{},"Vous pouvez lancer des commandes en tant que ",[30,54,55],{},"root"," (",[30,58,59],{},"sudo",").",[26,62,63,67,68,74],{},[64,65,66],"strong",{},"Certbot"," est installé. Suivez les ",[39,69,73],{"href":70,"rel":71},"https:\u002F\u002Fcertbot.eff.org\u002Finstructions",[72],"nofollow","instructions de Certbot"," pour votre système.",[18,76,78],{"id":77},"générer-un-certificat-pour-un-site","Générer un certificat pour un site",[80,81,86],"pre",{"className":82,"code":83,"language":84,"meta":85,"style":85},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","sudo -H bench setup lets-encrypt \u003Csite>\n","bash","",[30,87,88],{"__ignoreMap":85},[89,90,93,96,100,103,106,109,113,116,120],"span",{"class":91,"line":92},"line",1,[89,94,59],{"class":95},"sBMFI",[89,97,99],{"class":98},"sfazB"," -H",[89,101,102],{"class":98}," bench",[89,104,105],{"class":98}," setup",[89,107,108],{"class":98}," lets-encrypt",[89,110,112],{"class":111},"sMK4o"," \u003C",[89,114,115],{"class":98},"sit",[89,117,119],{"class":118},"sTEyZ","e",[89,121,122],{"class":111},">\n",[14,124,125],{},"La commande demande une confirmation : elle arrête Nginx quelques instants, et vos sites sont alors inaccessibles. Ensuite, elle :",[23,127,128,135,138,141],{},[26,129,130,131,134],{},"écrit la configuration de Certbot dans ",[30,132,133],{},"\u002Fetc\u002Fletsencrypt\u002Fconfigs\u002F\u003Csite>.cfg"," ;",[26,136,137],{},"demande le certificat à Let's Encrypt ;",[26,139,140],{},"ajoute le certificat à la configuration du site et régénère la configuration Nginx ;",[26,142,143,144,43],{},"ajoute une tâche planifiée de renouvellement dans la crontab de ",[30,145,55],{},[14,147,148,149,152,153,43],{},"Exemple fictif : ",[30,150,151],{},"sudo -H bench setup lets-encrypt compta.example.com",". Le site répond ensuite sur ",[30,154,155],{},"https:\u002F\u002Fcompta.example.com",[18,157,159],{"id":158},"générer-un-certificat-pour-un-domaine-personnalisé","Générer un certificat pour un domaine personnalisé",[14,161,162,163,166,167,169,170,43],{},"Le domaine doit d'abord être ajouté au site avec ",[30,164,165],{},"bench setup add-domain"," (voir ",[39,168,42],{"href":41},"). Sinon, la commande répond ",[30,171,172],{},"No custom domain named … set for site",[80,174,176],{"className":82,"code":175,"language":84,"meta":85,"style":85},"sudo -H bench setup lets-encrypt \u003Csite> --custom-domain \u003Cdomaine>\n",[30,177,178],{"__ignoreMap":85},[89,179,180,182,184,186,188,190,192,194,196,199,202,204,207,209],{"class":91,"line":92},[89,181,59],{"class":95},[89,183,99],{"class":98},[89,185,102],{"class":98},[89,187,105],{"class":98},[89,189,108],{"class":98},[89,191,112],{"class":111},[89,193,115],{"class":98},[89,195,119],{"class":118},[89,197,198],{"class":111},">",[89,200,201],{"class":98}," --custom-domain",[89,203,112],{"class":111},[89,205,206],{"class":98},"domain",[89,208,119],{"class":118},[89,210,122],{"class":111},[18,212,214],{"id":213},"générer-un-certificat-générique-wildcard","Générer un certificat générique (wildcard)",[14,216,217,218,221],{},"Pour couvrir tous les sous-domaines d'un domaine (",[30,219,220],{},"*.example.com",") :",[80,223,225],{"className":82,"code":224,"language":84,"meta":85,"style":85},"sudo -H bench setup wildcard-ssl example.com --email admin@example.com\n",[30,226,227],{"__ignoreMap":85},[89,228,229,231,233,235,237,240,243,246],{"class":91,"line":92},[89,230,59],{"class":95},[89,232,99],{"class":98},[89,234,102],{"class":98},[89,236,105],{"class":98},[89,238,239],{"class":98}," wildcard-ssl",[89,241,242],{"class":98}," example.com",[89,244,245],{"class":98}," --email",[89,247,248],{"class":98}," admin@example.com\n",[14,250,251,252,255,256,259],{},"Let's Encrypt vérifie alors le domaine par une entrée DNS de type TXT, que vous ajoutez à la main chez votre registraire. ",[30,253,254],{},"--exclude-base-domain"," exclut ",[30,257,258],{},"example.com"," lui-même du certificat.",[18,261,263],{"id":262},"renouveler-un-certificat","Renouveler un certificat",[14,265,266],{},"Un certificat Let's Encrypt est valable 90 jours. Certbot le renouvelle quand il reste moins de 30 jours.",[14,268,269,270,273],{},"La tâche planifiée ajoutée par ",[30,271,272],{},"bench setup lets-encrypt"," lance chaque jour à minuit :",[80,275,277],{"className":82,"code":276,"language":84,"meta":85,"style":85},"certbot renew -a nginx --post-hook \"systemctl reload nginx\"\n",[30,278,279],{"__ignoreMap":85},[89,280,281,284,287,290,293,296,299,302],{"class":91,"line":92},[89,282,283],{"class":95},"certbot",[89,285,286],{"class":98}," renew",[89,288,289],{"class":98}," -a",[89,291,292],{"class":98}," nginx",[89,294,295],{"class":98}," --post-hook",[89,297,298],{"class":111}," \"",[89,300,301],{"class":98},"systemctl reload nginx",[89,303,304],{"class":111},"\"\n",[14,306,307],{},"Si le renouvellement automatique échoue, renouvelez à la main :",[80,309,311],{"className":82,"code":310,"language":84,"meta":85,"style":85},"sudo bench renew-lets-encrypt\n",[30,312,313],{"__ignoreMap":85},[89,314,315,317,319],{"class":91,"line":92},[89,316,59],{"class":95},[89,318,102],{"class":98},[89,320,321],{"class":98}," renew-lets-encrypt\n",[14,323,324,325,328],{},"Cette commande réinstalle la tâche planifiée, arrête Nginx, lance ",[30,326,327],{},"certbot renew",", puis redémarre Nginx.",[330,331,334],"callout",{"color":332,"icon":333},"amber","i-heroicons-exclamation-triangle",[14,335,336,337,43],{},"Pour vérifier la date d'expiration, lancez ",[30,338,339],{},"sudo certbot certificates",[18,341,343],{"id":342},"installer-votre-propre-certificat","Installer votre propre certificat",[14,345,346],{},"Si vous avez déjà un certificat et sa clé privée :",[80,348,350],{"className":82,"code":349,"language":84,"meta":85,"style":85},"bench set-ssl-certificate \u003Csite> \u002Fchemin\u002Fabsolu\u002Fvers\u002Fcertificat.crt\nbench set-ssl-key \u003Csite> \u002Fchemin\u002Fabsolu\u002Fvers\u002Fcle.key\nbench setup nginx\nsudo systemctl reload nginx\n",[30,351,352,371,390,400],{"__ignoreMap":85},[89,353,354,357,360,362,364,366,368],{"class":91,"line":92},[89,355,356],{"class":95},"bench",[89,358,359],{"class":98}," set-ssl-certificate",[89,361,112],{"class":111},[89,363,115],{"class":98},[89,365,119],{"class":118},[89,367,198],{"class":111},[89,369,370],{"class":98}," \u002Fchemin\u002Fabsolu\u002Fvers\u002Fcertificat.crt\n",[89,372,374,376,379,381,383,385,387],{"class":91,"line":373},2,[89,375,356],{"class":95},[89,377,378],{"class":98}," set-ssl-key",[89,380,112],{"class":111},[89,382,115],{"class":98},[89,384,119],{"class":118},[89,386,198],{"class":111},[89,388,389],{"class":98}," \u002Fchemin\u002Fabsolu\u002Fvers\u002Fcle.key\n",[89,391,393,395,397],{"class":91,"line":392},3,[89,394,356],{"class":95},[89,396,105],{"class":98},[89,398,399],{"class":98}," nginx\n",[89,401,403,405,408,411],{"class":91,"line":402},4,[89,404,59],{"class":95},[89,406,407],{"class":98}," systemctl",[89,409,410],{"class":98}," reload",[89,412,399],{"class":98},[14,414,415,416,418,419,422,423,43],{},"Pour un domaine personnalisé, passez les chemins à ",[30,417,165],{}," avec ",[30,420,421],{},"--ssl-certificate"," et ",[30,424,425],{},"--ssl-certificate-key",[427,428,429],"style",{},"html pre.shiki code .sBMFI, html code.shiki .sBMFI{--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html pre.shiki code .sTEyZ, html code.shiki .sTEyZ{--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"title":85,"searchDepth":92,"depth":373,"links":431},[432,433,434,435,436,437],{"id":20,"depth":373,"text":21},{"id":77,"depth":373,"text":78},{"id":158,"depth":373,"text":159},{"id":213,"depth":373,"text":214},{"id":262,"depth":373,"text":263},{"id":342,"depth":373,"text":343},"Générer et renouveler un certificat SSL Let's Encrypt pour un site Dokos auto-hébergé, y compris pour un domaine personnalisé, ou installer votre propre certificat.","md",{"reviewed":441,"last_verified":442,"sources":443},true,"2026-11-04",[444,445,446],"bench:bench\u002Fcommands\u002Fsetup.py","bench:bench\u002Fcommands\u002Futils.py","bench:bench\u002Fconfig\u002Flets_encrypt.py","\u002Fnext\u002Fadministrer\u002Fexploitation\u002Fcertificat",{"title":5,"description":438},"2.next\u002F5.administrer\u002F03.exploitation\u002F6.certificat","PslOIxadcofTzNqvEBxESfPxmvRyDLSCiLVNXOkpaBg",{},1793871715002]