ACME Pro with Nginx and Pre-validation

This guide describes the process for installing and using TZ-Bot, to setup automatic issuance of certificates via the ACME protocol. In this guide we will be using a pre-validated domain, and a Nginx server. To use pre-validation, you need an active ACME Pro subscription, as this method of validation does not work with Pay As You Go products.

Prerequisites

**Prerequisites:** - Nginx server installed: **[[sudo apt install nginx]]** - Credentials (Guide:[**Link**](https://trustzone.com/knowledge-base/fetching-your-acme-pro-credentials/)) - Pre validated domain (Guide: [Link](https://trustzone.com/knowledge-base/pre-validating-your-domain-name-on-tcp)) - SSL/TLS enabled on your Nginx server (Guide: [Link](https://trustzone.com/knowledge-base/enabling-ssl-tls-on-nginx/))

Installing TZ-Bot

First, we download the script: [[sudo curl -L https://raw.githubusercontent.com/Trustzone-A-S/TZ-bot-lego/main/tz-lego-combined.sh > /tmp/tz-bot && sudo bash /tmp/tz-bot]] To run TZ-Bot, use this command: [[sudo tz-bot]] TZ-Bot uses Lego as its acme client. The script will prompt you to install Lego, if it is not found on the system. Simply press "**Y**" to install it automatically. You can also press "N" to exit TZ-Bot, if you would rather install lego manually.

Ordering a certificate

Next, to order a certificate, we select option "**1**" in the starting menu from TZ-Bot to enter the "Certificates & Renewals" menu.\ \ Select option "**1**" to "**Order a new certificate**". Then, we are using a pre-validated domain, so we select option "**1**" for "**Pre-validated domain**". Then, we have to provide our EAB credentials, as well as our domain name.\ **Remember** to include an asterisk if ordering a wildcard! (\*.example.com)\ \ We then get the option to select a custom path to save the certificate in. In this guide, we select "**n**", to use the default path which is [[/etc/tz-bot/certs/]] The script will then run Lego with the provided arguments.

To setup automatic renewal, please select "**y**". For this guide, we will be setting up automated reload of our Nginx server. For this, please select option "**1**" for "**Setup Automatic restart of webserver**".\ \ Then select option "2" for "**Nginx**" Lastly, we need to select which command we want to use for reloading our web server. In this guide, we use option "**1**". \ If you need to use "service" instead of "systemctl" feel free to select another option from the list. You can also use option 4, in order to input a custom command. **Tip:**\ Reloading your webserver instead of a hard restart, ensures uptime, and only reloads the configuration, instead of the entire server itself. This should also keep existing connections, instead of dropping them.

**Troubleshooting:**\ If this is your first time using TZ-Bot, you probably have to make changes to your servers configuration, in order to use the new certificates. This first time, you will have to manually reload your server configuration, to pick up the new certificate.

ACME Pro with Nginx and Pre-validation

Prerequisites

Installing TZ-Bot

Ordering a certificate