X-Git-Url: https://git.ralfj.de/lets-encrypt-tiny.git/blobdiff_plain/6a5c5964604124bfc0d5caf625c837c94c5fd123..53d17049bb85096d7f640ca1c8960f3dc6362fc9:/letsencrypt-tiny.conf.sample
diff --git a/letsencrypt-tiny.conf.sample b/letsencrypt-tiny.conf.sample
index 55c4f0f..178eead 100644
--- a/letsencrypt-tiny.conf.sample
+++ b/letsencrypt-tiny.conf.sample
@@ -8,29 +8,24 @@ domains =
# The length of secret RSA keys
key-length = 4096
-# File containing the DH parameters, as generated by openssl (optional)
-dh-params = /etc/ssl/dh2048.pem
-chain = /etc/ssl/chains/letsencrypt-x1.crt
-
[timing]
# After how many days should the private key be re-generated?
max-key-age-days = 180
-# How many hours should a new private key be left in staging? (0 for no staging)
+# How many hours should a new private key be left in staging? Remove or set to 0 to enable immediate activation.
staging-hours = 25
# How many days before a certificate expires, should it be renewed?
renew-cert-before-expiry-days = 15
[hooks]
# Called after a new certificate has been obtained.
-# Example usage: Reloading services.
+# Example usage: Reloading services, generating combined "certificate + key chain" file.
post-certchange = /home/user/letsencrypt/cert-hook
# Called after a new certificate has been obtained, *if* there also were changes in the private keys
# Example usage: Updating TLSA records (with the selector being SubjectPublicKeyInfo) in the zone
post-keychange = /home/user/letsencrypt/key-hook
-# Parameters for acme-tiny
+# Parameters for the embedded acme-tiny
[acme]
-acme-tiny = /home/user/letsencrypt/acme-tiny/
account-key = /etc/ssl/private/letsencrypt/account.key
challenge-dir = /srv/acme-challenge/
@@ -38,11 +33,10 @@ challenge-dir = /srv/acme-challenge/
[dirs]
certs = /etc/ssl/mycerts/letsencrypt
keys = /etc/ssl/private/letsencrypt
-csrs = /etc/ssl/private/letsencrypt
backups = /etc/ssl/old/letsencrypt
[files]
-# Base name of the live key and certificate
+# Base name of the live key and certificate.
live = live
-# Base name of the staging key and certificate (optional)
+# Base name of the staging key and certificate. Used during generation of a new key, to avoid trouble if something fails there.
staging = staging