SSL Certificate Automation in DevOps: Complete Guide 2025

#!/bin/bash
# Install Certbot
sudo apt-get update
sudo apt-get install certbot python3-certbot-nginx

# Obtain certificate with automatic nginx configuration
sudo certbot --nginx -d example.com -d www.example.com \
  --non-interactive --agree-tos \
  --email admin@example.com

# Setup automatic renewal (runs twice daily)
sudo systemctl enable certbot.timer
sudo systemctl start certbot.timer

# Test renewal process
sudo certbot renew --dry-run

#!/bin/bash
# Install DNS plugin for Route53
sudo apt-get install python3-certbot-dns-route53

# Configure AWS credentials
export AWS_ACCESS_KEY_ID="your_access_key"
export AWS_SECRET_ACCESS_KEY="your_secret_key"

# Obtain wildcard certificate
sudo certbot certonly \
  --dns-route53 \
  -d example.com \
  -d *.example.com \
  --non-interactive \
  --agree-tos \
  --email admin@example.com

# Deploy hook script
cat > /etc/letsencrypt/renewal-hooks/deploy/reload-services.sh << 'EOF'
#!/bin/bash
systemctl reload nginx
systemctl reload apache2
docker exec web-container nginx -s reload
EOF

chmod +x /etc/letsencrypt/renewal-hooks/deploy/reload-services.sh

stages:
  - provision
  - deploy
  - verify

variables:
  DOMAIN: "app.example.com"
  ACME_EMAIL: "devops@example.com"

provision_ssl:
  stage: provision
  image: certbot/certbot
  script:
    - certbot certonly --dns-cloudflare 
        --dns-cloudflare-credentials /secrets/cloudflare.ini
        -d $DOMAIN --non-interactive --agree-tos 
        --email $ACME_EMAIL
    - cp /etc/letsencrypt/live/$DOMAIN/fullchain.pem ./ssl/
    - cp /etc/letsencrypt/live/$DOMAIN/privkey.pem ./ssl/
  artifacts:
    paths:
      - ssl/
    expire_in: 1 hour
  only:
    - master

deploy_certificates:
  stage: deploy
  image: alpine:latest
  dependencies:
    - provision_ssl
  script:
    - apk add --no-cache openssh-client
    - eval $(ssh-agent -s)
    - ssh-add <(echo "$SSH_PRIVATE_KEY")
    - scp ssl/* user@server:/etc/nginx/ssl/
    - ssh user@server "nginx -t && systemctl reload nginx"
  only:
    - master

verify_ssl:
  stage: verify
  image: curlimages/curl:latest
  script:
    - curl -vI https://$DOMAIN 2>&1 | grep "SSL certificate verify ok"
    - curl -s https://$DOMAIN | grep "200 OK"
  only:
    - master

pipeline {
    agent any
    
    environment {
        DOMAIN = 'app.example.com'
        VAULT_ADDR = 'https://vault.example.com'
        VAULT_TOKEN = credentials('vault-token')
    }
    
    stages {
        stage('Request Certificate') {
            steps {
                script {
                    sh '''
                        acme.sh --issue --dns dns_aws \
                            -d ${DOMAIN} \
                            --keylength 2048
                    '''
                }
            }
        }
        
        stage('Store in Vault') {
            steps {
                script {
                    sh '''
                        vault kv put secret/ssl/${DOMAIN} \
                            cert=@~/.acme.sh/${DOMAIN}/fullchain.cer \
                            key=@~/.acme.sh/${DOMAIN}/${DOMAIN}.key
                    '''
                }
            }
        }
        
        stage('Deploy to Kubernetes') {
            steps {
                script {
                    sh '''
                        kubectl create secret tls ${DOMAIN}-tls \
                            --cert=~/.acme.sh/${DOMAIN}/fullchain.cer \
                            --key=~/.acme.sh/${DOMAIN}/${DOMAIN}.key \
                            --namespace=production \
                            --dry-run=client -o yaml | kubectl apply -f -
                        
                        kubectl rollout restart deployment/web -n production
                    '''
                }
            }
        }
        
        stage('Verify Deployment') {
            steps {
                script {
                    sh '''
                        sleep 30
                        curl -vI https://${DOMAIN} 2>&1 | grep "SSL certificate verify ok"
                    '''
                }
            }
        }
    }
    
    post {
        failure {
            emailext (
                subject: "SSL Deployment Failed: ${DOMAIN}",
                body: "Certificate deployment failed. Check Jenkins logs.",
                to: "devops@example.com"
            )
        }
    }
}

# Install cert-manager using kubectl
kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.13.0/cert-manager.yaml

# Verify installation
kubectl get pods --namespace cert-manager

# Create ClusterIssuer for Let's Encrypt
cat <