Differences

This shows you the differences between two versions of the page.

--- bernardspil:letsencrypt [2017/07/31 14:58] – Fix formatting MateuszPiotrowski
+++ bernardspil:letsencrypt [2019/01/02 18:47] (current) – Fix two external links JuanMolina
@@ Line 2: / Line 2: @@
 <callout type="info">
-**Guide changed to use the ''%%security/lets_k_encrypt.sh%%''**
+**Guide changed to use the ''%%security/acme-client%%''**
 The guide using official %%LetsEncrypt%% client can be found at [[BernardSpil/LetsEncrypt.py]]\\
@@ Line 8: / Line 8: @@
 </callout>
-My [[https://wiki.freebsd.org/BernardSpil/LetsEncrypt.py|first guide]] used the official [[/LetsEncrypt|LetsEncrypt]] python client. I found that to be way too fat and had too many dependencies to be allowed to run as root.\\
+My [[BernardSpil/LetsEncrypt.py|first guide]] used the official %%LetsEncrypt%% python client. I found that to be way too fat and had too many dependencies to be allowed to run as root.\\
-My [[https://https://brnrd.eu/security/2016-01-23/letsencrypt.html|second guide]] used Lukas Schauer's [[/LetsEncrypt|LetsEncrypt]].sh client which only required ''%%openssl%%'' and either ''%%bash%%'' or ''%%zsh%%''. This is still a good method as it has separated privileged and un-privileged actions.
+My [[https://https://brnrd.eu/security/2016-01-23/letsencrypt.html|second guide]] used Lukas Schauer's %%LetsEncrypt%%.sh client which only required ''%%openssl%%'' and either ''%%bash%%'' or ''%%zsh%%''. This is still a good method as it has separated privileged and un-privileged actions.
-This latest guide uses [[https://kristaps.bsd.lv/letskencrypt/|LetsKEncrypt]] created by Kristaps Dzonsons.
+This latest guide uses [[https://kristaps.bsd.lv/acme-client/|acme-client]] created by Kristaps Dzonsons.
-%%LETSkENCRYPT%% is a client for Let's Encrypt users, but one designed for %%<%%b>security%%<%%/b>. No Python. No Ruby. No Bash. A straightforward, open source implementation in C that isolates each step of the sequence.
+acme-client is a client for Let's Encrypt users, but one designed for **security**. No Python. No Ruby. No Bash. A straightforward, open source implementation in C that isolates each step of the sequence.
-As a proponent of %%LibreSSL%% I can't let solutions that use libtls from %%LibreSSL%% pass by without trying to use them. I'm the creator and maintainer of the [[http://www.freshports.org/security/letskencrypt/|security/letskencrypt]] port in the %%FreeBSD%% ports tree.
+As a proponent of %%LibreSSL%% I can't let solutions that use libtls from %%LibreSSL%% pass by without trying to use them. I'm the creator and maintainer of the [[http://www.freshports.org/security/acme-client/|security/acme-client]] port in the %%FreeBSD%% ports tree.
-===== Notes =====
+====== Notes ======
 Some notes on the configuration of my setup
   - All services accessible from the internet run in jails (all jails reside in ''%%/usr/jails%%'' by default on %%FreeBSD%%)
-  - I use [[https://www.LibreSSL.org|LibreSSL]] as the provider of libcrypto, libssl and libtls on my %%FreeBSD%% system. The ''%%security/letskencrypt%%'' port depends on %%LibreSSL%%.
+  - I use [[https://www.LibreSSL.org|LibreSSL]] as the provider of libcrypto, libssl and libtls on my %%FreeBSD%% system. The ''%%security/acme-client%%'' port depends on %%LibreSSL%%.
-The ''%%letskencrypt%%'' process will be started by root but drops privileges to [''%%nobody%%''%%](%%[[https://en.wikipedia.org/wiki/Nobody_(username]]%%))%% and [chroot%%](%%https://en.wikipedia.org/wiki/Chroot)'s any action that does not require root privileges. It must run as ''%%root%%'' to be able to drop privileges and run as an unprivileged user.
+The ''%%acme-client%%'' process will be started by root but drops privileges to [[https://en.wikipedia.org/wiki/Nobody_(username)|nobody]] and [[https://en.wikipedia.org/wiki/Chroot|chroot]]s any action that does not require root privileges. It must run as ''%%root%%'' to be able to drop privileges and run as an unprivileged user.
 ====== Install Letsencrypt.sh ======
@@ Line 57: / Line 57: @@
 ====== Prepare directories ======
-To make life easier all of the challenges ([[/LetsEncrypt|LetsEncrypt]] as well as keybase etc) will be hosted in a shared dir ''%%/usr/local/www/.well-known%%'' on the jail running my Apache server.
+To make life easier all of the challenges (%%LetsEncrypt%% as well as keybase etc) will be hosted in a shared dir ''%%/usr/local/www/.well-known%%'' on the jail running my Apache server.
 <code>
@@ Line 63: / Line 63: @@
 </code>
-The [[/LetsEncrypt|LetsEncrypt]] and [[/LetsKencrypt|LetsKencrypt]] bits will land in ''%%/usr/local/etc/letsencrypt%%'', the private keys will land in ''%%/usr/local/etc/ssl/letsencrypt/private%%'' and certificates will land in domain-specific directories in ''%%/usr/local/etc/ssl/letsencrypt%%'' on the host system. These directories are created by the port/package upon installation apart from the domain-specific certificate directories.
+The %%LetsEncrypt%% and acme-client bits will land in ''%%/usr/local/etc/letsencrypt%%'', the private keys will land in ''%%/usr/local/etc/ssl/letsencrypt/private%%'' and certificates will land in domain-specific directories in ''%%/usr/local/etc/ssl/letsencrypt%%'' on the host system. These directories are created by the port/package upon installation apart from the domain-specific certificate directories.
 ===== Migration from LetsEncrypt.sh =====
-To migrate from the ''%%LetsEncrypt.sh%%'' method, copy/move your account key, the ''%%domains.txt%%'' file and all keys and certs to the new locations. Use the default filename, resolve symlinks to the actual timestamped file. Use the script as an example, yet it _should_ work for the default settings.
+To migrate from the ''%%LetsEncrypt.sh%%'' method, copy/move your account key, the ''%%domains.txt%%'' file and all keys and certs to the new locations. Use the default filename, resolve symlinks to the actual timestamped file. Use the script as an example, yet it //should// work for the default settings.
 ''%%migrate.sh%%''
@@ Line 103: / Line 103: @@
 The Content-Type header was in my configs somewhere, shouldn't hurt.\\
-If you want to only share the ACME challenges you can suffix ''%%.well-known/%%'' with ''%%acme-challenge/%%''
+If you want to only share the ACME challenges you can suffix ''%%.well-known/%%'' with ''%%acme-challenge/%%''.
 Now every (non-ssl) Virtual Host that I have gets a on-line addition
@@ Line 117: / Line 117: @@
 </callout>
-===== LetsKencrypt configuration =====
+===== acme-client configuration =====
-''%%LetsKencrypt%%'' works different from the other clients I've used as it does %%**%%not%%**%% use configuration files. Everything is handled passing parameters with values to the command. The intende use-case is a system that hosts a single domain.
+acme-client works differently from the other clients I've used as it does **not** use configuration files. Everything is handled passing parameters with values to the command. The intended use-case is a system that hosts a single domain.
 I've tried to remain compatible with the ''%%LetsEncrypt.sh%%'' method using a file that lists domains and using the first (primary) hostname as prefix for the file and directory names. A filename-prefix handling is likely to be added in a future version. This could equally well be done with an inline HERE-document as documented below.
@@ Line 127: / Line 127: @@
 The script requires a list of domain names you want to have a SAN cert for in the following format:
+<code>
 example.com www.example.com
 example.net www.example.net wiki.example.net
-Domains and sub-domains that are listed on the //same line// will result in SAN-certificates ([Subject-Alternative-Name%%](%%[[https://en.wikipedia.org/wiki/SubjectAltName]]%%))%%.\\
+</code>
+Domains and sub-domains that are listed on the //same line// will result in SAN-certificates ([[https://en.wikipedia.org/wiki/SubjectAltName|Subject-Alternative-Name]]).\\
 Store this as ''%%/usr/local/etc/letsencrypt/domains.txt%%''
@@ Line 137: / Line 140: @@
 </callout>
-%%=%%= In-line configuration==
+===== In-line configuration =====
-If you don't want to use a ''%%domains.txt%%'' configuration file you can use a different construct to include the list in your ''%%/usr/local/etc/letsencrypt/letskencrypt.sh%%'' script (changed lines only).
+If you don't want to use a ''%%domains.txt%%'' configuration file you can use a different construct to include the list in your ''%%/usr/local/etc/letsencrypt/acme-client.sh%%'' script (changed lines only).
 <code>
@@ Line 153: / Line 156: @@
 ===== Configure periodic job =====
-The %%FreeBSD%% port contains a [''%%periodic(8)%%''%%](%%[[https://www.freebsd.org/cgi/man.cgi?query=periodic]]) script for full automation of your certificate renewal. The periodic script allows using a script for renewals or periodic variables only for a single key/certifcate
+The %%FreeBSD%% port contains a [[https://www.freebsd.org/cgi/man.cgi?query=periodic|periodic(8)]] script for full automation of your certificate renewal. The periodic script allows using a script for renewals or periodic variables only for a single key/certifcate
 To setup periodic to use the script
@@ Line 160: / Line 163: @@
 <code>
-weekly_letskencrypt_enable="YES"
+weekly_acme-client_enable="YES"
-weekly_letskencrypt_renewscript="/usr/local/etc/letsencrypt/letskencrypt.sh"
+weekly_acme-client_renewscript="/usr/local/etc/letsencrypt/acme-client.sh"
-weekly_letskencrypt_deployscript="/usr/local/etc/letsencrypt/deploy.sh"
+weekly_acme-client_deployscript="/usr/local/etc/letsencrypt/deploy.sh"
 </code>
@@ Line 172: / Line 175: @@
 <code>
-weekly_letskencrypt_enable="YES"
+weekly_acme-client_enable="YES"
-weekly_letskencrypt_domains="example.com www.example.com example.net www.example.net"
+weekly_acme-client_domains="example.com www.example.com example.net www.example.net"
-weekly_letskencrypt_challengedir="/usr/jails/http/usr/local/www/.well-known/acme-challenge"
+weekly_acme-client_challengedir="/usr/jails/http/usr/local/www/.well-known/acme-challenge"
-weekly_letskencrypt_args="-c /usr/jails/http/usr/local/ssl/certs -p /usr/jails/http/usr/local/ssl/priv"
+weekly_acme-client_args="-c /usr/jails/http/usr/local/ssl/certs -p /usr/jails/http/usr/local/ssl/priv"
 </code>
-In stead of using the ''%%weekly_letskencrypt_args%%'' you can also use ''%%weekly_letskencrypt_deployscript%%'' for your single certificate deployment.
+In stead of using the ''%%weekly_acme-client_args%%'' you can also use ''%%weekly_acme-client_deployscript%%'' for your single certificate deployment.
-The remainder of this guide assumes you use the ''%%weekly_letskencrypt_renewscript%%'' method.
+The remainder of this guide assumes you use the ''%%weekly_acme-client_renewscript%%'' method.
 ====== First run ======
-You will probably want to run your [[/LetsEncrypt|LetsEncrypt]] manually the first time (as ''%%root%%'') after you've setup periodic
+You will probably want to run your %%LetsEncrypt%% manually the first time (as ''%%root%%'') after you've setup periodic
 <code>
-/usr/local/etc/periodic/weekly/000.letskencrypt.sh
+/usr/local/etc/periodic/weekly/000.acme-client.sh
 </code>
@@ Line 242: / Line 245: @@
 </code>
-%%**%%NB:%%**%% Some applications want a private key, certificate and separate chain instead. If this is the case you'll need to copy ''%%cert.pem%%'' and ''%%chain.pem%%'' to the appropriate location in stead.
+**NB:** Some applications want a private key, certificate and separate chain instead. If this is the case you'll need to copy ''%%cert.pem%%'' and ''%%chain.pem%%'' to the appropriate location instead.
+----
+{{tag>HowTo}}