bernardspil:letsencrypt

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Next revision		 Previous revision
bernardspil:letsencrypt [2017/09/18 13:11] – Use local wiki LinkNames (remove absolute wiki urls), Delink another "LetsEncrypt" KubilayKocakbernardspil:letsencrypt [2019/01/02 18:47] (current) – Fix two external links JuanMolina
Line 2: Line 2:
  
 <callout type="info"> <callout type="info">
-**Guide changed to use the ''%%security/lets_k_encrypt.sh%%''**+**Guide changed to use the ''%%security/acme-client%%''**
  
 The guide using official %%LetsEncrypt%% client can be found at [[BernardSpil/LetsEncrypt.py]]\\  The guide using official %%LetsEncrypt%% client can be found at [[BernardSpil/LetsEncrypt.py]]\\ 
Line 9: Line 9:
  
 My [[BernardSpil/LetsEncrypt.py|first guide]] used the official %%LetsEncrypt%% python client. I found that to be way too fat and had too many dependencies to be allowed to run as root.\\  My [[BernardSpil/LetsEncrypt.py|first guide]] used the official %%LetsEncrypt%% python client. I found that to be way too fat and had too many dependencies to be allowed to run as root.\\ 
-My [[https://https://brnrd.eu/security/2016-01-23/letsencrypt.html|second guide]] used Lukas Schauer's [[/LetsEncrypt|LetsEncrypt]].sh client which only required ''%%openssl%%'' and either ''%%bash%%'' or ''%%zsh%%''. This is still a good method as it has separated privileged and un-privileged actions.+My [[https://https://brnrd.eu/security/2016-01-23/letsencrypt.html|second guide]] used Lukas Schauer's %%LetsEncrypt%%.sh client which only required ''%%openssl%%'' and either ''%%bash%%'' or ''%%zsh%%''. This is still a good method as it has separated privileged and un-privileged actions.
  
-This latest guide uses [[https://kristaps.bsd.lv/letskencrypt/|LetsKEncrypt]] created by Kristaps Dzonsons.+This latest guide uses [[https://kristaps.bsd.lv/acme-client/|acme-client]] created by Kristaps Dzonsons.
  
-%%LETSkENCRYPT%% is a client for Let's Encrypt users, but one designed for %%<%%b>security%%<%%/b>. No Python. No Ruby. No Bash. A straightforward, open source implementation in C that isolates each step of the sequence.+acme-client is a client for Let's Encrypt users, but one designed for **security**. No Python. No Ruby. No Bash. A straightforward, open source implementation in C that isolates each step of the sequence.
  
-As a proponent of %%LibreSSL%% I can't let solutions that use libtls from %%LibreSSL%% pass by without trying to use them. I'm the creator and maintainer of the [[http://www.freshports.org/security/letskencrypt/|security/letskencrypt]] port in the %%FreeBSD%% ports tree.+As a proponent of %%LibreSSL%% I can't let solutions that use libtls from %%LibreSSL%% pass by without trying to use them. I'm the creator and maintainer of the [[http://www.freshports.org/security/acme-client/|security/acme-client]] port in the %%FreeBSD%% ports tree.
  
 ====== Notes ====== ====== Notes ======
Line 22: Line 22:
  
   - All services accessible from the internet run in jails (all jails reside in ''%%/usr/jails%%'' by default on %%FreeBSD%%)   - All services accessible from the internet run in jails (all jails reside in ''%%/usr/jails%%'' by default on %%FreeBSD%%)
-  - I use [[https://www.LibreSSL.org|LibreSSL]] as the provider of libcrypto, libssl and libtls on my %%FreeBSD%% system. The ''%%security/letskencrypt%%'' port depends on %%LibreSSL%%.+  - I use [[https://www.LibreSSL.org|LibreSSL]] as the provider of libcrypto, libssl and libtls on my %%FreeBSD%% system. The ''%%security/acme-client%%'' port depends on %%LibreSSL%%.
  
-The ''%%letskencrypt%%'' process will be started by root but drops privileges to [''%%nobody%%''%%](%%[[https://en.wikipedia.org/wiki/Nobody_(username]]%%))%% and [chroot%%](%%https://en.wikipedia.org/wiki/Chroot)'s any action that does not require root privileges. It must run as ''%%root%%'' to be able to drop privileges and run as an unprivileged user.+The ''%%acme-client%%'' process will be started by root but drops privileges to [[https://en.wikipedia.org/wiki/Nobody_(username)|nobody]] and [[https://en.wikipedia.org/wiki/Chroot|chroot]]s any action that does not require root privileges. It must run as ''%%root%%'' to be able to drop privileges and run as an unprivileged user.
  
 ====== Install Letsencrypt.sh ====== ====== Install Letsencrypt.sh ======
Line 57: Line 57:
 ====== Prepare directories ====== ====== Prepare directories ======
  
-To make life easier all of the challenges ([[/LetsEncrypt|LetsEncrypt]] as well as keybase etc) will be hosted in a shared dir ''%%/usr/local/www/.well-known%%'' on the jail running my Apache server.+To make life easier all of the challenges (%%LetsEncrypt%% as well as keybase etc) will be hosted in a shared dir ''%%/usr/local/www/.well-known%%'' on the jail running my Apache server.
  
 <code> <code>
Line 63: Line 63:
 </code> </code>
  
-The [[/LetsEncrypt|LetsEncrypt]] and [[/LetsKencrypt|LetsKencrypt]] bits will land in ''%%/usr/local/etc/letsencrypt%%'', the private keys will land in ''%%/usr/local/etc/ssl/letsencrypt/private%%'' and certificates will land in domain-specific directories in ''%%/usr/local/etc/ssl/letsencrypt%%'' on the host system. These directories are created by the port/package upon installation apart from the domain-specific certificate directories.+The %%LetsEncrypt%% and acme-client bits will land in ''%%/usr/local/etc/letsencrypt%%'', the private keys will land in ''%%/usr/local/etc/ssl/letsencrypt/private%%'' and certificates will land in domain-specific directories in ''%%/usr/local/etc/ssl/letsencrypt%%'' on the host system. These directories are created by the port/package upon installation apart from the domain-specific certificate directories.
  
 ===== Migration from LetsEncrypt.sh ===== ===== Migration from LetsEncrypt.sh =====
Line 117: Line 117:
 </callout> </callout>
  
-===== LetsKencrypt configuration =====+===== acme-client configuration =====
  
-''%%LetsKencrypt%%'' works different from the other clients I've used as it does **not** use configuration files. Everything is handled passing parameters with values to the command. The intended use-case is a system that hosts a single domain.+acme-client works differently from the other clients I've used as it does **not** use configuration files. Everything is handled passing parameters with values to the command. The intended use-case is a system that hosts a single domain.
  
 I've tried to remain compatible with the ''%%LetsEncrypt.sh%%'' method using a file that lists domains and using the first (primary) hostname as prefix for the file and directory names. A filename-prefix handling is likely to be added in a future version. This could equally well be done with an inline HERE-document as documented below. I've tried to remain compatible with the ''%%LetsEncrypt.sh%%'' method using a file that lists domains and using the first (primary) hostname as prefix for the file and directory names. A filename-prefix handling is likely to be added in a future version. This could equally well be done with an inline HERE-document as documented below.
Line 142: Line 142:
 ===== In-line configuration ===== ===== In-line configuration =====
  
-If you don't want to use a ''%%domains.txt%%'' configuration file you can use a different construct to include the list in your ''%%/usr/local/etc/letsencrypt/letskencrypt.sh%%'' script (changed lines only).+If you don't want to use a ''%%domains.txt%%'' configuration file you can use a different construct to include the list in your ''%%/usr/local/etc/letsencrypt/acme-client.sh%%'' script (changed lines only).
  
 <code> <code>
Line 163: Line 163:
  
 <code> <code>
-weekly_letskencrypt_enable="YES" +weekly_acme-client_enable="YES" 
-weekly_letskencrypt_renewscript="/usr/local/etc/letsencrypt/letskencrypt.sh" +weekly_acme-client_renewscript="/usr/local/etc/letsencrypt/acme-client.sh" 
-weekly_letskencrypt_deployscript="/usr/local/etc/letsencrypt/deploy.sh"+weekly_acme-client_deployscript="/usr/local/etc/letsencrypt/deploy.sh"
 </code> </code>
  
Line 175: Line 175:
  
 <code> <code>
-weekly_letskencrypt_enable="YES" +weekly_acme-client_enable="YES" 
-weekly_letskencrypt_domains="example.com www.example.com example.net www.example.net" +weekly_acme-client_domains="example.com www.example.com example.net www.example.net" 
-weekly_letskencrypt_challengedir="/usr/jails/http/usr/local/www/.well-known/acme-challenge" +weekly_acme-client_challengedir="/usr/jails/http/usr/local/www/.well-known/acme-challenge" 
-weekly_letskencrypt_args="-c /usr/jails/http/usr/local/ssl/certs -p /usr/jails/http/usr/local/ssl/priv"+weekly_acme-client_args="-c /usr/jails/http/usr/local/ssl/certs -p /usr/jails/http/usr/local/ssl/priv"
 </code> </code>
  
-In stead of using the ''%%weekly_letskencrypt_args%%'' you can also use ''%%weekly_letskencrypt_deployscript%%'' for your single certificate deployment.+In stead of using the ''%%weekly_acme-client_args%%'' you can also use ''%%weekly_acme-client_deployscript%%'' for your single certificate deployment.
  
-The remainder of this guide assumes you use the ''%%weekly_letskencrypt_renewscript%%'' method.+The remainder of this guide assumes you use the ''%%weekly_acme-client_renewscript%%'' method.
  
 ====== First run ====== ====== First run ======
  
-You will probably want to run your [[/LetsEncrypt|LetsEncrypt]] manually the first time (as ''%%root%%'') after you've setup periodic+You will probably want to run your %%LetsEncrypt%% manually the first time (as ''%%root%%'') after you've setup periodic
  
 <code> <code>
-/usr/local/etc/periodic/weekly/000.letskencrypt.sh+/usr/local/etc/periodic/weekly/000.acme-client.sh
 </code> </code>
  
Line 246: Line 246:
  
 **NB:** Some applications want a private key, certificate and separate chain instead. If this is the case you'll need to copy ''%%cert.pem%%'' and ''%%chain.pem%%'' to the appropriate location instead. **NB:** Some applications want a private key, certificate and separate chain instead. If this is the case you'll need to copy ''%%cert.pem%%'' and ''%%chain.pem%%'' to the appropriate location instead.
 +
 +----
 +
 +{{tag>HowTo}}
  
  • bernardspil/letsencrypt.1505740316.txt.gz
  • Last modified: 2017/09/18 13:11
  • by KubilayKocak