Let's Encrypt with acme-client(1)

I recently went through the process to convert my website to https only, and wanted to document and share the process I used.

My setup: * FreeBSD 11.0-RELEASE * OpenSSL 1.0.2j-freebsd (in base) * nginx-1.10.2_3,2 (pkg install nginx) * acme-client-0.1.15 (pkg install acme-client)

Let's Encrypt will sign your certificate if you can demonstrate that you control the domain. It does this by issuing the client software with a challenge, in this case to provision a HTTP resource under http://domain/.well-known/acme-challenge/.

For this to work you will need to add the following to your nginx.conf file, within the server section that is listening for http traffic (typically on port 80):

` # Lets encrypt location ^~ /.well-known/acme-challenge/ { alias /usr/local/www/acme/; } `

After this, acme-client(1) can generate a new Let's Encrypt account key and certificate, get them signed, and install them with the following command: ` # acme-client -vNn example.com www.example.com `

This will give verbose output and perform the following: * create a new 4096-bit RSA account key, and save it as /usr/local/etc/acme/privkey.pem (can be changed with -f) * create a new 4096-bit RSA domain key, and save it as /usr/local/etc/ssl/acme/private/privkey.pem (can be changed with -k) * request Let's Encrypt to sign the new certificate, and automatically satisfy any challenges by temporarily creating files in /usr/local/www/acme (can be changed with -C) - relies on nginx.conf alias from http://example.com/.well-known/acme-challenge/ * save the signed public domain certificate (cert.pem), chain (chain.pem), and full-chain (fullchain.pem) in /usr/local/etc/ssl/acme/ (can be changed with -c)

` server { listen 80; server_name example.com www.example.com;

# Lets encrypt location ^~ /.well-known/acme-challenge/ { alias /usr/local/www/acme/; }

location / { return 301 https://example.com$request_uri; } }

server { listen 443 ssl; server_name example.com www.example.com; ssl_certificate /usr/local/etc/ssl/acme/fullchain.pem; ssl_certificate_key /usr/local/etc/ssl/acme/private/privkey.pem;

… INSERT REMAINDER OF NGINX CONFIG FOR WEBSITE HERE } `

Configure the acme-client(1) to perform weekly re-validation of the certificate with Let's Encrypt using periodic(8).

Add the following to /etc/periodic.conf (create the file if it does not exist):

` weekly_acme_client_enable=“YES” # To specify the domain name(s) to include in the certificate weekly_acme_client_domains=“womlins.wedding www.womlins.wedding” #To specify the .well-known/acme-challenge directory (full path) weekly_acme_client_challengedir=“/usr/local/www/acme” #To set additional acme-client arguments (see acme-client(1)) weekly_acme_client_args=“-bv” #To run a specific script for the renewal (ignore previously set variables) #allows generating/renewing multiple keys/certificates #weekly_acme_client_renewscript=“/usr/local/etc/acme/acme-client.sh” #To run a script after the renewal to deploy changed certs #weekly_acme_client_deployscript=“/usr/local/etc/acme/deploy.sh” `

In a web browser, go to http://example.com/ and confirm it re-directs to https://example.com/ and the browser trusts the certificate.

Now visit https://www.ssllabs.com/ssltest/ to see how your website scores, and close any security flaws as necessary.