Getting cozy with Let's Encrypt

Posted at: 2020-08-30 23:00 CEST
Length: 625 words (3 minutes)
Tags: [ web ssl nginx ]

Once upon a time, the web was wild. I mean, it still is, but some people have tried to make order from it, and set up boundaries. Once upon a time, all data sent over the web was plain to see for everyone who dared to look. This wasn't all too great when people started using passwords to log in to places, or do their banking online. So some people set out to make sure the data being sent from place to place (ie. from your web browser or other client, to whichever server you connect to, and back again) could not be spied upon.

This sounds all good and nice, but getting a valid certificate costs a bit. At least until Let's Encrypt arrived. Now everyone can get valid certificates for free. If they figure out how to get it working, and that's what I set out to do today since I plan on exposing some of my machines to the wide open internet.

Installing a client

Having looked around a little bit, I found the acme.sh client, and figured that it was good enough. I've decided to use my web server to get the certificate, and then distribute it from there to other machines that need it.

Installing on FreeBSD is simple enough:

# pkg install acme.sh

Getting started

There are multiple tutorials online on how to get going with acme.sh and how it works, so I'll not go over that here. Save for one gotcha that I couldn't find a reference to, it's possible that it doesn't appear on Linux, and I guess that's what most people use. I'll have to copy the folder with DNS API files to the home folder of root (as that's the user that'll run acme.sh). Also, set the permissions on the .acme.sh folder so that it's only usable by root (because I don't want anyone other than me getting access to my private key). Not that anyone else should be having access to my server anyway, but it certainly doesn't hurt restricting access.

# mkdir ~/.acme.sh
# chmod 700 ~/.acme.sh
# cp -r /usr/local/share/examples/acme.sh/dnsapi ~/.acme.sh/

Now I'm ready to test. Since I use the Swedish domain registrar Loopia, and decided to use acme.sh's DNS mode, I use the variable names suitable for them:

# set LOOPIA_User="********@loopiaapi"
# set LOOPIA_Password="********************"
# acme.sh --test --issue --debug -d "*.ops-area.net" -d "ops-area.net" --dns dns_loopia

Do note, Loopia seems to have a bug (or had a while ago when I first messed about with this, I don't know if they've fixed it since), the API user's username must be in lower-case when logging in, regardless of how you created it in their web interface.

The --dns attribute should (according to acme.sh --help) be able to take a path to a DNS API file, but it would not work if I used /usr/local/share/examples/acme.sh/dnsapi/dns_loopia.sh, thus the need to copy it to ~/.acme.sh/ first.

Out of testing, into the real world

Anyway. That works fine. Now to make it real and automate it, because I'm lazy and don't want to need to think about it every three months. Everything that can be automated, should.

# mkdir -p /usr/local/etc/nginx/certs/keys
# chmod 700 /usr/local/etc/nginx/certs/keys
# acme.sh --issue -d "*.ops-area.net" -d "ops-area.net" --dns dns_loopia
# acme.sh --install-cert -d "*.ops-area.net" --cert-file /usr/local/etc/nginx/certs/ops-area.net.cer --key-file /usr/local/etc/nginx/certs/keys/ops-area.net.key --reloadcmd "service nginx restart"

For automation, I first create a script with everything I want done...

# touch /usr/local/sbin/acme-renew.sh
# chmod 700 /usr/local/sbin/acme-renew.sh
# edit /usr/local/sbin/acme-renew.sh
acme.sh --renew -d "*.ops-area.net" -d "ops-area.net" --dns dns_loopia
acme.sh --install-cert -d "*.ops-area.net" --cert-file /usr/local/etc/nginx/certs/ops-area.net.cer --key-file /usr/local/etc/nginx/certs/keys/ops-area.net.key --reloadcmd "service nginx restart"

... and then edit /etc/crontab to set that script to run every second month.

30 0 1 2/2 * root /usr/local/sbin/acme-renew.sh

And now I just hope it works.

<- Previous post | Next post ->