Difference between revisions of "Letsencrypt"

From SME Server
Jump to navigationJump to search
m (Add correct wiki page for Note re fail on All)
 
(117 intermediate revisions by 13 users not shown)
Line 1: Line 1:
−
{{Level|Advanced}}
+
{{Languages|Letsencrypt}}
−
{{Warning box|This procedure change the default certificates and could significantly compromise your server's security.<br />Thorough understanding of linux system management is required.<br /><br /><b>Proceed at your own risk</b>}}
+
{{Level|Medium}}
−
==Introduction==
+
<!-- here we define the contrib name variable -->
 +
<!-- we get the page title, remove suffix for translated version; if needed you can define there with the value you want-->
 +
{{#vardefine:contribname| {{lc: {{#titleparts:  {{BASEPAGENAME}} |1}} }} }}
 +
{{#vardefine:smecontribname| smeserver-{{lc: {{#titleparts:  {{BASEPAGENAME}} |1}} }} }}
 +
<!-- we define the language -->
 +
{{#vardefine:lang| {{lc:  {{#titleparts:    {{PAGENAME}} | | -1}} }} |en }}
 +
{{Infobox contribs
 +
|name={{#var:contribname}}
 +
|image={{#var:contribname}}.jpg
 +
|description_image= {{#var:contribname}} logo
 +
|maintainer= John Crisp
 +
|licence= MIT license
 +
|url= https://github.com/dehydrated-io/dehydrated
 +
|category= certificates
 +
|tags=dehydrated,letsencrypt,dns,http,ssl
 +
}}
 +
==Maintainer==
 +
John Crisp
 +
 
 +
== Version ==
 +
{{#set: Version=Contrib10}}
 +
{{#smeversion:smeserver-letsencrypt }}
 +
<br>
 +
 
 +
==Description==
 +
 
 +
{{warning box| The original protocol used by Let’s Encrypt for certificate issuance and management is called ACMEv1. In March of 2018 Letsencrypt introduced support for ACMEv2, a newer version of the protocol that matches what was finalized today as RFC 8555 328. They have been encouraging subscribers to move to the ACMEv2 protocol.
 +
 
 +
In March 2019 they announced an end of life plan for ACMEv1.
 +
 
 +
In November of 2019 they will stop allowing new account registrations through their ACMEv1 API endpoint. '''IMPORTANTLY''' Existing accounts will continue to function normally.
 +
 
 +
In June of 2020 they will stop allowing new domains to validate via ACMEv1.
 +
 
 +
Starting at the beginning of 2021 they will occasionally disable ACMEv1 issuance and renewal for periods of 24 hours, no more than once per month (OCSP service will not be affected). The intention is to induce client errors that might encourage subscribers to update to clients or configurations that use ACMEv2.
 +
 
 +
Renewal failures should be limited since new domain validations will already be disabled and we recommend renewing certificates 30 days before they expire.
 +
 
 +
In June of 2021 they will entirely disable ACMEv1 as a viable way to get a Let’s Encrypt certificate.}}
 +
 
 
[https://letsencrypt.org/ Let’s Encrypt] is a new Certificate Authority:  
 
[https://letsencrypt.org/ Let’s Encrypt] is a new Certificate Authority:  
−
It’s free, automated, and open.
+
It’s free, automated, and open. Its main purpose is to allow people to encrypt their internet traffic at no cost, easily, and automatically. The certs delivered must be renewed every 3 months.
−
Its main purpose is to allow people to encrypt their internet traffic by a very simple system.
 
−
 
 
−
The certs delivered must be renewed every 3 months.
 
  
−
As of December 2015, the Letsencrypt service is in a public beta state.  They issue valid, trusted certificates, but the client code (and, to a lesser extent, the server code) is likely in a state of flux.  At least during the initial stages of the public beta, they're implementing rate-limiting, allowing no more than five certificates per domain in a rolling seven-day period.  This may make them unsuitable for users of dynamic DNS services.  The latest information about rate limiting should be posted in [https://community.letsencrypt.org/t/beta-program-announcements/1631 this topic] at the letsencrypt.org forums.  As of March 26, 2016, the rate limit has been increased to 20 certificates per domain per week.
+
As of December 2015, the Letsencrypt service is in a public beta state.  They issue valid, trusted certificates, but the client code (and, to a lesser extent, the server code) is likely in a state of flux.  At least during the initial stages of the public beta, they're implementing rate-limiting, allowing no more than five certificates per domain in a rolling seven-day period.  This may make them unsuitable for users of dynamic DNS services.  The latest information about rate limiting should be posted on [https://letsencrypt.org/docs/rate-limits/ this page] of the letsencrypt.org documentation.  As of March 26, 2016, the rate limit has been increased to 20 certificates per domain per week.
  
−
If you're going to be testing things in ways that would involve requesting lots of certificates in a short period of time, you're encouraged to use the Letsencrypt staging CA for this purpose.  Certificates generated by this CA will not be trusted by your browser, and will appear to be issued by the "Happy hacker CA", but it will allow you to validate the toolchain and workflow.  To do this, add "--server https://acme-staging.api.letsencrypt.org/directory" to the letsencrypt commands below.  See [https://community.letsencrypt.org/t/testing-against-the-lets-encrypt-staging-environment/6763/1 this post] at the letsencrypt.org forums for more information.
+
If you're going to be testing things in ways that would involve requesting lots of certificates in a short period of time, you're encouraged to use the Letsencrypt staging CA for this purpose.  Certificates generated by this CA will not be trusted by your browser, and will appear to be issued by the "Fake LE Intermediate X1", but it will allow you to validate the toolchain and workflow.
  
 
The current status of the Letsencrypt services can be found on their [https://letsencrypt.status.io/ status page].
 
The current status of the Letsencrypt services can be found on their [https://letsencrypt.status.io/ status page].
  
−
At this time (January 2016), a contrib is under active development using the letsencrypt.sh script.  See [http://bugs.contribs.org/show_bug.cgi?id=8676 Bug 8276] and the [https://github.com/reetp/smeserver-letsencrypt/tree/smeserver-letsencrypt-0.1 GitHub page] for further information.
+
Multiple clients are available for the Letsencrypt services.  The official "certbot" client from letsencrypt.org is quite full-featured, but has a number of dependencies that it needs to install.  It also requires a newer version of Python than is included with a standard SME Server installation. Due to this complexity, and the lack of compatibility with SME 8.x, this document describes installation and use of ''[https://github.com/lukas2511/dehydrated dehydrated]'', an alternative client implemented as a BASH shell script.
  
 
==Prerequisites==
 
==Prerequisites==
Line 21: Line 57:
 
* www.example.com is a valid domain name--the domain has been registered, and DNS records are published for it.
 
* www.example.com is a valid domain name--the domain has been registered, and DNS records are published for it.
 
* www.example.com resolves to your SME Server--published DNS records give the external IP address of your SME Server when queried for www.example.com.
 
* www.example.com resolves to your SME Server--published DNS records give the external IP address of your SME Server when queried for www.example.com.
−
* Your SME Server is connected to the Internet.
+
* Your SME Server is connected to the Internet, and is able to make outbound connections on ports 80 and 443.
−
* Port 80 on your SME Server is open to the Internet--you aren't behind a firewall, or some ISP filtering, that would block it.
+
* Port 80 on your SME Server is open to the Internet (i.e., the Internet can reach your server on port 80)--you aren't behind a firewall, or some ISP filtering, that would block it.  If you've made SSL mandatory for the Primary ibay, port 443 must also be open.
  
 
Letsencrypt will issue certificates that include multiple hostnames (for example, www.example.com, example.com, and mail.example.com), all of which would be part of the request.  All of the conditions above must be true for all of the hostnames you want to include in the certificate.
 
Letsencrypt will issue certificates that include multiple hostnames (for example, www.example.com, example.com, and mail.example.com), all of which would be part of the request.  All of the conditions above must be true for all of the hostnames you want to include in the certificate.
  
 
Make sure you've got this all set up correctly before continuing.
 
Make sure you've got this all set up correctly before continuing.
 +
 +
==Preparation==
  
 
Before you begin installation, check to see if you or an installed contrib have configured any custom values for your TLS/SSL certificate:
 
Before you begin installation, check to see if you or an installed contrib have configured any custom values for your TLS/SSL certificate:
Line 38: Line 76:
 
If this shows any values for crt, key, or CertificateChainFile, make a note of them.  If you encounter an issue with the certificate files generated by Letsencrypt, you'll then be able to revert your changes. To make a 'backup' of your existing key and properties you can issue:
 
If this shows any values for crt, key, or CertificateChainFile, make a note of them.  If you encounter an issue with the certificate files generated by Letsencrypt, you'll then be able to revert your changes. To make a 'backup' of your existing key and properties you can issue:
 
  config show modSSL > "/root/db_configuration_modSSL_backup_$(date +%Y%m%d_%H%M%S)"
 
  config show modSSL > "/root/db_configuration_modSSL_backup_$(date +%Y%m%d_%H%M%S)"
−
or to be sure, a copy of the complete configuration database (a good practice before any action such as manual changing of db values or installing a contrib):
 
−
config show > "/root/db_configuration_backup_$(date +%Y%m%d_%H%M%S)"
 
  
−
== Installation ==
+
==Installation of Dehydrated letsencrypt contrib==
−
Multiple clients are available for the Letsencrypt services.  The official client from letsencrypt.org is quite full-featured, but has a number of dependencies that it needs to install.  It also requires a newer version of Python than is included with a standard SME Server installation.  Due to this complexity, and the lack of compatibility with SME 8.x, this document describes installation and use of letsencrypt.sh, an alternative client implemented as a BASH shell script.
+
John Crisp has prepared a contrib that installs the dehydrated script, creates the appropriate configuration files, and integrates with the SME templates system.  This is the simplest way to install dehydrated on your SME Server.
 +
<tabs container style="display: inline-block;"><tab name="For SME 10">
 +
  yum install smeserver-letsencrypt
  
−
=== Installation of Letsencrypt.sh ===
+
You will then need to configure the domains and hosts for which you want to ask a certificate. See the following Configuration section.
−
Letsencrypt.sh is a lightweight alternative ACME client which will allow you to retrieve certificates from the Letsencrypt servers without needing to install any additional software on your server, other than git to download and install it. Begin by installing git:
 
−
yum install git
 
  
−
Then download the letsencrypt.sh client:
+
If your smeaddons repo has been disabled add --enablerepo=smeaddons and reenable it, as it should be by default.
−
  cd /etc
+
  db yum_repositories setprop smeaddons status enabled
−
  git clone https://github.com/lukas2511/letsencrypt.sh
+
  signal-event yum-modify
−
mv letsencrypt.sh/letsencrypt.sh /usr/local/bin/
 
  
−
You'll need to create two configuration files for letsencrypt.sh.
+
</tab><tab name="For SME 9">
−
  cd letsencrypt.sh
+
===Installation===
−
  mkdir -p /home/e-smith/files/ibays/Primary/html/.well-known/acme-challenge
+
  yum install smeserver-letsencrypt
−
nano -w domains.txt
+
  signal-event console-save
  
−
In this file, you'll list every hostname that you want your certificate to cover, all on one line.  It will look like this:
+
You will then need to configure the domains and hosts for which you want to ask a certificate. See the following Configuration section.
−
domain1.com www.domain1.com mail.domain1.com domain2.net www.domain2.net domain3.org ftp.domain3.org
 
−
Ctrl-X to exit, Y to save.
 
  
−
Second, you'll need to create the configuration file:
+
If your smeaddons repo has been disabled add --enablerepo=smeaddons and reenable it, as it should be by default.
−
  nano -w config
+
  db yum_repositories setprop smeaddons status enabled
 +
signal-event yum-modify
  
−
It should look like this:
+
===Updating===
−
#!/bin/bash
+
Few reported issue when upgrading the contribs see [[Bugzilla:10286]] and [[Bugzilla:10097]]
−
# config
 
−
# CA="https://acme-staging.api.letsencrypt.org/directory"
 
−
WELLKNOWN="/home/e-smith/files/ibays/Primary/html/.well-known/acme-challenge"
 
−
HOOK="/usr/local/bin/letsencrypt-hook.sh"
 
−
  # E-mail to use during the registration (default: <unset>)
 
−
CONTACT_EMAIL="admin@yourdomain.com"
 
−
Ctrl-X to exit, Y to save.
 
  
−
For testing purposes, it's recommended that you uncomment the third line (so it begins with "CA=").  Any certificates issued while testing will not be trusted, but they will also not count against your rate limits. Once your configuration is set, you can comment out that line and re-run letsencrypt.sh.
+
A full update can be done as follow :
 +
  yum update smeserver-letsencrypt dehydrated
 +
config setprop letsencrypt ACCEPT_TERMS yes
 +
signal-event console-save
 +
failure to do this might leave the contribution not working and your certificates not renewed.
 +
</tab>
 +
</tabs>
  
−
You'll need to create a custom "hook" script to set the config database up properly, and to trigger reloads of your system services when a certificate is issued or renewed.
+
==Configuration==
−
nano /usr/local/bin/letsencrypt-hook.sh
+
There are several configuration database entries that need to be made in order to set up this contrib.  Most of them tell the scripts which hostnames need to be part of your certificate.
  
−
Its contents should look like this:
+
=== Rush jobs ===
−
#!/bin/bash
+
For the test ('''adjust the domains and hosts'''):
−
+
<tabs container style="display: inline-block;"><tab name="For SME 10">
−
if [ $1 = "deploy_cert" ]; then
+
config setprop letsencrypt ACCEPT_TERMS yes status test
−
  KEY=$3
+
# really fast job to enable the primary domain
−
  CERT=$4
+
db domains setprop $(config get DomainName) letsencryptSSLcert enabled
−
  CHAIN=$6
+
#foreach of your domains you want SSL do the following
−
  /sbin/e-smith/db configuration setprop modSSL key $KEY
+
db domains setprop '''domain1.com''' letsencryptSSLcert enabled
−
  /sbin/e-smith/db configuration setprop modSSL crt $CERT
+
#foreach of your hosts (subdomains) you want SSL do the following
−
  /sbin/e-smith/db configuration setprop modSSL CertificateChainFile $CHAIN
+
db hosts setprop '''www.domain1.com''' letsencryptSSLcert enabled
−
  /sbin/e-smith/signal-event domain-modify
+
signal-event smeserver-letsencrypt-update
−
  /sbin/e-smith/signal-event email-update
+
dehydrated -c
−
  /sbin/e-smith/signal-event ibay-modify
+
</tab><tab name="For SME 9">
−
fi
+
config setprop letsencrypt ACCEPT_TERMS yes status test API 2
 +
#foreach of your domains you want SSL do the following
 +
db domains setprop '''domain1.com''' letsencryptSSLcert enabled
 +
#foreach of your hosts (subdomains) you want SSL do the following
 +
db hosts setprop '''www.domain1.com''' letsencryptSSLcert enabled
 +
signal-event console-save
 +
dehydrated -c
 +
</tab>
 +
</tabs>
 +
Check that the certificates are available ( your browser will still issue an error, but you can explore the content of the certificate to see that the Let's Encrypt test CA was used to sign your SSL certificate and that all your domains and hosts are in the "Certificate Subject Alt Name" property.
  
−
If you have at least version 5.6.0-26 of e-smith-base installed (i.e., if you've installed updates since late January of 2016), replace the three signal-event lines with
+
For the production ('''adjust your email'''):
−
 
+
<tabs container style="display: inline-block;"><tab name="For SME 10">
−
  /sbin/e-smith/signal-event ssl-update
+
config setprop letsencrypt status enabled email admin@$(config get DomainName)
 +
signal-event smeserver-letsencrypt-update
 +
dehydrated -c -x
 +
</tab><tab name="For SME 9">
 +
config setprop letsencrypt status enabled email '''admin@domain1.com'''
 +
signal-event console-save
 +
dehydrated -c -x
 +
</tab>
 +
</tabs>
  
−
Ctrl-X to exit, Y to save.  Then make it executable:
+
===Step by step configuration===
−
chmod +x /usr/local/bin/letsencrypt-hook.sh
 
  
−
You'll also need to create a custom template fragment for Apache:
+
====Hosts and domains for the certificate====
−
mkdir -p /etc/e-smith/templates-custom/etc/httpd/conf/httpd.conf
+
This contrib will obtain a single certificate from Let's Encrypt.  The certificate will include all the domains and hostnames that:
−
nano -w /etc/e-smith/templates-custom/etc/httpd/conf/httpd.conf/VirtualHosts40ACME
+
* Are configured on your SME Server (e.g., through the Server Manager), and
 +
* Are configured to use Let's Encrypt.
  
−
The contents of that file should look like:
+
For example, your SME Server may contain the following domains and hostnames:
−
# Alias for letsencrypt
 
−
Alias /.well-known/acme-challenge /home/e-smith/files/ibays/Primary/html/.well-known/acme-challenge
 
−
Again, Ctrl-X to exit, Y to save.
 
  
−
Expand the template and restart apache:
+
* domain1.com
−
expand-template /etc/httpd/conf/httpd.conf
+
** www.domain1.com
−
service httpd-e-smith restart
+
** mail.domain1.com
 +
** ftp.domain1.com
  
−
Now you're ready to run letsencrypt.sh and get your certificate.
+
* domain2.com
−
  letsencrypt.sh -c
+
** www.domain2.com
 +
** mail.domain2.com
 +
For each DOMAIN that you want to be included in the certificate, run this command:
 +
  db domains setprop $DOMAIN letsencryptSSLcert enabled
  
−
The script will run for a moment and should report success.  If it does, look in /etc/letsencrypt.sh/certs/YOURDOMAIN and see if you have your files there.  You should see a number of .pem files, at least one .csr file, and five symbolic links (chain.pem, cert.csr, cert.pem, fullchain.pem, and privkey.pem).  If you do, congratulations!  You've successfully obtained your certificate.  The hook script should have also configured your server to use the new certificate.  To make sure, run
+
Using the above example, one invocation of the command would look like this:
−
  config show modSSL
+
  db domains setprop domain1.com  letsencryptSSLcert enabled
−
and make sure there are values set for crt, key, and CertificateChainFile.
 
  
−
As above, once you've obtained your certificate and configured your server, test your server with a tool like [https://www.ssllabs.com/ssltest/ SSLLabs.com] to make sure it's working properly.
+
For each HOSTNAME that you want to be included in the certificate, run this command:
 +
db hosts setprop $HOSTNAME letsencryptSSLcert enabled
  
−
== Troubleshooting ==
+
Using the above example, one invocation of the command would look like this:
 +
db hosts setprop www.domain1.com letsencryptSSLcert enabled
  
−
Errors in the certificate files may prevent Apache and some other services from starting.  If you previously had custom settings for modSSL, revert those with:
+
You can obtain a certificate for either of the following: all domains, all hostnames, or all domains AND hostnames. Only set one of the following.
−
config setprop modSSL crt (old value)
 
−
config setprop modSSL key (old value)
 
−
config setprop modSSL CertificateChainFile (old value--if this property was empty, delete it using the command line below)
 
  
−
If you did not have custom settings for modSSL, remove your changes with:
+
  config setprop letsencrypt configure domains
−
  config delprop modSSL crt
 
−
config delprop modSSL key
 
−
config delprop modSSL CertificateChainFile
 
  
−
Once you've made these changes, do:
+
  config setprop letsencrypt configure hosts
−
  signal-event post-upgrade
 
−
signal-event reboot
 
  
−
== Renewal of the certificates ==
+
  config setprop letsencrypt configure all
−
As part of the security of Letsencrypt the certificates must be renewed every 3 months. The process will differ depending on whether you're using the official client or letsencrypt.sh.
 
  
−
=== Using Letsencrypt.sh ===
+
To use individually enabled hosts or domains leave the default none.
−
When run, the Letsencrypt.sh script will check your existing certificate to see how long it's valid.  If it has less than 30 days' lifetime remaining (by default; this can be changed by setting RENEW_DAYS in config to something other than 30), the script will renew your certificates.  If more than 30 days remain, the script will exit without further action.  All that's necessary is to run letsencrypt.sh daily:
 
−
nano -w /etc/cron.daily/call-letsencrypt.sh
 
  
−
Enter the following in this file:
+
  config setprop letsencrypt configure none
−
  #!/bin/bash
 
−
/usr/local/bin/letsencrypt.sh -c
 
−
Ctrl-X to exit, Y to save.  Then make it executable:
 
−
chmod +x /etc/cron.daily/call-letsencrypt.sh
 
  
−
== Backup ==
 
−
Your certificate, private key, and other important information are stored in /etc/letsencrypt.sh, which is not included in the standard SME Server backup routines.  Make sure to add this directory to your backups.  See, e.g., [[Backup with dar#Adding files and directories|Backup with dar]] if you're using the workstation backup feature.
 
  
−
== Creating certificates for internal servers ==
+
With the system configuration described above, setting this to "domains" will obtain a certificate covering domain1.com and domain2.com, but not www.domain1.com, etc.  Setting it to "hosts" will obtain a certificate covering www.domain1.com, mail.domain1.com, ftp.domain1.com, etc., but not domain1.com or domain2.com.  Setting this property to "all" will include all domain names and hostnames in the certificate. '''See [[Letsencrypt/Troubleshooting#Some_challenges_complete_successfully_but_some_hostnames_fail|NOTE]] before setting this to "all".'''
−
{{Warning box|These procedures need to be revised to work with letsencrypt.sh}}
 
−
You may have one or more internal servers on your network for which you want or need trusted TLS certificates, but which aren't directly accessible from the outside.  The Letsencrypt service can handle this too, although the process isn't quite as simple as shown above.
 
  
−
Assumptions:
+
==== Enable test mode ====
−
* You've followed the instructions above to install the Letsencrypt client, and it's working
+
After installing and configuring all the domains and hosts, the next step is to use test mode, which is enabled by default.  This will obtain certificates from the staging server.  The rate limits discussed in the introduction won't apply, so any errors or other issues won't prevent you from obtaining your production certificate.  Enable test mode using this command:
−
* The hostname for which you need a certificate resolves, from the outside, to your SME Server.  For example, you've registered yourdomain.tld, and a DNS record for *.yourdomain.tld points to your SME Server.  You want to create a certificate for privateserver.yourdomain.tld
+
  config setprop letsencrypt status test
−
* Port 80 on your SME Server is open to the Internet--you aren't behind a firewall, or some ISP filtering, that would block it.
+
  signal-event console-save
−
 
 
−
You can either create the certificate on your SME Server, and then copy it to the internal server using whatever means that server provides; or (if the internal server is able to run the Letsencrypt client) you can generate the certificate on the internal server.
 
−
 
 
−
=== Generate the certificate on the SME Server ===
 
−
You could simply follow the instructions above, using the FQDN of your internal server.  However, those instructions require that you take down your web server briefly.  If you were generating a new certificate for the SME Server, you'd need to do this anyway, so that the web server would load the new certificate.  If you're generating a certificate for a different internal server, though, you may not want (and you do not need) to take down your SME Server's web server.
 
−
 
 
−
Follow the instructions above to create the certificate, but replace the letsencrypt command line with:
 
−
./letsencrypt-auto certonly --webroot --webroot-path /home/e-smith/files/ibays/Primary/html \
 
−
  --email admin@yourdomain.tld -d privateserver.yourdomain.tld
 
−
 
 
−
The Letsencrypt client will run and place the certificate files in /etc/letsencrypt/live/privateserver.yourdomain.tld/ on your SME Server.  You can then copy them to your internal server and install them using whatever mechanism that server provides.  This will not alter the configuration of your SME Server.
 
−
 
 
−
Once the certificate files are created, installing them on the internal server can be automated.  One possible way to do this is to first ensure that the root user on your SME server has an [[SSH Public-Private Keys|SSH public key]] generated, that key does not have a passphrase assigned, and that key is trusted by the root user on your internal server.  Then, you can add the following to your renewal script:
 
−
 
 
−
/opt/letsencrypt/letsencrypt-auto certonly --renew-by-default --webroot \
 
−
  --webroot-path /home/e-smith/files/ibays/Primary/html --email admin@yourdomain.tld \
 
−
  -d privateserver.yourdomain.tld
 
−
   
 
−
export CERTDIR="/etc/letsencrypt/live/privateserver.yourdomain.tld"
 
−
scp $CERTDIR/cert.pem root@privateserver:/etc/pki/tls/certs/privateserver.yourdomain.tld.crt
 
−
scp $CERTDIR/privkey.pem root@privateserver:/etc/pki/tls/private/privateserver.yourdomain.tld.key
 
−
scp $CERTDIR/chain.pem root@privateserver:/etc/pki/tls/certs/server-chain.crt
 
−
ssh root@privateserver /sbin/service httpd restart
 
−
 
 
−
You will, of course, need to modify the paths on the internal server to be consistent with where that server expects the certificate files to be; the paths above are applicable to a CentOS-based server.
 
−
 
 
−
=== Generate the certificate on the internal server ===
 
−
If the internal server is Unix-y and otherwise meets the requirements for the Letsencrypt client, you can run the client on the internal server using manual domain authentication.  This will require you to create a small file on your SME Server, which you can delete once the certificate is created.
 
−
 
 
−
The letsencrypt command would look like:
 
−
./letsencrypt-auto certonly --manual --email admin@yourdomain.tld -d privateserver.yourdomain.tld
 
−
 
 
−
When the Letsencrypt client runs, it will show you a challenge like the following, with different random strings:
 
−
Make sure your web server displays the following content at
 
−
http://privateserver.yourdomain.tld/.well-known/acme-challenge/U8AGPrh8wTM9wYpaOGUmfihZezzoLrCAhspJYeO-lsc before continuing:
 
−
 
−
U8AGPrh8wTM9wYpaOGUmfihZezzoLrCAhspJYeO-lsc.oYz0Q5G7t8oAAhKBGu6Y9InuE1eP2CRhR-RtUVXvloc
 
−
 
 
−
At this point, on your SME Server, you'll need to create that file:
 
−
# mkdir -p /home/e-smith/files/ibays/Primary/html/.well-known/acme-challenge
 
−
# echo U8AGPrh8wTM9wYpaOGUmfihZezzoLrCAhspJYeO-lsc.oYz0Q5G7t8oAAhKBGu6Y9InuE1eP2CRhR-RtUVXvloc > /home/e-smith/files/primary/html/.well-known/acme-challenge/U8AGPrh8wTM9wYpaOGUmfihZezzoLrCAhspJYeO-lsc
 
−
 
 
−
Then press the Enter key on your internal server.  As of this writing (10 Dec 2015), the client has a bug which reports "Self-verify of challenge failed", but it will create the certificates anyway (and it will correctly tell you that they're created).  Once the client finishes and tells you the certificates are created, you can delete the nonce from your SME Server:
 
−
# rm /home/e-smith/files/primary/html/.well-known/acme-challenge/U8AGPrh8wTM9wYpaOGUmfihZezzoLrCAhspJYeO-lsc
 
−
 
 
−
The certificate files will be in /etc/letsencrypt/live/privateserver.yourdomain.tld/ on your internal server.
 
−
 
 
−
==Install with John Crisp contrib==
 
−
sources: https://github.com/reetp/smeserver-letsencrypt
 
−
 
 
−
first add his repo
 
−
  {{:reetspetit}}
 
−
then apply changes
 
−
signal-event yum-modify
 
−
 
 
−
then install
 
−
  yum install smeserver-letsencrypt --enablerepo=reetp
 
−
 
 
−
 
 
−
set email
 
−
  config setprop letsencrypt email my@email.com
 
−
 
 
−
 
 
−
TEST FIRST
 
−
db configuration setprop letsencrypt status test
 
−
 
 
−
ENABLE SOME HOSTS Or DOMAINS for testing purposes
 
−
  db hosts setprop www.mydomain.com letsencryptSSLcert enabled
 
−
db domains setprop mydomain.com  letsencryptSSLcert enabled
 
  
−
Then run
+
You can now run dehydrated for the first time, and make sure it's able to connect to the Let's Encrypt servers, validate the hostnames you're requesting, and issue certificates.  To do this, run
 +
dehydrated -c
  
−
signal-event console-save
+
If it prints only "# INFO: Using main config file /etc/dehydrated/config" and returns you to the shell prompt, see [[Bugzilla:10300]].
−
service dnscache restart
 
  
−
Create test certificates (file is in the path so should be OK)
+
{{Note box|Solution for error "Malformed account ID in KeyID header URL" using API 2, for contrib versions 0.6.13 or older See [[Bugzilla:10828]] or update to latest contrib}}
  
−
  letsencrypt.sh -c -x
+
If this runs without errors, try to connect to your server-manager page.  You should see an error that the security certificate wasn't issued by a trusted certification authority; this is perfectly normal.  However, there should be a certificate, it should include all the hostnames you wanted included, and it should be valid for the next ninety days. If this was successful, proceed to production.
  
−
Once you are satisfied with your test
+
====Enable Production Mode====
 +
Once you've successfully tested your installation, set it to production mode using these commands:
  
 
  config setprop letsencrypt status enabled
 
  config setprop letsencrypt status enabled
−
 
 
  signal-event console-save
 
  signal-event console-save
−
  service dnscache restart
+
   
 +
Then obtain a new certificate from the Let's Encrypt production server:
 +
dehydrated -c -x
  
−
and
+
The -x flag here is needed to force dehydrated to obtain a new certificate, even though you have an existing certificate that's valid for more than 30 days.
  
−
  mv /etc/letsencrypt.sh/private_key.pem /etc/letsencrypt.sh/private_key.test
+
If this command succeeded, congratulations! You've successfully obtained a valid, trusted TLS certificate, which will automatically renew itself in perpetuity.  
−
letsencrypt.sh -c -x
 
  
−
Note thereafter you ONLY need to run
+
Once you've obtained your certificate and configured your server, test your server with a tool like [https://www.ssllabs.com/ssltest/ SSLLabs.com] to make sure it's working properly.
  
−
letsencrypt.sh -c
+
====Archive old certificates====
  
 +
A new function lets you cleanup old and archive old certificates.
  
−
=== what is next ?===
+
dehydrated --cleanup (-gc)
−
If you make any db key changes run console-save to regenerate your config files
 
  
−
You can now set any public ibays to SSL only using the server manager, or set the following key:
+
===Configuration properties===
 +
{| class="wikitable"
 +
!Key
 +
!property
 +
!default
 +
!values
 +
!
 +
|-
 +
| rowspan="10" |letsencrypt
 +
|ACCEPT_TERMS
 +
|
 +
|empty, yes
 +
|set to yes to accept terms of service, if left empty the contrib will not work.
 +
|-
 +
|API
 +
|2
 +
|1,2
 +
|deprecated, will always be v2, as v1 is deprecated as per june 2021
 +
|-
 +
|configure
 +
|none
 +
|none,all,domains,hosts
 +
|this will change the default behaviour on non explicitly domains or hosts with "letsencryptSSLcert enabled". By default will not be used, if hosts is set will ask a cert for all hosts, if domains is set will ask a cert for all domains, if all is set, will ask for both domains and hosts. In all situation it will ask a cert for domains/hosts where "letsencryptSSLcert enabled" is set and it is not set to "letsencryptSSLcert disabled"
 +
|-
 +
|email
 +
|
 +
|email
 +
|enter the email to create account and receive updates from Let's Encrypt
 +
|-
 +
|hookScript
 +
|disabled
 +
|enabled,disabled
 +
|will trigger advanced hook script if enabled, even if disabled the part to signal-event ssl-update to propagate the cert will run.
 +
|-
 +
|hostOverride
 +
|disabled
 +
|yes,disabled
 +
|default disabled, if disabled will only ask cert for hosts (if selected according to configure and "letsencryptSSLcert enabled") for hosts with type=Self. If set to yes will include any listed hosts whether remote or local.
 +
|-
 +
|keysize
 +
|4096
 +
|base 2 number
 +
|length of your certificate's private key, if you don't want the '''default of 4096''' bits.  This should not be necessary in most cases, but if desired, use this command to do so:
 +
|-
 +
|status
 +
|test
 +
|enabled,disabled,test
 +
|default status is disabled, '''First set it to test''' to connect to the test server of let's Encrypt to check if your server is well configured. After checking everything is ok, you can set it to enabled.
 +
|}
  
−
db accounts setprop {accountname} SSL enabled
+
== Troubleshooting ==
−
 
+
see [[Letsencrypt/Troubleshooting]]
−
You cannot set the Primary ibay to SSL from the panel:
 
−
 
 
−
db accounts setprop Primary SSL enabled
 
−
 
 
−
signal-event console-save
 
−
service dnscache restart
 
−
 
 
−
or
 
−
 
 
−
signal-event ibay-modify Primary
 
−
 
 
−
=== other info ===
 
−
Optional keys - (not required)
 
−
 
 
−
config setprop letsencrypt email (defaults to empty)
 
−
config setprop letsencrypt keysize (defaults to 4096)
 
−
 
 
−
If the licence changes before this script is updated you can specify a new licence URL:
 
−
config setprop letsencrypt licence https://letsencrypt.org/documents/LE-SA-v1.0.1-July-27-2015.pdf
 
−
 
 
−
You can enable just a domain or just a host on a domain
 
−
 
 
−
Per domain
 
−
 
 
−
db domains setprop mydomain.com letsencryptSSLcert enabled
 
−
 
 
−
Per host
 
−
 
 
−
db hosts setprop www.mydomain.com letsencryptSSLcert enabled
 
  
−
If you want a hook script to push changes remotely (not required)
+
== Advanced Topics ==
 +
see [[Letsencrypt/Advanced]]
  
−
db configuration setprop letsencrypt hookScript enabled
 
−
db configuration setprop letsencrypt user someuser
 
−
db configuration setprop letsencrypt host 1.2.3.4 db configuration setprop letsencrypt path //some/remote/local/path
 
  
−
You can now use a db entry to set all domains or hosts regardless of status
+
== Uninstall ==
 +
yum remove {{#var:smecontribname}}  {{#var:contribname}}
 +
== Bugs ==
 +
Please raise bugs under the SME-Contribs section in [http://bugs.contribs.org/enter_bug.cgi bugzilla]
 +
and select the smeserver-letsencrypt component or use {{BugzillaFileBug|product=SME%20Contribs|component=smeserver-letsencrypt|title=this link}}
  
−
config setprop letsencrypt configure none| all | domains | hosts
+
{{#bugzilla:columns=id,product,version,status,summary |sort=id |order=desc |component=smeserver-letsencrypt |disablecache=1|noresultsmessage="No open bugs found."}}
  
−
default is none
+
== Changelog ==
 +
Only released version in smecontrib are listed here.
  
−
If you set to domains it will enable ALL domains regardless of individual settings. Hosts will be per host as normal.
+
{{#smechangelog:smeserver-letsencrypt}}
−
If you set to hosts it will enable ALL hosts regardless of individual settings. Domains will be per domain as normal
 
−
If you set to all it will enable ALL hosts AND domains regardless of individual settings.
 
  
−
==Source from info==
+
[[Category:Contrib]]  
−
Source: http://forums.contribs.org/index.php/topic,51961.msg266680.html#msg266680
+
[[Category:Howto]]  
−
[[Category:Howto]] [[Category:Security]] [[Category:Howto]]
+
[[Category:Security]]
 
[[Category: Administration:Certificates]]
 
[[Category: Administration:Certificates]]

Latest revision as of 08:18, 15 December 2023

Geographylogo.png Languages: 

English  • français


PythonIcon.png Skill level: Medium
The instructions on this page require a basic knowledge of linux.




letsencrypt
NeedImage.svg
letsencrypt logo
MaintainerJohn Crisp
Urlhttps://github.com/dehydrated-io/dehydrated
LicenceMIT license
Category

certificates

Tags dehydrated, letsencrypt, dns, http, ssl


Maintainer

John Crisp

Version

Add-on 10:
Contrib 9:
smeserver-letsencrypt
The latest version of smeserver-letsencrypt is available in the SME repository, click on the version number(s) for more information.



Description

Warning.png Warning:
The original protocol used by Let’s Encrypt for certificate issuance and management is called ACMEv1. In March of 2018 Letsencrypt introduced support for ACMEv2, a newer version of the protocol that matches what was finalized today as RFC 8555 328. They have been encouraging subscribers to move to the ACMEv2 protocol.

In March 2019 they announced an end of life plan for ACMEv1.

In November of 2019 they will stop allowing new account registrations through their ACMEv1 API endpoint. IMPORTANTLY Existing accounts will continue to function normally.

In June of 2020 they will stop allowing new domains to validate via ACMEv1.

Starting at the beginning of 2021 they will occasionally disable ACMEv1 issuance and renewal for periods of 24 hours, no more than once per month (OCSP service will not be affected). The intention is to induce client errors that might encourage subscribers to update to clients or configurations that use ACMEv2.

Renewal failures should be limited since new domain validations will already be disabled and we recommend renewing certificates 30 days before they expire.

In June of 2021 they will entirely disable ACMEv1 as a viable way to get a Let’s Encrypt certificate.


Let’s Encrypt is a new Certificate Authority: It’s free, automated, and open. Its main purpose is to allow people to encrypt their internet traffic at no cost, easily, and automatically. The certs delivered must be renewed every 3 months.

As of December 2015, the Letsencrypt service is in a public beta state. They issue valid, trusted certificates, but the client code (and, to a lesser extent, the server code) is likely in a state of flux. At least during the initial stages of the public beta, they're implementing rate-limiting, allowing no more than five certificates per domain in a rolling seven-day period. This may make them unsuitable for users of dynamic DNS services. The latest information about rate limiting should be posted on this page of the letsencrypt.org documentation. As of March 26, 2016, the rate limit has been increased to 20 certificates per domain per week.

If you're going to be testing things in ways that would involve requesting lots of certificates in a short period of time, you're encouraged to use the Letsencrypt staging CA for this purpose. Certificates generated by this CA will not be trusted by your browser, and will appear to be issued by the "Fake LE Intermediate X1", but it will allow you to validate the toolchain and workflow.

The current status of the Letsencrypt services can be found on their status page.

Multiple clients are available for the Letsencrypt services. The official "certbot" client from letsencrypt.org is quite full-featured, but has a number of dependencies that it needs to install. It also requires a newer version of Python than is included with a standard SME Server installation. Due to this complexity, and the lack of compatibility with SME 8.x, this document describes installation and use of dehydrated, an alternative client implemented as a BASH shell script.

Prerequisites

The Letsencrypt client and server interact to confirm that the person requesting a certificate for a hostname actually controls that host. For this reason, there are some prerequisites for your configuration. For example, if you're trying to obtain a certificate for www.example.com, the following conditions must be met:

  • www.example.com is a valid domain name--the domain has been registered, and DNS records are published for it.
  • www.example.com resolves to your SME Server--published DNS records give the external IP address of your SME Server when queried for www.example.com.
  • Your SME Server is connected to the Internet, and is able to make outbound connections on ports 80 and 443.
  • Port 80 on your SME Server is open to the Internet (i.e., the Internet can reach your server on port 80)--you aren't behind a firewall, or some ISP filtering, that would block it. If you've made SSL mandatory for the Primary ibay, port 443 must also be open.

Letsencrypt will issue certificates that include multiple hostnames (for example, www.example.com, example.com, and mail.example.com), all of which would be part of the request. All of the conditions above must be true for all of the hostnames you want to include in the certificate.

Make sure you've got this all set up correctly before continuing.

Preparation

Before you begin installation, check to see if you or an installed contrib have configured any custom values for your TLS/SSL certificate: 

# config show modSSL

By default it would show: 

modSSL=service
   TCPPort=443
   access=public
   status=enabled

If this shows any values for crt, key, or CertificateChainFile, make a note of them. If you encounter an issue with the certificate files generated by Letsencrypt, you'll then be able to revert your changes. To make a 'backup' of your existing key and properties you can issue: 

config show modSSL > "/root/db_configuration_modSSL_backup_$(date +%Y%m%d_%H%M%S)"

Installation of Dehydrated letsencrypt contrib

John Crisp has prepared a contrib that installs the dehydrated script, creates the appropriate configuration files, and integrates with the SME templates system. This is the simplest way to install dehydrated on your SME Server. 

yum install smeserver-letsencrypt

You will then need to configure the domains and hosts for which you want to ask a certificate. See the following Configuration section.

If your smeaddons repo has been disabled add --enablerepo=smeaddons and reenable it, as it should be by default. 

db yum_repositories setprop smeaddons status enabled
signal-event yum-modify

Installation

yum install smeserver-letsencrypt
signal-event console-save

You will then need to configure the domains and hosts for which you want to ask a certificate. See the following Configuration section.

If your smeaddons repo has been disabled add --enablerepo=smeaddons and reenable it, as it should be by default. 

db yum_repositories setprop smeaddons status enabled
signal-event yum-modify

Updating

Few reported issue when upgrading the contribs see Bugzilla:10286 and Bugzilla:10097

A full update can be done as follow : 

yum update smeserver-letsencrypt dehydrated
config setprop letsencrypt ACCEPT_TERMS yes
signal-event console-save

failure to do this might leave the contribution not working and your certificates not renewed.

Configuration

There are several configuration database entries that need to be made in order to set up this contrib. Most of them tell the scripts which hostnames need to be part of your certificate.

Rush jobs

For the test (adjust the domains and hosts): 

config setprop letsencrypt ACCEPT_TERMS yes status test
# really fast job to enable the primary domain
db domains setprop $(config get DomainName) letsencryptSSLcert enabled
#foreach of your domains you want SSL do the following
db domains setprop domain1.com letsencryptSSLcert enabled
#foreach of your hosts (subdomains) you want SSL do the following
db hosts setprop www.domain1.com letsencryptSSLcert enabled
signal-event smeserver-letsencrypt-update
dehydrated -c

config setprop letsencrypt ACCEPT_TERMS yes status test API 2
#foreach of your domains you want SSL do the following
db domains setprop domain1.com letsencryptSSLcert enabled
#foreach of your hosts (subdomains) you want SSL do the following
db hosts setprop www.domain1.com letsencryptSSLcert enabled
signal-event console-save
dehydrated -c

Check that the certificates are available ( your browser will still issue an error, but you can explore the content of the certificate to see that the Let's Encrypt test CA was used to sign your SSL certificate and that all your domains and hosts are in the "Certificate Subject Alt Name" property.

For the production (adjust your email): 

config setprop letsencrypt status enabled email admin@$(config get DomainName)
signal-event smeserver-letsencrypt-update
dehydrated -c -x

config setprop letsencrypt status enabled email admin@domain1.com
signal-event console-save
dehydrated -c -x

Step by step configuration

Hosts and domains for the certificate

This contrib will obtain a single certificate from Let's Encrypt. The certificate will include all the domains and hostnames that:

  • Are configured on your SME Server (e.g., through the Server Manager), and
  • Are configured to use Let's Encrypt.

For example, your SME Server may contain the following domains and hostnames:

  • domain1.com
    • www.domain1.com
    • mail.domain1.com
    • ftp.domain1.com
  • domain2.com
    • www.domain2.com
    • mail.domain2.com

For each DOMAIN that you want to be included in the certificate, run this command: 

db domains setprop $DOMAIN letsencryptSSLcert enabled

Using the above example, one invocation of the command would look like this: 

db domains setprop domain1.com  letsencryptSSLcert enabled

For each HOSTNAME that you want to be included in the certificate, run this command: 

db hosts setprop $HOSTNAME letsencryptSSLcert enabled

Using the above example, one invocation of the command would look like this: 

db hosts setprop www.domain1.com letsencryptSSLcert enabled

You can obtain a certificate for either of the following: all domains, all hostnames, or all domains AND hostnames. Only set one of the following. 

config setprop letsencrypt configure domains

config setprop letsencrypt configure hosts

config setprop letsencrypt configure all

To use individually enabled hosts or domains leave the default none. 

config setprop letsencrypt configure none


With the system configuration described above, setting this to "domains" will obtain a certificate covering domain1.com and domain2.com, but not www.domain1.com, etc. Setting it to "hosts" will obtain a certificate covering www.domain1.com, mail.domain1.com, ftp.domain1.com, etc., but not domain1.com or domain2.com. Setting this property to "all" will include all domain names and hostnames in the certificate. See NOTE before setting this to "all".

Enable test mode

After installing and configuring all the domains and hosts, the next step is to use test mode, which is enabled by default. This will obtain certificates from the staging server. The rate limits discussed in the introduction won't apply, so any errors or other issues won't prevent you from obtaining your production certificate. Enable test mode using this command: 

config setprop letsencrypt status test
signal-event console-save

You can now run dehydrated for the first time, and make sure it's able to connect to the Let's Encrypt servers, validate the hostnames you're requesting, and issue certificates. To do this, run 

dehydrated -c

If it prints only "# INFO: Using main config file /etc/dehydrated/config" and returns you to the shell prompt, see Bugzilla:10300.


Important.png Note:
Solution for error "Malformed account ID in KeyID header URL" using API 2, for contrib versions 0.6.13 or older See Bugzilla:10828 or update to latest contrib


If this runs without errors, try to connect to your server-manager page. You should see an error that the security certificate wasn't issued by a trusted certification authority; this is perfectly normal. However, there should be a certificate, it should include all the hostnames you wanted included, and it should be valid for the next ninety days. If this was successful, proceed to production.

Enable Production Mode

Once you've successfully tested your installation, set it to production mode using these commands: 

config setprop letsencrypt status enabled
signal-event console-save

Then obtain a new certificate from the Let's Encrypt production server: 

dehydrated -c -x

The -x flag here is needed to force dehydrated to obtain a new certificate, even though you have an existing certificate that's valid for more than 30 days.

If this command succeeded, congratulations! You've successfully obtained a valid, trusted TLS certificate, which will automatically renew itself in perpetuity.

Once you've obtained your certificate and configured your server, test your server with a tool like SSLLabs.com to make sure it's working properly.

Archive old certificates

A new function lets you cleanup old and archive old certificates. 

dehydrated --cleanup (-gc)

Configuration properties

Key property default values
letsencrypt ACCEPT_TERMS empty, yes set to yes to accept terms of service, if left empty the contrib will not work.
API 2 1,2 deprecated, will always be v2, as v1 is deprecated as per june 2021
configure none none,all,domains,hosts this will change the default behaviour on non explicitly domains or hosts with "letsencryptSSLcert enabled". By default will not be used, if hosts is set will ask a cert for all hosts, if domains is set will ask a cert for all domains, if all is set, will ask for both domains and hosts. In all situation it will ask a cert for domains/hosts where "letsencryptSSLcert enabled" is set and it is not set to "letsencryptSSLcert disabled"
email email enter the email to create account and receive updates from Let's Encrypt
hookScript disabled enabled,disabled will trigger advanced hook script if enabled, even if disabled the part to signal-event ssl-update to propagate the cert will run.
hostOverride disabled yes,disabled default disabled, if disabled will only ask cert for hosts (if selected according to configure and "letsencryptSSLcert enabled") for hosts with type=Self. If set to yes will include any listed hosts whether remote or local.
keysize 4096 base 2 number length of your certificate's private key, if you don't want the default of 4096 bits. This should not be necessary in most cases, but if desired, use this command to do so:
status test enabled,disabled,test default status is disabled, First set it to test to connect to the test server of let's Encrypt to check if your server is well configured. After checking everything is ok, you can set it to enabled.

Troubleshooting

see Letsencrypt/Troubleshooting

Advanced Topics

see Letsencrypt/Advanced


Uninstall

yum remove smeserver-letsencrypt  letsencrypt

Bugs

Please raise bugs under the SME-Contribs section in bugzilla and select the smeserver-letsencrypt component or use this link


IDProductVersionStatusSummary (10 tasks) ⇒
12325SME Contribs10.0CONFIRMEDrenewal fails after domain deleted from manager.
11796SME ContribsFuturCONFIRMEDIs the dns-01 Challenge Supported or is it in planing?
11442SME Contribs10alphaCONFIRMEDmultiple fragments related to some other bugs
10920SME Contribs10alphaCONFIRMEDmove .well-known/acme-challenge out of the Primary ibay
10836SME Contribs9.2CONFIRMEDforce migration from acme-v1 to acme-v2
10818SME Contribs9.2CONFIRMEDtemplate does not respect domain-deleted
10656SME Contribs9.2CONFIRMEDNo letsencrypt certificate for Internet enable password protected Ibay
10483SME Contribs9.2CONFIRMEDrenewal fails with ibay using password
10462SME ContribsFuturCONFIRMEDNFR: implement per certificate / domain
10280SME Contribs9.2CONFIRMEDadd test for domain and host to disable the one at least defined in publicly available dns

Changelog

Only released version in smecontrib are listed here.

smeserver-letsencrypt Changelog: SME 10 (smeaddons)
2022/07/30 Brian Read 0.5-24.sme
- Re-build and link to latest devtools [SME: 11997]
2022/07/25 Jean-Philippe Pialasse 0.5-23.sme
- add to core backup [SME: 12011]
2022/06/15 Brian Read 0.5-22.sme
- Add action to check if dehydrated.timer is running and stop it if so [SME: 11996]
2022/06/12 Brian Read 0.5-21.sme
- Stop systemd timer runnning as well as cron [SME: 11990]
2022/03/23 Jean-Philippe Pialasse 0.5-19.sme
- use a general Alias for acme path and a proxypass [SME: 10637]
Retrieved from "https://wiki.koozali.org/index.php?title=Letsencrypt&oldid=42414"