Letsencrypt
 | |
| letsencrypt logo | |
| Maintainer | John Crisp |
|---|---|
| Url | https://github.com/dehydrated-io/dehydrated |
| Licence | MIT license |
| Category | |
| Tags | dehydrated, letsencrypt, dns, http, ssl |
Maintainer
John Crisp
Version
Description
Let’s Encrypt is a new Certificate Authority: It’s free, automated, and open. Its main purpose is to allow people to encrypt their internet traffic at no cost, easily, and automatically. The certs delivered must be renewed every 3 months.
As of December 2015, the Letsencrypt service is in a public beta state. They issue valid, trusted certificates, but the client code (and, to a lesser extent, the server code) is likely in a state of flux. At least during the initial stages of the public beta, they're implementing rate-limiting, allowing no more than five certificates per domain in a rolling seven-day period. This may make them unsuitable for users of dynamic DNS services. The latest information about rate limiting should be posted on this page of the letsencrypt.org documentation. As of March 26, 2016, the rate limit has been increased to 20 certificates per domain per week.
If you're going to be testing things in ways that would involve requesting lots of certificates in a short period of time, you're encouraged to use the Letsencrypt staging CA for this purpose. Certificates generated by this CA will not be trusted by your browser, and will appear to be issued by the "Fake LE Intermediate X1", but it will allow you to validate the toolchain and workflow.
The current status of the Letsencrypt services can be found on their status page.
Multiple clients are available for the Letsencrypt services. The official "certbot" client from letsencrypt.org is quite full-featured, but has a number of dependencies that it needs to install. It also requires a newer version of Python than is included with a standard SME Server installation. Due to this complexity, and the lack of compatibility with SME 8.x, this document describes installation and use of dehydrated, an alternative client implemented as a BASH shell script.
Prerequisites
The Letsencrypt client and server interact to confirm that the person requesting a certificate for a hostname actually controls that host. For this reason, there are some prerequisites for your configuration. For example, if you're trying to obtain a certificate for www.example.com, the following conditions must be met:
- www.example.com is a valid domain name--the domain has been registered, and DNS records are published for it.
- www.example.com resolves to your SME Server--published DNS records give the external IP address of your SME Server when queried for www.example.com.
- Your SME Server is connected to the Internet, and is able to make outbound connections on ports 80 and 443.
- Port 80 on your SME Server is open to the Internet (i.e., the Internet can reach your server on port 80)--you aren't behind a firewall, or some ISP filtering, that would block it. If you've made SSL mandatory for the Primary ibay, port 443 must also be open.
Letsencrypt will issue certificates that include multiple hostnames (for example, www.example.com, example.com, and mail.example.com), all of which would be part of the request. All of the conditions above must be true for all of the hostnames you want to include in the certificate.
Make sure you've got this all set up correctly before continuing.
Preparation
Before you begin installation, check to see if you or an installed contrib have configured any custom values for your TLS/SSL certificate:
# config show modSSL
By default it would show:
modSSL=service TCPPort=443 access=public status=enabled
If this shows any values for crt, key, or CertificateChainFile, make a note of them. If you encounter an issue with the certificate files generated by Letsencrypt, you'll then be able to revert your changes. To make a 'backup' of your existing key and properties you can issue:
config show modSSL > "/root/db_configuration_modSSL_backup_$(date +%Y%m%d_%H%M%S)"
Installation of Dehydrated letsencrypt contrib
John Crisp has prepared a contrib that installs the dehydrated script, creates the appropriate configuration files, and integrates with the SME templates system. This is the simplest way to install dehydrated on your SME Server.
yum install smeserver-letsencrypt
You will then need to configure the domains and hosts for which you want to ask a certificate. See the following Configuration section.
If your smeaddons repo has been disabled add --enablerepo=smeaddons and reenable it, as it should be by default.
db yum_repositories setprop smeaddons status enabled signal-event yum-modify
Installation
yum install smeserver-letsencrypt signal-event console-save
You will then need to configure the domains and hosts for which you want to ask a certificate. See the following Configuration section.
If your smeaddons repo has been disabled add --enablerepo=smeaddons and reenable it, as it should be by default.
db yum_repositories setprop smeaddons status enabled signal-event yum-modify
Updating
Few reported issue when upgrading the contribs see Bugzilla:10286 and Bugzilla:10097
A full update can be done as follow :
yum update smeserver-letsencrypt dehydrated config setprop letsencrypt ACCEPT_TERMS yes signal-event console-save
failure to do this might leave the contribution not working and your certificates not renewed.
Configuration
There are several configuration database entries that need to be made in order to set up this contrib. Most of them tell the scripts which hostnames need to be part of your certificate.
Rush jobs
For the test (adjust the domains and hosts):
config setprop letsencrypt ACCEPT_TERMS yes status test # really fast job to enable the primary domain db domains setprop $(config get DomainName) letsencryptSSLcert enabled #foreach of your domains you want SSL do the following db domains setprop domain1.com letsencryptSSLcert enabled #foreach of your hosts (subdomains) you want SSL do the following db hosts setprop www.domain1.com letsencryptSSLcert enabled signal-event smeserver-letsencrypt-update dehydrated -c
config setprop letsencrypt ACCEPT_TERMS yes status test API 2 #foreach of your domains you want SSL do the following db domains setprop domain1.com letsencryptSSLcert enabled #foreach of your hosts (subdomains) you want SSL do the following db hosts setprop www.domain1.com letsencryptSSLcert enabled signal-event console-save dehydrated -c
Check that the certificates are available ( your browser will still issue an error, but you can explore the content of the certificate to see that the Let's Encrypt test CA was used to sign your SSL certificate and that all your domains and hosts are in the "Certificate Subject Alt Name" property.
For the production (adjust your email):
config setprop letsencrypt status enabled email admin@$(config get DomainName) signal-event smeserver-letsencrypt-update dehydrated -c -x
config setprop letsencrypt status enabled email admin@domain1.com signal-event console-save dehydrated -c -x
Step by step configuration
Hosts and domains for the certificate
This contrib will obtain a single certificate from Let's Encrypt. The certificate will include all the domains and hostnames that:
- Are configured on your SME Server (e.g., through the Server Manager), and
- Are configured to use Let's Encrypt.
For example, your SME Server may contain the following domains and hostnames:
- domain1.com
- www.domain1.com
- mail.domain1.com
- ftp.domain1.com
- domain2.com
- www.domain2.com
- mail.domain2.com
For each DOMAIN that you want to be included in the certificate, run this command:
db domains setprop $DOMAIN letsencryptSSLcert enabled
Using the above example, one invocation of the command would look like this:
db domains setprop domain1.com letsencryptSSLcert enabled
For each HOSTNAME that you want to be included in the certificate, run this command:
db hosts setprop $HOSTNAME letsencryptSSLcert enabled
Using the above example, one invocation of the command would look like this:
db hosts setprop www.domain1.com letsencryptSSLcert enabled
You can obtain a certificate for either of the following: all domains, all hostnames, or all domains AND hostnames. Only set one of the following.
config setprop letsencrypt configure domains
config setprop letsencrypt configure hosts
config setprop letsencrypt configure all
To use individually enabled hosts or domains leave the default none.
config setprop letsencrypt configure none
With the system configuration described above, setting this to "domains" will obtain a certificate covering domain1.com and domain2.com, but not www.domain1.com, etc. Setting it to "hosts" will obtain a certificate covering www.domain1.com, mail.domain1.com, ftp.domain1.com, etc., but not domain1.com or domain2.com. Setting this property to "all" will include all domain names and hostnames in the certificate. see NOTE before setting this to "all"
Enable test mode
After installing and configuring all the domains and hosts, the next step is to use test mode, which is enabled by default. This will obtain certificates from the staging server. The rate limits discussed in the introduction won't apply, so any errors or other issues won't prevent you from obtaining your production certificate. Enable test mode using this command:
config setprop letsencrypt status test signal-event console-save
You can now run dehydrated for the first time, and make sure it's able to connect to the Let's Encrypt servers, validate the hostnames you're requesting, and issue certificates. To do this, run
dehydrated -c
If it prints only "# INFO: Using main config file /etc/dehydrated/config" and returns you to the shell prompt, see Bugzilla:10300.
If this runs without errors, try to connect to your server-manager page. You should see an error that the security certificate wasn't issued by a trusted certification authority; this is perfectly normal. However, there should be a certificate, it should include all the hostnames you wanted included, and it should be valid for the next ninety days. If this was successful, proceed to production.
Enable Production Mode
Once you've successfully tested your installation, set it to production mode using these commands:
config setprop letsencrypt status enabled signal-event console-save
Then obtain a new certificate from the Let's Encrypt production server:
dehydrated -c -x
The -x flag here is needed to force dehydrated to obtain a new certificate, even though you have an existing certificate that's valid for more than 30 days.
If this command succeeded, congratulations! You've successfully obtained a valid, trusted TLS certificate, which will automatically renew itself in perpetuity.
Once you've obtained your certificate and configured your server, test your server with a tool like SSLLabs.com to make sure it's working properly.
Archive old certificates
A new function lets you cleanup old and archive old certificates.
dehydrated --cleanup (-gc)
Configuration properties
| Key | property | default | values | |
|---|---|---|---|---|
| letsencrypt | ACCEPT_TERMS | empty, yes | set to yes to accept terms of service, if left empty the contrib will not work. | |
| API | 2 | 1,2 | deprecated, will always be v2, as v1 is deprecated as per june 2021 | |
| configure | none | none,all,domains,hosts | this will change the default behaviour on non explicitly domains or hosts with "letsencryptSSLcert enabled". By default will not be used, if hosts is set will ask a cert for all hosts, if domains is set will ask a cert for all domains, if all is set, will ask for both domains and hosts. In all situation it will ask a cert for domains/hosts where "letsencryptSSLcert enabled" is set and it is not set to "letsencryptSSLcert disabled" | |
| enter the email to create account and recieve updates from Let's Encrypt | ||||
| hookScript | disabled | enabled,disabled | will trigger advanced hook script if enabled, even if disabled the part to signal-event ssl-update to propagate the cert will run. | |
| hostOverride | disabled | yes,disabled | default disabled, if disabled will only ask cert for hosts (if selected accodring to configure and "letsencryptSSLcert enabled") for hosts with type=Self. If set to yes will include any listed hosts wether remote or local. | |
| keysize | 4096 | base 2 number | length of your certificate's private key, if you don't want the default of 4096 bits. This should not be necessary in most cases, but if desired, use this command to do so: | |
| status | test | enabled,disabled,test | default status is disabled, First set it to test to connect to the test server of let's Encrypt to check if your server is well configured. After checking everything is ok, you can set it to enabled. |
Troubleshooting
Advanced Topics
Uninstall
yum remove smeserver-letsencrypt letsencrypt
Bugs
Please raise bugs under the SME-Contribs section in bugzilla and select the smeserver-letsencrypt component or use this link
| ID | Product | Version | Status | Summary (10 tasks) ⇒ |
|---|---|---|---|---|
| 12325 | SME Contribs | 10.0 | CONFIRMED | renewal fails after domain deleted from manager. |
| 11796 | SME Contribs | Futur | CONFIRMED | Is the dns-01 Challenge Supported or is it in planing? |
| 11442 | SME Contribs | 10alpha | CONFIRMED | multiple fragments related to some other bugs |
| 10920 | SME Contribs | 10alpha | CONFIRMED | move .well-known/acme-challenge out of the Primary ibay |
| 10836 | SME Contribs | 9.2 | CONFIRMED | force migration from acme-v1 to acme-v2 |
| 10818 | SME Contribs | 9.2 | CONFIRMED | template does not respect domain-deleted |
| 10656 | SME Contribs | 9.2 | CONFIRMED | No letsencrypt certificate for Internet enable password protected Ibay |
| 10483 | SME Contribs | 9.2 | CONFIRMED | renewal fails with ibay using password |
| 10462 | SME Contribs | Futur | CONFIRMED | NFR: implement per certificate / domain |
| 10280 | SME Contribs | 9.2 | CONFIRMED | add test for domain and host to disable the one at least defined in publicly available dns |
Changelog
Only released version in smecontrib are listed here.
- Re-build and link to latest devtools [SME: 11997]
- add to core backup [SME: 12011]
- Add action to check if dehydrated.timer is running and stop it if so [SME: 11996]
- Stop systemd timer runnning as well as cron [SME: 11990]
- use a general Alias for acme path and a proxypass [SME: 10637]