Letsencrypt
Introduction
Let’s Encrypt is a new Certificate Authority: It’s free, automated, and open. Its main purpose is to allow people to encrypt their internet traffic by a very simple system.
The certs delivered must be renewed every 3 months.
As of December 2015, the Letsencrypt service is in a public beta state. They issue valid, trusted certificates, but the client code (and, to a lesser extent, the server code) is likely in a state of flux.
Prerequisites
The Letsencrypt client and server interact to confirm that the person requesting a certificate for a hostname actually controls that host. For this reason, there are some prerequisites for your configuration. For example, if you're trying to obtain a certificate for www.example.com, the following conditions must be met:
- www.example.com is a valid domain name--the domain has been registered, and DNS records are published for it.
- www.example.com resolves to your SME Server--published DNS records give the external IP address of your SME Server when queried for www.example.com.
- Your SME Server is connected to the Internet.
- Port 80 on your SME Server is open to the Internet--you aren't behind a firewall, or some ISP filtering, that would block it.
Letsencrypt will issue certificates that include multiple hostnames (for example, www.example.com, example.com, and mail.example.com), all of which would be part of the request. All of the conditions above must be true for all of the hostnames you want to include in the certificate.
Make sure you've got this all set up correctly before continuing.
Installation
For the installation of Letsencrypt, the initial generation of the certificates and periodically re-new the authority certificates, at minimum Python version 2.7 is required. By default SME Server comes with a lower version, but below instruction will enable you to install version 2.7 in a 'supported' way, next to the default SME Server Python version. The newly installed Python version 2.7 will then only be used (after initial installation) for the renewal of the certificates (periodically and mandatory every 3 months).
Follow the instructions at Software_Collections and the python related wiki page specifically. You need to add the scl-repository for Python 2.7 that can be found here
To install Python 2.7:
yum install python27 --enablerepo=scl-python27
You can download the latest Letsencrypt code from their Github page either via GIT or as a ZIP file.
To download via GIT do:
yum install git cd /opt git clone https://github.com/letsencrypt/letsencrypt.git
To download as a ZIP do:
wget https://github.com/letsencrypt/letsencrypt/archive/master.zip -P /opt unzip /opt/master.zip -d /opt && mv /opt/letsencrypt-master /opt/letsencrypt rm -f /opt/master.zip
To use Let's Encrypt run:
cd /opt/letsencrypt service httpd-e-smith stop scl enable python27 bash ./letsencrypt-auto certonly --standalone --email me@mydomain.co.uk -d test.firstdomain.co.uk -d seconddomain.co.uk -d www.seconddomain.co.uk exit
Replacing email and domains as required. You should include every hostname that is hosted on your SME server, along with any aliases you use (e.g., www.yourdomain.tld, mail.yourdomain.tld, yourdomain.tld, www.yourotherdomain.tld, etc.). If it completes with no errors, configure SME with the certificates generated:
config setprop modSSL crt /etc/letsencrypt/live/test.firstdomain.co.uk/cert.pem config setprop modSSL key /etc/letsencrypt/live/test.firstdomain.co.uk/privkey.pem config setprop modSSL CertificateChainFile /etc/letsencrypt/live/test.firstdomain.co.uk/chain.pem signal-event domain-modify; signal-event email-update; signal-event ibay-modify
Troubleshooting
In case of errors the apache service may not start anymore, a simple rollback may be used with :
config delprop modSSL crt config delprop modSSL key config delprop modSSLCertificateChainFile signal-event post-upgrade signal-event reboot
Renewal of the certificates
As part of the security of Letsencrypt the certificates must be renewed every 3 months.
The following script will automatically renew your certificate. Save it in a convenient place, for example, /opt/letsencrypt-renew.sh;don't forget to chmod +x the file
#!/bin/bash source /opt/rh/python27/enable export X_SCLS="`scl enable python27 'echo $X_SCLS'`" /sbin/service httpd-e-smith stop /opt/letsencrypt/letsencrypt-auto certonly --standalone --renew-by-default --email me@mydomain.co.uk \ -d test.firstdomain.co.uk -d seconddomain.co.uk -d www.seconddomain.co.uk /sbin/e-smith/signal-event domain-modify /sbin/e-smith/signal-event email-update /sbin/e-smith/signal-event ibay-modify
You may want to set this up as a cron job to run every two months, to make sure your certificate doesn't expire. Please see Crontab_Manager contrib for an easy way to achieve this. Or, to set this from the command line, do the following:
mkdir -p /etc/e-smith/templates-custom/etc/crontab nano /etc/e-smith/templates-custom/etc/crontab/sslrenew
The following example will run the renewal script at 22:48 on the third of every other month (Feb, Apr, Jun, etc.):
48 22 3 */2 * root /opt/letsencrypt-renew.sh
then expand and restart
expand-template /etc/crontab service crond restart
The time and day of the month can be chosen at your discretion--I've deliberately chosen a time that isn't at the top or bottom of the hour, or on the first of the month, in the hope of reducing load on letsencrypt's servers. Since the certificates are good for 90 days, this will renew your certificate in plenty of time.
Backup
Your certificate, private key, and other important information are stored in /etc/letsencrypt, which is not included in the standard SME Server backup routines. Make sure to add this directory to your backups. See, e.g., Backup with dar if you're using the workstation backup feature.
Source from info
Source: http://forums.contribs.org/index.php/topic,51961.msg266680.html#msg266680
