4 ms·

The official lets-encrypt client has an extremely large dependency graph, and using the client requires server downtime since it takes over port 80. Can either

The official lets-encrypt client has an extremely large dependency graph, and using the client requires server downtime since it takes over port 80. Can either of these things be improved?

ultramancool 11y ago
Yes, this greatly annoyed me too especially given the 3 month expiry time. https://github.com/diafygi/acme-tiny https://github.com/diafygi/acme-tiny is a tiny alternative client without any dependencies (except python itself), and you can use any web server including your usual running one to serve the challenge responses up.
- davexunit 11y ago
  Awesome. Exactly what I was hoping to hear. Thanks!
- wbond 11y ago
  It also requires the openssl executable in your path.
  - diafygi 11y ago
    Luckily, it's less than 200 lines and open source! Please feel free to fork it and modify for your needs :)
    - wbond 11y ago
      I was just clarifying for other readers. I looked through it because I've been working on some Python crypto stuff for a while, so I was curious what it used since the statement above was that it only required Python.
scrollaway 11y ago
The client supports being plugged into your running instance of nginx/apache as long as it can provide the appropriate .well-known paths.
- Vespasian 11y ago
  Yep. The option is called 'webroot' and using letsencrypt-auto (the offical client) I deployed this on a few servers and setup cron to renew automatically. It's not very well documented (at least wasn't when I last checked).
finnn 11y ago
I think you should double check the taking over port 80 thing. There are a number of authenticators that do not require taking down your existing webserver. I've used the webroot authenticator to get several certificates without taking down anything.
- ultramancool 11y ago
  Not supported on all platforms though, on my FreeBSD box the only option it gave me was to take down the web server. Maybe it's possible with manual config?
  - pilif 11y ago
    There is an option to run it in a different port which will allow you to reverse proxy to it. --standalone-supported-challenges http-01 --http-01-port 9999 Will make it listen on port 9999. Their server will only connect to the official ports of course, so you need to reverse proxy
    - ultramancool 11y ago
      Nice, I really like that idea. Any information on what paths I'd need to reverse proxy to it?
      - merlincorey 11y ago
        In NginX you would need the following location (with different contents): location /.well-known/acme-challenge/ { alias /var/www/challenges/; try_files $uri =404; } Snippet from https://github.com/diafygi/acme-tiny https://github.com/diafygi/acme-tiny documentation.
    - FireBeyond 11y ago
      I can understand some of the need for this. On the other hand you could make it trust all privileged ports, which implies root access - but this is a separate concern for other users.

The official lets-encrypt client has an extremely large dependency graph, and using the client requires server downtime since it takes over port 80. Can either of these things be improved?

ultramancool 11y ago

Yes, this greatly annoyed me too especially given the 3 month expiry time. https://github.com/diafygi/acme-tiny https://github.com/diafygi/acme-tiny is a tiny alternative client without any dependencies (except python itself), and you can use any web server including your usual running one to serve the challenge responses up.

davexunit 11y ago
Awesome. Exactly what I was hoping to hear. Thanks!
wbond 11y ago
It also requires the openssl executable in your path.
- diafygi 11y ago
  Luckily, it's less than 200 lines and open source! Please feel free to fork it and modify for your needs :)
  - wbond 11y ago
    I was just clarifying for other readers. I looked through it because I've been working on some Python crypto stuff for a while, so I was curious what it used since the statement above was that it only required Python.

scrollaway 11y ago

The client supports being plugged into your running instance of nginx/apache as long as it can provide the appropriate .well-known paths.

Vespasian 11y ago
Yep. The option is called 'webroot' and using letsencrypt-auto (the offical client) I deployed this on a few servers and setup cron to renew automatically. It's not very well documented (at least wasn't when I last checked).

finnn 11y ago

I think you should double check the taking over port 80 thing. There are a number of authenticators that do not require taking down your existing webserver. I've used the webroot authenticator to get several certificates without taking down anything.

ultramancool 11y ago
Not supported on all platforms though, on my FreeBSD box the only option it gave me was to take down the web server. Maybe it's possible with manual config?
- pilif 11y ago
  There is an option to run it in a different port which will allow you to reverse proxy to it. --standalone-supported-challenges http-01 --http-01-port 9999 Will make it listen on port 9999. Their server will only connect to the official ports of course, so you need to reverse proxy
  - ultramancool 11y ago
    Nice, I really like that idea. Any information on what paths I'd need to reverse proxy to it?
    - merlincorey 11y ago
      In NginX you would need the following location (with different contents): location /.well-known/acme-challenge/ { alias /var/www/challenges/; try_files $uri =404; } Snippet from https://github.com/diafygi/acme-tiny https://github.com/diafygi/acme-tiny documentation.
  - FireBeyond 11y ago
    I can understand some of the need for this. On the other hand you could make it trust all privileged ports, which implies root access - but this is a separate concern for other users.