4 ms·

You should automate the process and not manually request certificates. They are saying this for a long time. Every client can auto-renew.

Hackbraten 8y ago
I’ve been trying to automate this for a while but don’t know how to do it. Am using split DNS with BIND. The device in question accepts a private key and certificate chain but won’t allow arbitrary software to run so I need to do a manual TXT challenge every 3 months, which is super annoying. Any pointers?
- kissgyorgy 8y ago
  Lego [1] can do DNS (dns-01) challenge automatically, you can run it on a different device and transfer the certs to the device which needs it. This way you expose the secret key to some danger (secret keys should never leave the requester machine), but might be acceptable risk, it depends. [1]: https://github.com/xenolf/lego https://github.com/xenolf/lego
  - Hackbraten 8y ago
    Thanks! Yes, the risk is acceptable because the appliance can’t generate a key pair by itself. All machines involved (including the DNS server) are on the same LAN and physically under my control. Took me a while to figure out that Lego indeed supports BIND (via the RFC2136 DNS provider).
  - tialaramex 8y ago
    Lego can use a CSR, so you don't need to send private keys anywhere. (Secret keys and private keys aren't the same kind of thing. lyrics to U2's "The Fly" helps me remember, "A Secret is something you tell one other person, so I'm telling you" - somebody else needs to know the _secret_ key for it to work, but nobody at all knows the private key) A CSR is a signed document which says "I want a certificate for this identity with this public key". The signature proves you know the corresponding private key, but that key isn't transmitted anywhere. If you're willing to have relatively long lived keys (2-3 years isn't too scary for 2048-bit RSA) you can generate a private key and a CSR once, and have Lego or similar CSR-capable software obtain certificates from Let's Encrypt every couple of months with that CSR.

Hackbraten 8y ago

I’ve been trying to automate this for a while but don’t know how to do it. Am using split DNS with BIND. The device in question accepts a private key and certificate chain but won’t allow arbitrary software to run so I need to do a manual TXT challenge every 3 months, which is super annoying. Any pointers?

kissgyorgy 8y ago
Lego [1] can do DNS (dns-01) challenge automatically, you can run it on a different device and transfer the certs to the device which needs it. This way you expose the secret key to some danger (secret keys should never leave the requester machine), but might be acceptable risk, it depends. [1]: https://github.com/xenolf/lego https://github.com/xenolf/lego
- Hackbraten 8y ago
  Thanks! Yes, the risk is acceptable because the appliance can’t generate a key pair by itself. All machines involved (including the DNS server) are on the same LAN and physically under my control. Took me a while to figure out that Lego indeed supports BIND (via the RFC2136 DNS provider).
- tialaramex 8y ago
  Lego can use a CSR, so you don't need to send private keys anywhere. (Secret keys and private keys aren't the same kind of thing. lyrics to U2's "The Fly" helps me remember, "A Secret is something you tell one other person, so I'm telling you" - somebody else needs to know the _secret_ key for it to work, but nobody at all knows the private key) A CSR is a signed document which says "I want a certificate for this identity with this public key". The signature proves you know the corresponding private key, but that key isn't transmitted anywhere. If you're willing to have relatively long lived keys (2-3 years isn't too scary for 2048-bit RSA) you can generate a private key and a CSR once, and have Lego or similar CSR-capable software obtain certificates from Let's Encrypt every couple of months with that CSR.