4 ms·

Lego [1] can do DNS (dns-01) challenge automatically, you can run it on a different device and transfer the certs to the device which needs it. This way you exp

• Hackbraten 8y ago
  Thanks! Yes, the risk is acceptable because the appliance can’t generate a key pair by itself. All machines involved (including the DNS server) are on the same LAN and physically under my control. Took me a while to figure out that Lego indeed supports BIND (via the RFC2136 DNS provider).
• tialaramex 8y ago
  Lego can use a CSR, so you don't need to send private keys anywhere. (Secret keys and private keys aren't the same kind of thing. lyrics to U2's "The Fly" helps me remember, "A Secret is something you tell one other person, so I'm telling you" - somebody else needs to know the _secret_ key for it to work, but nobody at all knows the private key) A CSR is a signed document which says "I want a certificate for this identity with this public key". The signature proves you know the corresponding private key, but that key isn't transmitted anywhere. If you're willing to have relatively long lived keys (2-3 years isn't too scary for 2048-bit RSA) you can generate a private key and a CSR once, and have Lego or similar CSR-capable software obtain certificates from Let's Encrypt every couple of months with that CSR.