7 ms·

> I'm using the acme.sh client but the process will be similar no matter which client you choose to use. Always nice to see some variety in clients along side

> I'm using the acme.sh client but the process will be similar no matter which client you choose to use. Always nice to see some variety in clients along side the official Let's Encrypt one. While we do use the official Python-based client at works at times, whenever I install it via apt, and it pulls in a whole bunch of dependencies, it's a bit disconcerting to me. I'm a bit partial to dehydrated, which is a shell script (works under Bash and Zsh): I find it a lot easier to understand. It's handy to put on Linux/POSIX-based appliances like F5s, where the only prerequisites are Bash, cURL, and OpenSSL (and standard Unix tools like sed, grep, etc): * https://devcentral.f5.com/s/articles/lets-encrypt-on-a-big-ip https://devcentral.f5.com/s/articles/lets-encrypt-on-a-big-i... * https://github.com/EquateTechnologies/dehydrated-bigip-ansible https://github.com/EquateTechnologies/dehydrated-bigip-ansib...

WesolyKubeczek 5y ago
> whenever I install it via apt, and it pulls in a whole bunch of dependencies, it's a bit disconcerting to me. This always makes me chuckle. HN always advise developers to always use existing libraries and to never reinvent the wheel, but feel „disconcerted” as soon as they have to deal with the direct result of such advice.
- ipaddr 5y ago
  Take advice with a grain of salt is my advice to you. Advice for the average person is not necessarily advice for everyone. The official client stopped supporting older os like centos 6. Using a third party libruary might be important for some. People heard using 'goto' is forbidden so many will get upset if one is found in a code base. You can use gotos and in some situations it becomes a better tradeoff. Advice in general is just advice in general..
  - marcosdumay 5y ago
    > People heard using 'goto' is forbidden so many will get upset if one is found in a code base. You can use gotos and in some situations it becomes a better tradeoff. I'm going completely off-topic on a tangent, but no modern language even supports the goto from the "Goto Considered Harmful" paper. All you can use nowadays (unless you write assembly) is a much weaker version that has none of the problems you'll find there.
    - ipaddr 5y ago
      The problem the goto solves in a language that have predefined line numbers like basic just doesn't apply with numberless line code bases. It's an example we can understand.. Like never use jquery use some complex framework when you need 5 actions.
      - IncRnd 5y ago
        > The problem the goto solves in a language that have predefined line numbers like basic just doesn't apply with numberless line code bases. That's not true. There are useful times to use goto, but the main issue with its use doesn't have to do with line numbers... Using goto leads to spaghetti code that is difficult to maintain or reason about.
    - freedomben 5y ago
      the amount of code in existence in languages that support "goto" is mindblowing. I would wager that the majority of developers have encountered it in a code base. even though it's not modern, it's certainly a relevant example for most people
      - fiddlerwoaroof 5y ago
        My suspicion is that the majority of developers today haven’t used anything besides JavaScript or Typescript professionally, with maybe a bit of Ruby or Python.
      - marcosdumay 5y ago
        You mean C? C hasn't supported the Dijkstra's bad version of goto since the last century. Gcc was one of the first to add a verification against it, so if your code compiles on gcc without any "ancient code" flag, it's not there.
- thraxil 5y ago
  Do you realize that "HN" isn't one single monolithic entity that needs to achieve 100% consistency in its views? Like if one person here says "use existing libraries" but then a different person says "don't use this existing library", that doesn't actually mean that someone was being hypocritical. You might also consider that not all advice (especially when presented in an extremely limited form like a comment box on a website) should be interpreted as black or white, full compliance or complete rejection, but might better be treated as a general guideline or recommendation and that standard disclaimers or tradeoffs ought to be implied. Certbot is a bad example of "use existing libraries and never reinvent the wheel" because it pulls in soooo many unrelated things. These are certbot's python dependencies: https://github.com/certbot/certbot/blob/master/tools/requirements.txt https://github.com/certbot/certbot/blob/master/tools/require... Almost 200 different dependencies. Most of them to handle some niche use-case that are likely not what a given user needs. For some people certbot, with its downsides still might be the best solution. For others, there might be a more appropriate solution that still avoids reinventing the wheel. Eg, I prefer to use a single Go library to do ACME stuff or to just use Traefik or Caddy or some other reverse proxy/load balancer that supports ACME transparently without pulling in a ton of extra packages that aren't relevant to me. But sometimes, cerbot is still the simplest solution, so I use that. I still reserve the right to wish that it had fewer dependencies.
- throw0101a 5y ago
  To accomplish basically the same result, dehydrated lists three dependencies (with openssl probably already installed on most systems): * https://packages.debian.org/bullseye/dehydrated https://packages.debian.org/bullseye/dehydrated (python3-)certbot lists more: * https://packages.debian.org/bullseye/python3-certbot https://packages.debian.org/bullseye/python3-certbot As a sysadmin I can examine the code path of, and wrap my head around, one of these much more easily than the other. If something breaks I can throw in a "set -x" in the shell script and start getting debugging information.
  - petre 5y ago
    The --cron flag is brilliant, I will definitely try it.
- IncRnd 5y ago
  Well, if a student driver is given the advice, "always drive to the right," that doesn't mean to turn left out of the right lane! Use some critical thinking, like the person you are laughing at did. Free advice over the Internet is worth exactly what it sounds like - free advice from nameless, anonymous people.
- glitcher 5y ago
  [All of] HN always... always... never... What an extremely low bar for an argument. Underachievers, please try harder!
silviot 5y ago
> whenever I install it via apt You have the option to create a virtualenv and install it with pip, or snap, or use a docker image. See [1]. This has a couple of advantages: * you'll get the latest version from the maintainers - for instance right now only debian unstable has the latest 1.18.0 version - debian testing bundles 1.12.0-2 * you won't be adding system packages that might affect other parts of the system [1] https://certbot.eff.org/docs/install.html#alternate-installation-methods https://certbot.eff.org/docs/install.html#alternate-installa...
- pbronez 5y ago
  This might be a good scenario for pipx. It’s a Python package manager optimized for deploying applications instead of libraries. https://pypa.github.io/pipx/ https://pypa.github.io/pipx/
  - memco 5y ago
    Use pipx-in-pipx to make it even more robust: https://pypi.org/project/pipx-in-pipx/ https://pypi.org/project/pipx-in-pipx/
    - gunapologist99 5y ago
      I hope this is a joke, right?
      - memco 5y ago
        Sadly, No. Thanks to the way Python works when installed via homebrew on Mac this is actually very necessary if you want to install system-wide python utilities that do not depend on the system python. Without it you can have these utilities broken by a system update or by a homebrew update that bumps the Python version.
- throw0101a 5y ago
  Which is another reason why I lean towards dehydrated when I can: a lot fewer "system packages" to deal with.
phone8675309 5y ago
I can't bear to use certbot because snaps on a headless server (along with using aide) are a complete nightmare and no-go for me. I'll second the suggestion for dehydrated.
- aorth 5y ago
  Prefer to avoid snaps too. First time I'm hearing of dehydrated. I've dabbled a bit with acme.sh too and it's good (can do ECC certs and it's a single shell script).
  - _joel 5y ago
    I've stopped using Ubuntu in favour of good old Debian due to Canonical foisting snaps. I know you can remove snapd but the whole Ubuntu ecosystem is pivoting towards them.
- caddybox 5y ago
  Genuine question : Whya re snaps a nightmare on headless servers? Their auto-updating nature does add some stability issues but any other reasons?
  - bitlevel 5y ago
    Because it's not conjusive to a minimal attack surface - by way of example: https://www.helpnetsecurity.com/2019/02/13/cve-2019-7304/ https://www.helpnetsecurity.com/2019/02/13/cve-2019-7304/
    - Osiris 5y ago
      Not to completely minimize it, but that says local attacker, not remote attacker. So someone would still have to gain access to the system in question in the first place.
      - phone8675309 5y ago
        Just because a server is headless does not mean that it isn't interactive in some way or running some user-submitted scripts or code. Also, compromising a service running as a user (not root) would be sufficient to then escalate.
cat199 5y ago
OpenBSD's 'acme-client' may be a good fit in these kinds of cases - not sure if anyone has ported to other systems but it's probably a pretty direct recompile with maybe a couple of adjustments https://man.openbsd.org/acme-client.conf.5 https://man.openbsd.org/acme-client.conf.5 http://cvsweb.openbsd.org/src/usr.sbin/acme-client/ http://cvsweb.openbsd.org/src/usr.sbin/acme-client/
- vbezhenar 5y ago
  It’s the most sane client and should’ve been a standard one.
  - tialaramex 5y ago
    The OpenBSD acme-client is OpenBSD specific and lacks a whole bunch of features, it is I suppose exactly what you'd expect the default acme-client to be in OpenBSD and so it fits its role perfectly but it doesn't make any sense as the "standard" ACME client with no support for lots of desirable ACME features.
- gray_-_wolf 5y ago
  I maintain portable fork of the project: https://git.sr.ht/~graywolf/acme-client-portable https://git.sr.ht/~graywolf/acme-client-portable
lisper 5y ago
I recommend acme-tiny: https://github.com/Tronde/acme-tiny https://github.com/Tronde/acme-tiny It's an acme client in a single, small, stand-alone Python file. I reverse-engineered it and ported it to Common Lisp. I haven't published the result, but I'd be happy to do so if anyone is interested.
- dividuum 5y ago
  Recommendation from me as well. Have been using this script for multiple years now without a single issue. The minimal code is awesome for avoiding unnecessary external dependencies and complexity. Be sure to use the latest version from https://github.com/diafygi/acme-tiny https://github.com/diafygi/acme-tiny though :-)
  - petre 5y ago
    From the gh page doc it requires too much stuff to set up. Imagine if you need certs for >10 domains I prefer lego + cronjob or caddy. Most web apps speak http now and it's just a matter of proxying to a local port, unless you are using php, uwsgi, psgi. Php-fpm is also well supported.
- deleted 5y ago
  [deleted]
gregmac 5y ago
+1 for dehydrated [1]. Aside from being able to run basically anywhere, it is very easy to script: Create a file with the list of domains you want, and run `dehydrated --cron`. dehydrated will obtain certs and/or modify existing and/or renew, or just do nothing. Certbot is designed for interactive use: obtaining, changing and renewing certificates are all distinct commands, and if you tell it to obtain a cert you already have, it'll just obtain it anyway. Handling this from a script is a huge pain. [1] https://github.com/dehydrated-io/dehydrated https://github.com/dehydrated-io/dehydrated
petre 5y ago
I use lego everywhere. You download it from github or build it with go, drop it in a bin folder, run it first time and set up a cronjob. That's it. No on site deps, no interpreters, no venv.

WesolyKubeczek 5y ago

> whenever I install it via apt, and it pulls in a whole bunch of dependencies, it's a bit disconcerting to me. This always makes me chuckle. HN always advise developers to always use existing libraries and to never reinvent the wheel, but feel „disconcerted” as soon as they have to deal with the direct result of such advice.

ipaddr 5y ago
Take advice with a grain of salt is my advice to you. Advice for the average person is not necessarily advice for everyone. The official client stopped supporting older os like centos 6. Using a third party libruary might be important for some. People heard using 'goto' is forbidden so many will get upset if one is found in a code base. You can use gotos and in some situations it becomes a better tradeoff. Advice in general is just advice in general..
- marcosdumay 5y ago
  > People heard using 'goto' is forbidden so many will get upset if one is found in a code base. You can use gotos and in some situations it becomes a better tradeoff. I'm going completely off-topic on a tangent, but no modern language even supports the goto from the "Goto Considered Harmful" paper. All you can use nowadays (unless you write assembly) is a much weaker version that has none of the problems you'll find there.
  - ipaddr 5y ago
    The problem the goto solves in a language that have predefined line numbers like basic just doesn't apply with numberless line code bases. It's an example we can understand.. Like never use jquery use some complex framework when you need 5 actions.
    - IncRnd 5y ago
      > The problem the goto solves in a language that have predefined line numbers like basic just doesn't apply with numberless line code bases. That's not true. There are useful times to use goto, but the main issue with its use doesn't have to do with line numbers... Using goto leads to spaghetti code that is difficult to maintain or reason about.
  - freedomben 5y ago
    the amount of code in existence in languages that support "goto" is mindblowing. I would wager that the majority of developers have encountered it in a code base. even though it's not modern, it's certainly a relevant example for most people
    - fiddlerwoaroof 5y ago
      My suspicion is that the majority of developers today haven’t used anything besides JavaScript or Typescript professionally, with maybe a bit of Ruby or Python.
    - marcosdumay 5y ago
      You mean C? C hasn't supported the Dijkstra's bad version of goto since the last century. Gcc was one of the first to add a verification against it, so if your code compiles on gcc without any "ancient code" flag, it's not there.
thraxil 5y ago
Do you realize that "HN" isn't one single monolithic entity that needs to achieve 100% consistency in its views? Like if one person here says "use existing libraries" but then a different person says "don't use this existing library", that doesn't actually mean that someone was being hypocritical. You might also consider that not all advice (especially when presented in an extremely limited form like a comment box on a website) should be interpreted as black or white, full compliance or complete rejection, but might better be treated as a general guideline or recommendation and that standard disclaimers or tradeoffs ought to be implied. Certbot is a bad example of "use existing libraries and never reinvent the wheel" because it pulls in soooo many unrelated things. These are certbot's python dependencies: https://github.com/certbot/certbot/blob/master/tools/requirements.txt https://github.com/certbot/certbot/blob/master/tools/require... Almost 200 different dependencies. Most of them to handle some niche use-case that are likely not what a given user needs. For some people certbot, with its downsides still might be the best solution. For others, there might be a more appropriate solution that still avoids reinventing the wheel. Eg, I prefer to use a single Go library to do ACME stuff or to just use Traefik or Caddy or some other reverse proxy/load balancer that supports ACME transparently without pulling in a ton of extra packages that aren't relevant to me. But sometimes, cerbot is still the simplest solution, so I use that. I still reserve the right to wish that it had fewer dependencies.
throw0101a 5y ago
To accomplish basically the same result, dehydrated lists three dependencies (with openssl probably already installed on most systems): * https://packages.debian.org/bullseye/dehydrated https://packages.debian.org/bullseye/dehydrated (python3-)certbot lists more: * https://packages.debian.org/bullseye/python3-certbot https://packages.debian.org/bullseye/python3-certbot As a sysadmin I can examine the code path of, and wrap my head around, one of these much more easily than the other. If something breaks I can throw in a "set -x" in the shell script and start getting debugging information.
- petre 5y ago
  The --cron flag is brilliant, I will definitely try it.
IncRnd 5y ago
Well, if a student driver is given the advice, "always drive to the right," that doesn't mean to turn left out of the right lane! Use some critical thinking, like the person you are laughing at did. Free advice over the Internet is worth exactly what it sounds like - free advice from nameless, anonymous people.
glitcher 5y ago
[All of] HN always... always... never... What an extremely low bar for an argument. Underachievers, please try harder!

silviot 5y ago

> whenever I install it via apt You have the option to create a virtualenv and install it with pip, or snap, or use a docker image. See [1]. This has a couple of advantages: * you'll get the latest version from the maintainers - for instance right now only debian unstable has the latest 1.18.0 version - debian testing bundles 1.12.0-2 * you won't be adding system packages that might affect other parts of the system [1] https://certbot.eff.org/docs/install.html#alternate-installation-methods https://certbot.eff.org/docs/install.html#alternate-installa...

pbronez 5y ago
This might be a good scenario for pipx. It’s a Python package manager optimized for deploying applications instead of libraries. https://pypa.github.io/pipx/ https://pypa.github.io/pipx/
- memco 5y ago
  Use pipx-in-pipx to make it even more robust: https://pypi.org/project/pipx-in-pipx/ https://pypi.org/project/pipx-in-pipx/
  - gunapologist99 5y ago
    I hope this is a joke, right?
    - memco 5y ago
      Sadly, No. Thanks to the way Python works when installed via homebrew on Mac this is actually very necessary if you want to install system-wide python utilities that do not depend on the system python. Without it you can have these utilities broken by a system update or by a homebrew update that bumps the Python version.
throw0101a 5y ago
Which is another reason why I lean towards dehydrated when I can: a lot fewer "system packages" to deal with.

phone8675309 5y ago

I can't bear to use certbot because snaps on a headless server (along with using aide) are a complete nightmare and no-go for me. I'll second the suggestion for dehydrated.

aorth 5y ago
Prefer to avoid snaps too. First time I'm hearing of dehydrated. I've dabbled a bit with acme.sh too and it's good (can do ECC certs and it's a single shell script).
- _joel 5y ago
  I've stopped using Ubuntu in favour of good old Debian due to Canonical foisting snaps. I know you can remove snapd but the whole Ubuntu ecosystem is pivoting towards them.
caddybox 5y ago
Genuine question : Whya re snaps a nightmare on headless servers? Their auto-updating nature does add some stability issues but any other reasons?
- bitlevel 5y ago
  Because it's not conjusive to a minimal attack surface - by way of example: https://www.helpnetsecurity.com/2019/02/13/cve-2019-7304/ https://www.helpnetsecurity.com/2019/02/13/cve-2019-7304/
  - Osiris 5y ago
    Not to completely minimize it, but that says local attacker, not remote attacker. So someone would still have to gain access to the system in question in the first place.
    - phone8675309 5y ago
      Just because a server is headless does not mean that it isn't interactive in some way or running some user-submitted scripts or code. Also, compromising a service running as a user (not root) would be sufficient to then escalate.

cat199 5y ago

OpenBSD's 'acme-client' may be a good fit in these kinds of cases - not sure if anyone has ported to other systems but it's probably a pretty direct recompile with maybe a couple of adjustments https://man.openbsd.org/acme-client.conf.5 https://man.openbsd.org/acme-client.conf.5 http://cvsweb.openbsd.org/src/usr.sbin/acme-client/ http://cvsweb.openbsd.org/src/usr.sbin/acme-client/

vbezhenar 5y ago
It’s the most sane client and should’ve been a standard one.
- tialaramex 5y ago
  The OpenBSD acme-client is OpenBSD specific and lacks a whole bunch of features, it is I suppose exactly what you'd expect the default acme-client to be in OpenBSD and so it fits its role perfectly but it doesn't make any sense as the "standard" ACME client with no support for lots of desirable ACME features.
gray_-_wolf 5y ago
I maintain portable fork of the project: https://git.sr.ht/~graywolf/acme-client-portable https://git.sr.ht/~graywolf/acme-client-portable

lisper 5y ago

I recommend acme-tiny: https://github.com/Tronde/acme-tiny https://github.com/Tronde/acme-tiny It's an acme client in a single, small, stand-alone Python file. I reverse-engineered it and ported it to Common Lisp. I haven't published the result, but I'd be happy to do so if anyone is interested.

dividuum 5y ago
Recommendation from me as well. Have been using this script for multiple years now without a single issue. The minimal code is awesome for avoiding unnecessary external dependencies and complexity. Be sure to use the latest version from https://github.com/diafygi/acme-tiny https://github.com/diafygi/acme-tiny though :-)
- petre 5y ago
  From the gh page doc it requires too much stuff to set up. Imagine if you need certs for >10 domains I prefer lego + cronjob or caddy. Most web apps speak http now and it's just a matter of proxying to a local port, unless you are using php, uwsgi, psgi. Php-fpm is also well supported.
deleted 5y ago
[deleted]

gregmac 5y ago

+1 for dehydrated [1]. Aside from being able to run basically anywhere, it is very easy to script: Create a file with the list of domains you want, and run `dehydrated --cron`. dehydrated will obtain certs and/or modify existing and/or renew, or just do nothing. Certbot is designed for interactive use: obtaining, changing and renewing certificates are all distinct commands, and if you tell it to obtain a cert you already have, it'll just obtain it anyway. Handling this from a script is a huge pain. [1] https://github.com/dehydrated-io/dehydrated https://github.com/dehydrated-io/dehydrated

petre 5y ago

I use lego everywhere. You download it from github or build it with go, drop it in a bin folder, run it first time and set up a cronjob. That's it. No on site deps, no interpreters, no venv.