11 ms·

Uacme: ACMEv2 client written in plain C with minimal dependencies

121 points by robalni 4y ago

galaxyLogic 4y ago
Certificates seem to be lots of work and complexity, and lots of do-it-yourself. Couldn't that functionality come as part of the OS? It is fundamental that computers should be able to know whom to trust and whom not.
- _8j50 4y ago
  It is in windows, the cert store comes with windows and you use for many applications from code signing, email signing, server cert signing to authenticating users and the computer to the network/AD. PKI is the way windows and the corporate world went. On nix you have PGP, with GPG it is sort of baked in I guess but it is used only in package signing and signing of text content in various contexts. I believe the "web of trust" is preferred over PKI but nix folks because they don't want to depend on certificate authorities mediating trust, instead you have key servers that only help in distributing keys. For *nix, the burden of forming trust is on the user. You have to either go to key signing parties (very scalable lol) or I guess google around and ask in chatrooms and look up trustworthy sites until you are confident a key us trustworthy? I mean you can cross-sign and all that but in reality, you have to investigate each key one by one and hope you don't screw up. Or what happens in most cases is people trusr https/PKI so key IDs on people's websites or a command asking you to import a key from their site over https is trusted... because PKI/TLS is much more practical. Get the GPG fans to like PKI and maybe Linux will have PKI cert management out of the box. The Linux kernel does support X509 and pki certs afaik, I don't know if you can make it store root certs and have it verify cert chains for you from userspace. Very possible but only applications using kTLS might want that. Perhaps a feature request with your favorite browsers and package managers to use kTLS instead of openssl/gnutls is a start?
  - jiggawatts 4y ago
    I suspect there isn't a Windows Enterprise PKI team any more as such, development seems to have stalled around 2016. There is no ACME support built-in either as a client or server, which is sad considering Windows already has dynamic DNS capabilities. Even Azure Key Vault won't integrate with Microsoft Enterprise PKI, which should tell you everything you need to know...
    - _8j50 4y ago
      On prem AD itself is going away, no idea if AAD has or will have a PKI component.
robalni 4y ago
I found this project while looking for a way to renew my SSL certificate without having to use certbot which has a lot of dependencies including python. This program is really small and simple and does exactly what I need. It's perfect.
- LinuxBender 4y ago
  If you like minimal dependencies another one to take a peek at may be acme.sh [1]. It depends on bash, openssl and curl. It seems to work fine in ash as well. It has code to handle most API's and most importantly to me is the great documentation. In the same spirit of minimal and light weight there is also testssh.sh [2] for testing TLS on HTTPS/SMTPS servers that also depends on bash and openssl. [1] - https://github.com/acmesh-official/acme.sh https://github.com/acmesh-official/acme.sh [2] - https://github.com/drwetter/testssl.sh https://github.com/drwetter/testssl.sh
  - encryptluks2 4y ago
    I'd prefer to use a C, Go, or Rust app at this point. I love shell scripts because it was one of the first scripting languages I learned, but I'd trust a developer capable of writing C, Go or Rust to do a better job and make something more optimized than what is within the scope of Posix shell scripting.
    - FpUser 4y ago
      To me it is a utility stuff. As long as it does the job (and acme.sh does it just fine) and does not require pulling down half of the Internet for dependencies I would not give rat's ass about what language has been used to write it.
    - vladvasiliu 4y ago
      There's step-cli that's just a single go executable: https://github.com/smallstep/cli https://github.com/smallstep/cli They also provide a CA to go with it, if you need internal certs.
ape4 4y ago
I really appreciate the limited dependencies. The readme says it needs only "libcurl and one of GnuTLS, OpenSSL or mbedTLS"
kazinator 4y ago
No, I want my Debian machine polluted with Snap garbage to run Certbot. Find someone sane to promote this to. :)
- 9dev 4y ago
  Right? It’s so ridiculous how you’re supposed to use Snap to install certbot. The (well, one of..) GitHub discussion is just beyond the pale: https://github.com/certbot/certbot/issues/8345#issuecomment-1039049260 https://github.com/certbot/certbot/issues/8345#issuecomment-...
  - kazinator 4y ago
    I really hate how all that junk urinates into /etc, which should be treated as immutable by applications. Changing state should go into /var/run.
    - Denvercoder9 4y ago
      /var/run isn't really suitable for certificates, as it's allowed to get cleared on every boot. /var/lib would be the better alternative.
  - vbezhenar 4y ago
    Just install docker or k8s and use certbot image.
    - jabbany 4y ago
      The thread above has mentioned a very real problem with snap running on OpenVZ. It requires either squashfs as a kernel module or FUSE+squashfuse. Many OpenVZ hosts will not provide either and docker/k8s is obviously out if you are already operating inside a container... Like, squashfs is great and all and packaged app images are an acceptable way of delivering desktop apps... but there's so much lossage here when certbot indirectly requires both just for an install. (I ended up going with acme.sh instead.)
christophilus 4y ago
Someone needs to tell the Manjaro folks about this.
adancalderon 4y ago
Been ussing this script https://github.com/srvrco/getssl https://github.com/srvrco/getssl
losingom 4y ago
If you want to be super minimal, I prefer acme.sh[1] instead. It even comes preconfigured for various DNS providers[2], and you can even create your own hook if there isn't already one[3]. [1] https://github.com/acmesh-official/acme.sh https://github.com/acmesh-official/acme.sh [2] https://github.com/acmesh-official/acme.sh/wiki/dnsapi https://github.com/acmesh-official/acme.sh/wiki/dnsapi [3] https://github.com/acmesh-official/acme.sh/wiki/DNS-API-Dev-Guide https://github.com/acmesh-official/acme.sh/wiki/DNS-API-Dev-...
- thayne 4y ago
  If you have over a thousand lines of bash (or any other kind of shell code really), that is a pretty big red flag that you probably shouldn't be using bash IMO.
  - delusional 4y ago
    If you want to issue a certificate in an environment where you only have a shell, it's the only language you can use. Sometimes you write in shell because it's the lowest common denominator.
    - encryptluks2 4y ago
      - delusional 4y ago
        Not everything I do is a job.
      - throw0101a 4y ago
        > If you only have shell on your servers then it is time to start looking for a new job. Perhaps you wish to have "real" certs on appliances like F5s and Isilons (FreeBSD-based) where you can't install extra stuff, but where curl and openssl (and bash/zsh) are present. Or perhaps you want to run simple software that you can actually audit. While "over a thousand lines of bash" may take a little while to examine, good luck auditing Zope, which is what certbot pulls in as a dependency: * https://packages.debian.org/bullseye/python3-certbot https://packages.debian.org/bullseye/python3-certbot * https://packages.ubuntu.com/jammy/python3-certbot https://packages.ubuntu.com/jammy/python3-certbot
vbezhenar 4y ago
https://man.openbsd.org/acme-client.1 https://man.openbsd.org/acme-client.1 is similar. I'm not sure if it was ported to Linux.
- yakubin 4y ago
  I've recently spent some time sandboxing nginx on my web server by running the master process as the user www-data instead of root, adding some seccomp filters through systemd and writing a custom AppArmor profile[1]. And the hardest part was dealing with certbot actually. Not least because it's written in Python, and so adding capabilities to the script itself didn't do a thing. They needed to be added to the Python interpreter executable[2]. The whole thing seemed more complicated than its worth. I've looked briefly at what supposedly configuring an OpenBSD server with OpenBSD httpd + OpenBSD's acme-client would look like, and it seems so much easier and the secure configuration is the official one, so I'd need to worry much less about updates breaking my stuff. So I'm considering moving to OpenBSD for my web server. The only thing giving me pause currently is that I saw no mention of HTTP/2 support, so I suspect there is none. Although maybe I don't need it. We'll see. [1]: That last apart I actually already had, but it needed some tweaking this time, because I moved nginx's PID file to its own runtime directory created by systemd, instead of allowing it to write to /run as root. [2]: Of course only for testing. I revoked them after verifying that everything works. And now they're only assigned dynamically by systemd when the service is run.
- gray_-_wolf 4y ago
  It was, I maintain a port here [0]. Release tarballs can be downloaded here [1], I plan to add them to the git tags but did not get to it yet. For example alpine linux ships it in the repositories [2]. 0: https://git.sr.ht/~graywolf/acme-client-portable https://git.sr.ht/~graywolf/acme-client-portable 1: https://data.wolfsden.cz/sources/ https://data.wolfsden.cz/sources/ 2: https://pkgs.alpinelinux.org/packages?name=acme-client&branch=v3.16 https://pkgs.alpinelinux.org/packages?name=acme-client&branc...
- messe 4y ago
  Quite reliable as well. I haven't touched my acme-client.conf since 2019. Admittedly, I haven't updated my blog since then, but goddammit, my SSL certs are still valid! Cough Manjaro Cough
matthews2 4y ago
Cool! I hadn't seen tls-alpn-01 for authentication before. Instead of using the ualpn daemon to respond to the challenges and proxying all other connections through to nginx, would it be possible to do it solely in nginx?
johnklos 4y ago
One of the things I don't like about Github is that, while they do list languages used, they don't have a section for listing dependencies. Some (Ok, many) projects don't list dependencies and assume we're all OK with so many that we don't deserve to know and are expected to just pipe a URL to a shell to install them all. We need more projects like this, because many of us would like clean, reproducible environments that won't be in dependency hell every few years when an update to one dependency isn't compatible with updates to others.
jeffbee 4y ago
Security software written in C, with no unit tests. You cannot run away from this software fast enough. I cannot think of any worse idea than "I wrote my own base64 codec in bare C without tests and without code review". "Minimal dependencies" does not even begin to make up for how bad this idea is. It would be strongly preferable to depend on third-party code that has been reviewed, tested, and implemented in a reasonable language.
- christophilus 4y ago
  You use C and C++ apps daily— many of which probably have poorer automated testing than you’d think. It’s not great, but it isn’t the world-ending catastrophe that you seem to think it is.
  - ClumsyPilot 4y ago
    he is spot on, you know - this software is a contender for foundational infrastructure. The best foundational infrastructure software is like SQLITE - more tests than code, tiny and runs everywhere
    - christophilus 4y ago
      And written in C. So, he is at best half spot on. I agree that I’d want to see better testing. I would disagree that C rules it out.

121 points by robalni 4y ago

Certificates seem to be lots of work and complexity, and lots of do-it-yourself. Couldn't that functionality come as part of the OS? It is fundamental that computers should be able to know whom to trust and whom not.

_8j50 4y ago
It is in windows, the cert store comes with windows and you use for many applications from code signing, email signing, server cert signing to authenticating users and the computer to the network/AD. PKI is the way windows and the corporate world went. On nix you have PGP, with GPG it is sort of baked in I guess but it is used only in package signing and signing of text content in various contexts. I believe the "web of trust" is preferred over PKI but nix folks because they don't want to depend on certificate authorities mediating trust, instead you have key servers that only help in distributing keys. For *nix, the burden of forming trust is on the user. You have to either go to key signing parties (very scalable lol) or I guess google around and ask in chatrooms and look up trustworthy sites until you are confident a key us trustworthy? I mean you can cross-sign and all that but in reality, you have to investigate each key one by one and hope you don't screw up. Or what happens in most cases is people trusr https/PKI so key IDs on people's websites or a command asking you to import a key from their site over https is trusted... because PKI/TLS is much more practical. Get the GPG fans to like PKI and maybe Linux will have PKI cert management out of the box. The Linux kernel does support X509 and pki certs afaik, I don't know if you can make it store root certs and have it verify cert chains for you from userspace. Very possible but only applications using kTLS might want that. Perhaps a feature request with your favorite browsers and package managers to use kTLS instead of openssl/gnutls is a start?
- jiggawatts 4y ago
  I suspect there isn't a Windows Enterprise PKI team any more as such, development seems to have stalled around 2016. There is no ACME support built-in either as a client or server, which is sad considering Windows already has dynamic DNS capabilities. Even Azure Key Vault won't integrate with Microsoft Enterprise PKI, which should tell you everything you need to know...
  - _8j50 4y ago
    On prem AD itself is going away, no idea if AAD has or will have a PKI component.

robalni 4y ago

I found this project while looking for a way to renew my SSL certificate without having to use certbot which has a lot of dependencies including python. This program is really small and simple and does exactly what I need. It's perfect.

LinuxBender 4y ago
If you like minimal dependencies another one to take a peek at may be acme.sh [1]. It depends on bash, openssl and curl. It seems to work fine in ash as well. It has code to handle most API's and most importantly to me is the great documentation. In the same spirit of minimal and light weight there is also testssh.sh [2] for testing TLS on HTTPS/SMTPS servers that also depends on bash and openssl. [1] - https://github.com/acmesh-official/acme.sh https://github.com/acmesh-official/acme.sh [2] - https://github.com/drwetter/testssl.sh https://github.com/drwetter/testssl.sh
- encryptluks2 4y ago
  I'd prefer to use a C, Go, or Rust app at this point. I love shell scripts because it was one of the first scripting languages I learned, but I'd trust a developer capable of writing C, Go or Rust to do a better job and make something more optimized than what is within the scope of Posix shell scripting.
  - FpUser 4y ago
    To me it is a utility stuff. As long as it does the job (and acme.sh does it just fine) and does not require pulling down half of the Internet for dependencies I would not give rat's ass about what language has been used to write it.
  - vladvasiliu 4y ago
    There's step-cli that's just a single go executable: https://github.com/smallstep/cli https://github.com/smallstep/cli They also provide a CA to go with it, if you need internal certs.

ape4 4y ago

I really appreciate the limited dependencies. The readme says it needs only "libcurl and one of GnuTLS, OpenSSL or mbedTLS"

kazinator 4y ago

No, I want my Debian machine polluted with Snap garbage to run Certbot. Find someone sane to promote this to. :)

9dev 4y ago
Right? It’s so ridiculous how you’re supposed to use Snap to install certbot. The (well, one of..) GitHub discussion is just beyond the pale: https://github.com/certbot/certbot/issues/8345#issuecomment-1039049260 https://github.com/certbot/certbot/issues/8345#issuecomment-...
- kazinator 4y ago
  I really hate how all that junk urinates into /etc, which should be treated as immutable by applications. Changing state should go into /var/run.
  - Denvercoder9 4y ago
    /var/run isn't really suitable for certificates, as it's allowed to get cleared on every boot. /var/lib would be the better alternative.
- vbezhenar 4y ago
  Just install docker or k8s and use certbot image.
  - jabbany 4y ago
    The thread above has mentioned a very real problem with snap running on OpenVZ. It requires either squashfs as a kernel module or FUSE+squashfuse. Many OpenVZ hosts will not provide either and docker/k8s is obviously out if you are already operating inside a container... Like, squashfs is great and all and packaged app images are an acceptable way of delivering desktop apps... but there's so much lossage here when certbot indirectly requires both just for an install. (I ended up going with acme.sh instead.)

christophilus 4y ago

Someone needs to tell the Manjaro folks about this.

adancalderon 4y ago

Been ussing this script https://github.com/srvrco/getssl https://github.com/srvrco/getssl

losingom 4y ago

If you want to be super minimal, I prefer acme.sh[1] instead. It even comes preconfigured for various DNS providers[2], and you can even create your own hook if there isn't already one[3]. [1] https://github.com/acmesh-official/acme.sh https://github.com/acmesh-official/acme.sh [2] https://github.com/acmesh-official/acme.sh/wiki/dnsapi https://github.com/acmesh-official/acme.sh/wiki/dnsapi [3] https://github.com/acmesh-official/acme.sh/wiki/DNS-API-Dev-Guide https://github.com/acmesh-official/acme.sh/wiki/DNS-API-Dev-...

thayne 4y ago
If you have over a thousand lines of bash (or any other kind of shell code really), that is a pretty big red flag that you probably shouldn't be using bash IMO.
- delusional 4y ago
  If you want to issue a certificate in an environment where you only have a shell, it's the only language you can use. Sometimes you write in shell because it's the lowest common denominator.
  - encryptluks2 4y ago
    - delusional 4y ago
      Not everything I do is a job.
    - throw0101a 4y ago
      > If you only have shell on your servers then it is time to start looking for a new job. Perhaps you wish to have "real" certs on appliances like F5s and Isilons (FreeBSD-based) where you can't install extra stuff, but where curl and openssl (and bash/zsh) are present. Or perhaps you want to run simple software that you can actually audit. While "over a thousand lines of bash" may take a little while to examine, good luck auditing Zope, which is what certbot pulls in as a dependency: * https://packages.debian.org/bullseye/python3-certbot https://packages.debian.org/bullseye/python3-certbot * https://packages.ubuntu.com/jammy/python3-certbot https://packages.ubuntu.com/jammy/python3-certbot

vbezhenar 4y ago

https://man.openbsd.org/acme-client.1 https://man.openbsd.org/acme-client.1 is similar. I'm not sure if it was ported to Linux.

yakubin 4y ago
I've recently spent some time sandboxing nginx on my web server by running the master process as the user www-data instead of root, adding some seccomp filters through systemd and writing a custom AppArmor profile[1]. And the hardest part was dealing with certbot actually. Not least because it's written in Python, and so adding capabilities to the script itself didn't do a thing. They needed to be added to the Python interpreter executable[2]. The whole thing seemed more complicated than its worth. I've looked briefly at what supposedly configuring an OpenBSD server with OpenBSD httpd + OpenBSD's acme-client would look like, and it seems so much easier and the secure configuration is the official one, so I'd need to worry much less about updates breaking my stuff. So I'm considering moving to OpenBSD for my web server. The only thing giving me pause currently is that I saw no mention of HTTP/2 support, so I suspect there is none. Although maybe I don't need it. We'll see. [1]: That last apart I actually already had, but it needed some tweaking this time, because I moved nginx's PID file to its own runtime directory created by systemd, instead of allowing it to write to /run as root. [2]: Of course only for testing. I revoked them after verifying that everything works. And now they're only assigned dynamically by systemd when the service is run.
gray_-_wolf 4y ago
It was, I maintain a port here [0]. Release tarballs can be downloaded here [1], I plan to add them to the git tags but did not get to it yet. For example alpine linux ships it in the repositories [2]. 0: https://git.sr.ht/~graywolf/acme-client-portable https://git.sr.ht/~graywolf/acme-client-portable 1: https://data.wolfsden.cz/sources/ https://data.wolfsden.cz/sources/ 2: https://pkgs.alpinelinux.org/packages?name=acme-client&branch=v3.16 https://pkgs.alpinelinux.org/packages?name=acme-client&branc...
messe 4y ago
Quite reliable as well. I haven't touched my acme-client.conf since 2019. Admittedly, I haven't updated my blog since then, but goddammit, my SSL certs are still valid! Cough Manjaro Cough

matthews2 4y ago

Cool! I hadn't seen tls-alpn-01 for authentication before. Instead of using the ualpn daemon to respond to the challenges and proxying all other connections through to nginx, would it be possible to do it solely in nginx?

johnklos 4y ago

One of the things I don't like about Github is that, while they do list languages used, they don't have a section for listing dependencies. Some (Ok, many) projects don't list dependencies and assume we're all OK with so many that we don't deserve to know and are expected to just pipe a URL to a shell to install them all. We need more projects like this, because many of us would like clean, reproducible environments that won't be in dependency hell every few years when an update to one dependency isn't compatible with updates to others.

jeffbee 4y ago

Security software written in C, with no unit tests. You cannot run away from this software fast enough. I cannot think of any worse idea than "I wrote my own base64 codec in bare C without tests and without code review". "Minimal dependencies" does not even begin to make up for how bad this idea is. It would be strongly preferable to depend on third-party code that has been reviewed, tested, and implemented in a reasonable language.

christophilus 4y ago
You use C and C++ apps daily— many of which probably have poorer automated testing than you’d think. It’s not great, but it isn’t the world-ending catastrophe that you seem to think it is.
- ClumsyPilot 4y ago
  he is spot on, you know - this software is a contender for foundational infrastructure. The best foundational infrastructure software is like SQLITE - more tests than code, tiny and runs everywhere
  - christophilus 4y ago
    And written in C. So, he is at best half spot on. I agree that I’d want to see better testing. I would disagree that C rules it out.