3 ms·

When I first got started with LetsEncrypt, I wanted to do the whole thing manually so I could understand it better. This was probably 4 years ago. I expected a

When I first got started with LetsEncrypt, I wanted to do the whole thing manually so I could understand it better. This was probably 4 years ago. I expected a web form to fill out (e.g. what domain to do you want, paste your CSR here, etc.), but such a thing didn't exist. The LetsEncrypt site didn't have much useful in the way of instructions except to say "Use Certbot". So I set up certbot, ran it in manual mode, and got my certificate. Cool. The only problem was that there was a little too much magic. What is this "account" that I'm using to renew my certificate if I never made an account (i.e. username password). What happens if I accidentally delete all the files certbot created for me? And a bunch of other questions. The documentation I found didn't give a whole lot of straightforward answers. Instead I pieced together information from blogs and forum posts. I'm hoping the documentation situation has changed, but I can understand how someone can be confused about LetsEncrypt. Many people are happy to use something without any concerns about how it works. Others want to understand and when they find that they can't, they get frustrated.

Arnavion 4y ago
When I decided to use LE for my website's HTTPS cert, I wrote my own ACME client from scratch based on the RFC. Never tried certbot, since from the beginning I wanted to to have the cert issuance process run in an Azure Function. The RFC (and the related RFCs for JWK and JWS) are very readable and easy to implement as long as you know how to delegate the crypto to libraries. (I actually ended up writing three different versions, one in PowerShell, then one in F#, and finally one in Rust that I still maintain.) Once I had it working, I wrote a blog post with a higher-level description of the whole cert flow, which you may find useful: https://www.arnavion.dev/blog/2019-06-01-how-does-acme-v2-work/ https://www.arnavion.dev/blog/2019-06-01-how-does-acme-v2-wo... It links to the relevant sections of the RFCs, so you can follow along while reading the post.

Arnavion 4y ago

When I decided to use LE for my website's HTTPS cert, I wrote my own ACME client from scratch based on the RFC. Never tried certbot, since from the beginning I wanted to to have the cert issuance process run in an Azure Function. The RFC (and the related RFCs for JWK and JWS) are very readable and easy to implement as long as you know how to delegate the crypto to libraries. (I actually ended up writing three different versions, one in PowerShell, then one in F#, and finally one in Rust that I still maintain.) Once I had it working, I wrote a blog post with a higher-level description of the whole cert flow, which you may find useful: https://www.arnavion.dev/blog/2019-06-01-how-does-acme-v2-work/ https://www.arnavion.dev/blog/2019-06-01-how-does-acme-v2-wo... It links to the relevant sections of the RFCs, so you can follow along while reading the post.