59 ms·
> The official way to renew Let's Encrypt certificates is automatically, with a tool called certbot. It downloads a bunch of untrusted data from the web, and th
by winter_blue 3y ago
> The official way to renew Let's Encrypt certificates is automatically, with a tool called certbot. It downloads a bunch of untrusted data from the web, and then feeds that data into your web server, all as root. If that sounds dumb, then good for you, because it is.
I'm a bit confused by this. I use Caddy, and Caddy doesn't run in root – and Caddy is able to handle automatic Let's Encrypt certificate renewal.
Why does certbot need root?
- Operyl 3y agoIt doesn’t necessarily, people are just conditioned to using root for things that don’t necessarily need it because it’s easier.
- winter_blue 3y agoI guess I'll just have to run anything that needs root in some sort of container.
- avsteele 3y agocertbot copies the file to be served as part of the challenge. It can optionally can modify your nginx config to use the cert once its obtained. I don't see why it needs root to do this, but you'd at least need permissions for it to read/write to the appropriate nginx & server folders.
- input_sh 3y agocertbot doesn't need root, it just writes to directories that are usually limited to root by default (`/etc/`, `/var/log/`, `/var/lib/`). And it needs some interaction with the web server to actually complete the challenge. You can absolutely provide it with alternative paths and configure your web server to forward `/.well-known/acme-challenge/` to a non-root location.