4 ms·

Installing a Let's Encrypt TLS certificate on a Brother printer with Certbot

246 points by 8organicbits 7mo ago

lousken 7mo ago
why bother with tls, stick it on a separate vlan, lock down all the traffic
- justin_oaks 7mo ago
  Some of this might have been "because I want to see if I can". Another reason is "It bothers me to keep seeing this browser tell me my connection is insecure". As for putting it on a separate VLAN and securing traffic with firewall rules, that may be as much or more trouble than setting up the automated certificate renewal. At least with the automated certificates there may not be any further maintenance required. With firewall rules, you'll need to open up the firewall each time you want a new device to access the printer.
  - lousken 7mo ago
    Sure but how long will that last? It says in the article that RSA2048 is required, however 3072 should be the minimum these days, I am not sure how long will letsencrypt even allow creating 2048bit certs.
  - whalesalad 7mo ago
    This is only for the web UI, no? The actual print comms are not over https. This is a management tool only that I’d imagine you access once or twice per year?
- dns_snek 7mo ago
  Because that only protects you from a small subset of possible threats that end-to-end encryption protects you from like DNS hijacking and any MITM-type scenario. Sticking it on a VLAN only controls access, not data secrecy.
  - VladVladikoff 7mo ago
    Broadcasting internal IPs on public DNS records is also a suboptimal approach that leaks information to the public. Local devices should be routed over layer 2.
    - iso1631 7mo ago
      DNS challenge doesn't broadcast internal IPs. Certificate transparency does show up hostnames or wildcards though.
- hrmtst93837 7mo ago
  [flagged]
  - lousken 7mo ago
    tls is not boring at all, especially with devices that are always 10 years behind in terms of security, it's not like you can enforce any kind of reasonable ciphersuites even in modern printers also 9/10 printing protocols are insecure anyway scans - sure, mailserver needs to be allowed vendor support - same mailserver vm - at least a reason to kill it also why would i ever allow auto updates, it's better not to without understanding what garbage manufacturer released this time
justin_oaks 7mo ago
I read a lot about people running things like Caddy which will automatically retrieve Lets Encrypt certificates. And I think it makes sense for publicly accessible web sites since you can use an HTTP challenge with Let's Encrypt. For internal-use certificates, you'll have to make use of a DNS challenge with Let's Encrypt. I've been hesitant to set that up because I'm concerned about the potential compromise of a token that has permissions to edit my DNS zone. I see that the author creates exactly that kind of token and has permanently accessible to his script. For a home lab where he's the only person accessing his hardware, that's less of a concern. But what about at a company where multiple people may have access to a system? Am I being too paranoid here? Or is there a better way to allow DNS challenges without a token that allows too much power in editing a DNS zone?
- bombcar 7mo ago
  There is a way to delegate the DNS challenges, but you can also create a dummy Caddysite for HTTP challenge (e.g., firewall.internal.example.com resolves externally to an IP that Caddy will respond to and get the certificate, and then said certificate is copied internally to whatever needs it).
- kro 7mo ago
  In Q2 this year, so very soon, there will be the DNS PERSIST method, which is non rotating.
  - justin_oaks 7mo ago
    That looks like a great solution. I'll probably make use of that as soon as it's available.
- captn3m0 7mo ago
  I used to have a separate Cloudflare account with a separate DNS Zone for my internal services. Because CF PATs were free-for-all. They've improved this since, so now you can create a token scoped to a single Zone. If you really care about, you can move a subdomain to a separate zone with a child NS record, but I haven't tried it with cloudflare. If you are using something like AWS, you can create an IAM role that can only update a single DNS record.
mdhowle 7mo ago
DNS-PERSIST-01 is coming soon https://letsencrypt.org/2026/02/18/dns-persist-01 https://letsencrypt.org/2026/02/18/dns-persist-01
- justin_oaks 7mo ago
  Oh... that's fantastic! It specifically addresses my concerns about needing DNS credentials accessible to scripts. The article says it is for those who > prefer to keep DNS updates and sensitive credentials out of their issuance path.
- cromka 7mo ago
  Oh wow, this will make self-hosting so much easier! I have so far issued probably about 30 different API keys for my subdomain zones for services I host, which you then have to configure with ACME/Certbot. This reduces it to a simple DNS record change!
captn3m0 7mo ago
I own a Brother printer and was curious how the upload worked. Apparently, it is just screenscraping the CSRF token[0], and submitting the cert upload form[1] in the printer's admin web interface. It needs the printer's admin credentials for the upload to work. [0]: https://github.com/gregtwallace/brother-cert/blob/main/pkg/printer/csrf_token.go https://github.com/gregtwallace/brother-cert/blob/main/pkg/p... [1]: https://github.com/gregtwallace/brother-cert/blob/main/pkg/printer/cert_upload.go https://github.com/gregtwallace/brother-cert/blob/main/pkg/p...
- huflungdung 7mo ago
  [dead]
- kuschku 7mo ago
  That's sadly the only reliable way to do this, I actually solved it the same way last year: https://github.com/justjanne/brother-client https://github.com/justjanne/brother-client
yawniek 7mo ago
did a similar thing for reolink cameras and mikrotik devices. since i run a small k8s cluster i made it a k8s controller that picks up the certs. works really nicely
yegle 7mo ago
You should have used the `--deploy-hook` on certbot. I use this to copy the cert to Synology NAS and trigger a reload of the cert on the NAS. BTW: The easiest way to run certbot in a container is to mount a renew script (some shell script as simple as `certbot renew`) to /etc/periodic/daily/renew, then change the container's entrypoint to `crond -d6 -f`.
jijji 7mo ago
you could probably get away with just running nginx with certbot on the front end of that domain name and then have it proxy back to a script that talks to the brother printer on the back end of it to do printing, although I'm not sure why you'd want to print via the public internet
- akerl_ 7mo ago
  Who’s putting their printer on the public internet?
  - wpm 7mo ago
    The #marchintosh folks have been! Got a few more days to send some fun messages to someone's ImageWriter over an AppleTalk bridge!
intsunny 7mo ago
Even before I clicked on the article, I had a strong feeling this person was using CloudFlare DNS and the related API. (They are.) Given the immense popularity of Cloudflare DNS + API + ACME DNS-01 challenge, why are not other DNS providers stepping into this foray?
- xyzzy_plugh 7mo ago
  Perhaps I'm missing something but what's special about Cloudflare here? You can use a boatload of providers for automated DNS-01.
  - buckle8017 7mo ago
    There's a relatively short list supported by certbot out of the box.
    - throw0101a 7mo ago
      One tool that can be used in a deployment hook which supports the API of several dozen DNS providers: * https://github.com/dns-lexicon/dns-lexicon https://github.com/dns-lexicon/dns-lexicon
      - justin_oaks 7mo ago
        The list of API integrations provided by the lego project looks quite impressive. https://go-acme.github.io/lego/dns/index.html https://go-acme.github.io/lego/dns/index.html
- JonathonW 7mo ago
  Cloudflare is not the only DNS provider supported for DNS-01 challenges, even if you restrict yourself to only using Certbot: https://community.letsencrypt.org/t/dns-providers-who-easily-integrate-with-lets-encrypt-dns-validation/86438 https://community.letsencrypt.org/t/dns-providers-who-easily...
- varispeed 7mo ago
bob1029 7mo ago
ACME+LE is definitely the future. I've built some custom AspNetCore middleware that completely owns the entire thing. I tried win-acme and other clients but they aren't in the same room of convenience. All I need to provide is the desired hostname to the middleware and ensure traffic destined for that FQDN winds up at the server. HTTP-01 is used to verify, so I don't have to screw with anything other than an A record. If the hostname is null, it issues an IP address certificate instead using Amazon's public IP lookup service to derive the appropriate SAN. Certs are automatically refreshed when they are within 48 hours of expiration, and the actual swap is a X509Certificate2 reference being updated. It's about as trivial as it gets. None of the libraries/CLI tools I attempted support anything like this experience. This is what originally put me off to the ecosystem and the idea of short lived certificates. The automation can't just be "sufficient". It needs to be "fucking incredible". $12.95/yr is not that expensive to me if the alternative is getting sucked into hours and hours of someone else's idea of a good time.
- deleted 7mo ago
  [deleted]
sgt 7mo ago
For some reason I read "Brothel Printer". Would have been funny.
- cromka 7mo ago
  Let's Enpimp!
sigio 7mo ago
This got me to finally put effort into upgrading the firmware on my brother printer, which was still running stock firmware. There was only a password-entry, and that didn't let me access anything. After running Brothers updater in a VM, and sharing the usb-device, I managed to upgrade the printer. However, still no login, and now I need to get it reconnected to my wifi, ugh. Try entering a long wifi-password via the 1-line lcd and 2 buttons on the printer, what a nightmare. (No way to configure via usb). Oh well, I still have a couple of days before I need to print a bunch of documents, so there goes the weekend ;)
- gucci-on-fleek 7mo ago
  > Try entering a long wifi-password via the 1-line lcd and 2 buttons on the printer, what a nightmare. I used the WPS button method [0] to set up my Brother printers and it worked perfectly for me. Definitely much more pleasant than trying to key in a long password. [0]: https://en.wikipedia.org/wiki/Wi-Fi_Protected_Setup https://en.wikipedia.org/wiki/Wi-Fi_Protected_Setup
  - wps 7mo ago
    My router doesn’t have a WPS button, so I also had to use the two button interface. Not fun having to cycle through some 50 plus ASCII characters for the WiFi password. I’m pretty sure you can emulate the button press in openwrt with some package though. It was faster to just enter the password than to figure all that out.
deleted 7mo ago
[deleted]
gerdesj 7mo ago
I've spent quite some time on this stuff. acme.sh is my recommendation for Linux and anything else that runs a BASH or similar (pfSense has a glorious integration for it) and Simple ACME for Windows. Both support dynamic DNS with CNAME. Certbot doesn't support CNAME for DNS-01 or at least didn't. I was always a fan of Certbot when all I had was http style challenges available. Setup a DNS server with a zone called (say) challenges.example.co.uk. You will need to own example.co.uk and add NS glue records for the sub zone. You'll need to sort out dynamic DNS too for that zone. Now you can create a CNAME record like: _acme-challenge.mywebserver.mywebdomain.co.uk. CNAME _acme-challenge.challenges.example.co.uk Now you configure your acme.sh or simple acme to put its challenge into challenges.example.co.uk - it will create a TXT record and things should work out. It is a lot easier, if you can, to run your own public DNS or subscribe to a DNS service that does everything for you.
chka 7mo ago
This is the kind of absurd-but-useful thing I love about self-hosting. Next step: mTLS between the printer and the NAS.
whalesalad 7mo ago
This is a monumental amount of work for no gain at all. The self signed cert doesn’t mean the comms to the printer UI are insecure. It’s still https. Better yet that’s going through WireGuard encryption. If god forbid this printer was actually on the public internet this would make sense.
orthogonalinfo 7mo ago
[flagged]
Natfan 7mo ago
the current persistUntil implementation gives me cause for concern -- re: the 2038 problem will these integers be backed by int32 or int64? or possibly use unsigned i32s?

246 points by 8organicbits 7mo ago

lousken 7mo ago

why bother with tls, stick it on a separate vlan, lock down all the traffic

justin_oaks 7mo ago
Some of this might have been "because I want to see if I can". Another reason is "It bothers me to keep seeing this browser tell me my connection is insecure". As for putting it on a separate VLAN and securing traffic with firewall rules, that may be as much or more trouble than setting up the automated certificate renewal. At least with the automated certificates there may not be any further maintenance required. With firewall rules, you'll need to open up the firewall each time you want a new device to access the printer.
- lousken 7mo ago
  Sure but how long will that last? It says in the article that RSA2048 is required, however 3072 should be the minimum these days, I am not sure how long will letsencrypt even allow creating 2048bit certs.
- whalesalad 7mo ago
  This is only for the web UI, no? The actual print comms are not over https. This is a management tool only that I’d imagine you access once or twice per year?
dns_snek 7mo ago
Because that only protects you from a small subset of possible threats that end-to-end encryption protects you from like DNS hijacking and any MITM-type scenario. Sticking it on a VLAN only controls access, not data secrecy.
- VladVladikoff 7mo ago
  Broadcasting internal IPs on public DNS records is also a suboptimal approach that leaks information to the public. Local devices should be routed over layer 2.
  - iso1631 7mo ago
    DNS challenge doesn't broadcast internal IPs. Certificate transparency does show up hostnames or wildcards though.
hrmtst93837 7mo ago
[flagged]
- lousken 7mo ago
  tls is not boring at all, especially with devices that are always 10 years behind in terms of security, it's not like you can enforce any kind of reasonable ciphersuites even in modern printers also 9/10 printing protocols are insecure anyway scans - sure, mailserver needs to be allowed vendor support - same mailserver vm - at least a reason to kill it also why would i ever allow auto updates, it's better not to without understanding what garbage manufacturer released this time

justin_oaks 7mo ago

I read a lot about people running things like Caddy which will automatically retrieve Lets Encrypt certificates. And I think it makes sense for publicly accessible web sites since you can use an HTTP challenge with Let's Encrypt. For internal-use certificates, you'll have to make use of a DNS challenge with Let's Encrypt. I've been hesitant to set that up because I'm concerned about the potential compromise of a token that has permissions to edit my DNS zone. I see that the author creates exactly that kind of token and has permanently accessible to his script. For a home lab where he's the only person accessing his hardware, that's less of a concern. But what about at a company where multiple people may have access to a system? Am I being too paranoid here? Or is there a better way to allow DNS challenges without a token that allows too much power in editing a DNS zone?

bombcar 7mo ago
There is a way to delegate the DNS challenges, but you can also create a dummy Caddysite for HTTP challenge (e.g., firewall.internal.example.com resolves externally to an IP that Caddy will respond to and get the certificate, and then said certificate is copied internally to whatever needs it).
kro 7mo ago
In Q2 this year, so very soon, there will be the DNS PERSIST method, which is non rotating.
- justin_oaks 7mo ago
  That looks like a great solution. I'll probably make use of that as soon as it's available.
captn3m0 7mo ago
I used to have a separate Cloudflare account with a separate DNS Zone for my internal services. Because CF PATs were free-for-all. They've improved this since, so now you can create a token scoped to a single Zone. If you really care about, you can move a subdomain to a separate zone with a child NS record, but I haven't tried it with cloudflare. If you are using something like AWS, you can create an IAM role that can only update a single DNS record.

mdhowle 7mo ago

DNS-PERSIST-01 is coming soon https://letsencrypt.org/2026/02/18/dns-persist-01 https://letsencrypt.org/2026/02/18/dns-persist-01

justin_oaks 7mo ago
Oh... that's fantastic! It specifically addresses my concerns about needing DNS credentials accessible to scripts. The article says it is for those who > prefer to keep DNS updates and sensitive credentials out of their issuance path.
cromka 7mo ago
Oh wow, this will make self-hosting so much easier! I have so far issued probably about 30 different API keys for my subdomain zones for services I host, which you then have to configure with ACME/Certbot. This reduces it to a simple DNS record change!

captn3m0 7mo ago

I own a Brother printer and was curious how the upload worked. Apparently, it is just screenscraping the CSRF token[0], and submitting the cert upload form[1] in the printer's admin web interface. It needs the printer's admin credentials for the upload to work. [0]: https://github.com/gregtwallace/brother-cert/blob/main/pkg/printer/csrf_token.go https://github.com/gregtwallace/brother-cert/blob/main/pkg/p... [1]: https://github.com/gregtwallace/brother-cert/blob/main/pkg/printer/cert_upload.go https://github.com/gregtwallace/brother-cert/blob/main/pkg/p...

huflungdung 7mo ago
[dead]
kuschku 7mo ago
That's sadly the only reliable way to do this, I actually solved it the same way last year: https://github.com/justjanne/brother-client https://github.com/justjanne/brother-client

yawniek 7mo ago

did a similar thing for reolink cameras and mikrotik devices. since i run a small k8s cluster i made it a k8s controller that picks up the certs. works really nicely

yegle 7mo ago

You should have used the `--deploy-hook` on certbot. I use this to copy the cert to Synology NAS and trigger a reload of the cert on the NAS. BTW: The easiest way to run certbot in a container is to mount a renew script (some shell script as simple as `certbot renew`) to /etc/periodic/daily/renew, then change the container's entrypoint to `crond -d6 -f`.

jijji 7mo ago

you could probably get away with just running nginx with certbot on the front end of that domain name and then have it proxy back to a script that talks to the brother printer on the back end of it to do printing, although I'm not sure why you'd want to print via the public internet

akerl_ 7mo ago
Who’s putting their printer on the public internet?
- wpm 7mo ago
  The #marchintosh folks have been! Got a few more days to send some fun messages to someone's ImageWriter over an AppleTalk bridge!

intsunny 7mo ago

Even before I clicked on the article, I had a strong feeling this person was using CloudFlare DNS and the related API. (They are.) Given the immense popularity of Cloudflare DNS + API + ACME DNS-01 challenge, why are not other DNS providers stepping into this foray?

xyzzy_plugh 7mo ago
Perhaps I'm missing something but what's special about Cloudflare here? You can use a boatload of providers for automated DNS-01.
- buckle8017 7mo ago
  There's a relatively short list supported by certbot out of the box.
  - throw0101a 7mo ago
    One tool that can be used in a deployment hook which supports the API of several dozen DNS providers: * https://github.com/dns-lexicon/dns-lexicon https://github.com/dns-lexicon/dns-lexicon
    - justin_oaks 7mo ago
      The list of API integrations provided by the lego project looks quite impressive. https://go-acme.github.io/lego/dns/index.html https://go-acme.github.io/lego/dns/index.html
JonathonW 7mo ago
Cloudflare is not the only DNS provider supported for DNS-01 challenges, even if you restrict yourself to only using Certbot: https://community.letsencrypt.org/t/dns-providers-who-easily-integrate-with-lets-encrypt-dns-validation/86438 https://community.letsencrypt.org/t/dns-providers-who-easily...
varispeed 7mo ago

bob1029 7mo ago

ACME+LE is definitely the future. I've built some custom AspNetCore middleware that completely owns the entire thing. I tried win-acme and other clients but they aren't in the same room of convenience. All I need to provide is the desired hostname to the middleware and ensure traffic destined for that FQDN winds up at the server. HTTP-01 is used to verify, so I don't have to screw with anything other than an A record. If the hostname is null, it issues an IP address certificate instead using Amazon's public IP lookup service to derive the appropriate SAN. Certs are automatically refreshed when they are within 48 hours of expiration, and the actual swap is a X509Certificate2 reference being updated. It's about as trivial as it gets. None of the libraries/CLI tools I attempted support anything like this experience. This is what originally put me off to the ecosystem and the idea of short lived certificates. The automation can't just be "sufficient". It needs to be "fucking incredible". $12.95/yr is not that expensive to me if the alternative is getting sucked into hours and hours of someone else's idea of a good time.

deleted 7mo ago
[deleted]

sgt 7mo ago

For some reason I read "Brothel Printer". Would have been funny.

cromka 7mo ago
Let's Enpimp!

sigio 7mo ago

This got me to finally put effort into upgrading the firmware on my brother printer, which was still running stock firmware. There was only a password-entry, and that didn't let me access anything. After running Brothers updater in a VM, and sharing the usb-device, I managed to upgrade the printer. However, still no login, and now I need to get it reconnected to my wifi, ugh. Try entering a long wifi-password via the 1-line lcd and 2 buttons on the printer, what a nightmare. (No way to configure via usb). Oh well, I still have a couple of days before I need to print a bunch of documents, so there goes the weekend ;)

gucci-on-fleek 7mo ago
> Try entering a long wifi-password via the 1-line lcd and 2 buttons on the printer, what a nightmare. I used the WPS button method [0] to set up my Brother printers and it worked perfectly for me. Definitely much more pleasant than trying to key in a long password. [0]: https://en.wikipedia.org/wiki/Wi-Fi_Protected_Setup https://en.wikipedia.org/wiki/Wi-Fi_Protected_Setup
- wps 7mo ago
  My router doesn’t have a WPS button, so I also had to use the two button interface. Not fun having to cycle through some 50 plus ASCII characters for the WiFi password. I’m pretty sure you can emulate the button press in openwrt with some package though. It was faster to just enter the password than to figure all that out.

deleted 7mo ago

[deleted]

gerdesj 7mo ago

I've spent quite some time on this stuff. acme.sh is my recommendation for Linux and anything else that runs a BASH or similar (pfSense has a glorious integration for it) and Simple ACME for Windows. Both support dynamic DNS with CNAME. Certbot doesn't support CNAME for DNS-01 or at least didn't. I was always a fan of Certbot when all I had was http style challenges available. Setup a DNS server with a zone called (say) challenges.example.co.uk. You will need to own example.co.uk and add NS glue records for the sub zone. You'll need to sort out dynamic DNS too for that zone. Now you can create a CNAME record like: _acme-challenge.mywebserver.mywebdomain.co.uk. CNAME _acme-challenge.challenges.example.co.uk Now you configure your acme.sh or simple acme to put its challenge into challenges.example.co.uk - it will create a TXT record and things should work out. It is a lot easier, if you can, to run your own public DNS or subscribe to a DNS service that does everything for you.

chka 7mo ago

This is the kind of absurd-but-useful thing I love about self-hosting. Next step: mTLS between the printer and the NAS.

whalesalad 7mo ago

This is a monumental amount of work for no gain at all. The self signed cert doesn’t mean the comms to the printer UI are insecure. It’s still https. Better yet that’s going through WireGuard encryption. If god forbid this printer was actually on the public internet this would make sense.

orthogonalinfo 7mo ago

[flagged]

Natfan 7mo ago

the current persistUntil implementation gives me cause for concern -- re: the 2038 problem will these integers be backed by int32 or int64? or possibly use unsigned i32s?