4 ms·

FYI, if you don't want to install the official Let's Encrypt client on your production server, I created a simple python script that will automate the ACME proc

by diafygi 11y ago

FYI, if you don't want to install the official Let's Encrypt client on your production server, I created a simple python script that will automate the ACME process for you. It doesn't have to run on your server, and it doesn't ask for your private keys. https://github.com/diafygi/letsencrypt-nosudo https://github.com/diafygi/letsencrypt-nosudo The only thing that has to be run as sudo on your production server is a simple python one-liner that temporarily serves the required file. The script prints out this one-liner so you can copy and paste it into your server's terminal, then kill it when the challenge is done.

garrettr_ 11y ago
How is this different from/superior to Let's Encrypt's built-in "standalone authenticator"? [0] [0] https://github.com/letsencrypt/lets-encrypt-preview/blob/master/letsencrypt/plugins/standalone/authenticator.py https://github.com/letsencrypt/lets-encrypt-preview/blob/mas...
- diafygi 11y ago
  The standalone authenticator still requires (1) installing/running the letsencrypt client on your production server, (2) letting it run as root, and (3) letting it access your private keys. My script requires none of these things.
- kyledrake 11y ago
  I would add that it's also easier to understand. I've been having a lot of trouble figuring out ACME's workflow. This has been pretty helpful.
JoshTriplett 11y ago
Does your script support doing the DVSNI challenge instead, to avoid needing to install a file on the web server?
- diafygi 11y ago
  It used to, but that meant you had to scp the generated dvsni cert to your server[1], which is more complex than asking the user to start serving a string over a specific url (which is what the SimpleHTTP challenge requires). [1]: https://github.com/diafygi/letsencrypt-nosudo/blob/9607deb7b259499725ce1c705a1664199f51881d/sign_csr.py#L149 https://github.com/diafygi/letsencrypt-nosudo/blob/9607deb7b...
bradbeattie 11y ago
The overview speaks of a "here's my key!" / "you are registered!" step that letsencrypt-nosudo doesn't seem to have. It seems that your first communication with the CA is during step 2 (requesting challenges). Does this affect your script's ability to do things like subject alternative names?
- diafygi 11y ago
  This script takes certificate signing requests (CSR) as input. If you want a subject alternative name, it's up to you to add that to your CSR file before you run the script. The official Let's Encrypt client is mostly focused on ease of use. This script is mostly focused on not knowing your secrets or requiring privileged access, and it assumes you know what a CSR is and how to install a signed certificate on your webserver.
garthk 11y ago
Strikes me you could also go through the process using letsencrypt in a container (eg Docker on Linux) and extract the results.
- javajosh 11y ago
  This is a good idea, but the docker daemon runs as root so it's at least theoretically possible to break out of the container and start messing with the host, as root.
baby 11y ago
As is said in the post: > the address of the CA is hardcoded in the program so be sure to use the official lets-encrypt Now, the idea of a nosudo letsencrypt is a good idea, but if such a thing should exist it should be made on the officiel repo and audited like lets encrypt was (note that this is just my opinion).
- diafygi 11y ago
  This script is less than 400 lines of code. Please, read through it! Would love for someone else to audit it or submit bugs!
ars 11y ago
Thanks for this. I would like to use this service, but I do not want a program to do things for me on my server unless it's part of the OS distribution, so this will help. Why do you need sudo to serve a file though? Is it a restricted port?
- icebraining 11y ago
  Reading the code, it seems the file is served on port 443 (HTTPS).
- schoen 11y ago
  Hopefully the Let's Encrypt client will be part of most server operating systems in the future, too!

by diafygi 11y ago

garrettr_ 11y ago

How is this different from/superior to Let's Encrypt's built-in "standalone authenticator"? [0] [0] https://github.com/letsencrypt/lets-encrypt-preview/blob/master/letsencrypt/plugins/standalone/authenticator.py https://github.com/letsencrypt/lets-encrypt-preview/blob/mas...

diafygi 11y ago
The standalone authenticator still requires (1) installing/running the letsencrypt client on your production server, (2) letting it run as root, and (3) letting it access your private keys. My script requires none of these things.
kyledrake 11y ago
I would add that it's also easier to understand. I've been having a lot of trouble figuring out ACME's workflow. This has been pretty helpful.

JoshTriplett 11y ago

Does your script support doing the DVSNI challenge instead, to avoid needing to install a file on the web server?

diafygi 11y ago
It used to, but that meant you had to scp the generated dvsni cert to your server[1], which is more complex than asking the user to start serving a string over a specific url (which is what the SimpleHTTP challenge requires). [1]: https://github.com/diafygi/letsencrypt-nosudo/blob/9607deb7b259499725ce1c705a1664199f51881d/sign_csr.py#L149 https://github.com/diafygi/letsencrypt-nosudo/blob/9607deb7b...

bradbeattie 11y ago

The overview speaks of a "here's my key!" / "you are registered!" step that letsencrypt-nosudo doesn't seem to have. It seems that your first communication with the CA is during step 2 (requesting challenges). Does this affect your script's ability to do things like subject alternative names?

diafygi 11y ago
This script takes certificate signing requests (CSR) as input. If you want a subject alternative name, it's up to you to add that to your CSR file before you run the script. The official Let's Encrypt client is mostly focused on ease of use. This script is mostly focused on not knowing your secrets or requiring privileged access, and it assumes you know what a CSR is and how to install a signed certificate on your webserver.

garthk 11y ago

Strikes me you could also go through the process using letsencrypt in a container (eg Docker on Linux) and extract the results.

javajosh 11y ago
This is a good idea, but the docker daemon runs as root so it's at least theoretically possible to break out of the container and start messing with the host, as root.

baby 11y ago

As is said in the post: > the address of the CA is hardcoded in the program so be sure to use the official lets-encrypt Now, the idea of a nosudo letsencrypt is a good idea, but if such a thing should exist it should be made on the officiel repo and audited like lets encrypt was (note that this is just my opinion).

diafygi 11y ago
This script is less than 400 lines of code. Please, read through it! Would love for someone else to audit it or submit bugs!

ars 11y ago

Thanks for this. I would like to use this service, but I do not want a program to do things for me on my server unless it's part of the OS distribution, so this will help. Why do you need sudo to serve a file though? Is it a restricted port?

icebraining 11y ago
Reading the code, it seems the file is served on port 443 (HTTPS).
schoen 11y ago
Hopefully the Let's Encrypt client will be part of most server operating systems in the future, too!