4 ms·

I used to have my own local root CA as well but now trying the Let's Encrypt with DNS-01. What is the easiest combination of software to try it? I have failed m

I used to have my own local root CA as well but now trying the Let's Encrypt with DNS-01. What is the easiest combination of software to try it? I have failed miserably trying Opnsense + ACME client plugin + Cloudflare DNS + HAProxy / NGinx. I would get 100% ssllabs certs but somehow the reverse proxy won't forward to internal services. Next I am gonna go caddyserver for reverse proxy as it has SSL with LE inbuilt. Let's see.

wejn 3y ago
A friend of mine runs dns01 thusly: https://ipng.ch/s/articles/2023/03/24/lego-dns01.html https://ipng.ch/s/articles/2023/03/24/lego-dns01.html
taskforcegemini 3y ago
do you use https/have a cert in your webserver as well, or just on the proxy?
petronio 3y ago
I've had a lot of success with https://github.com/dehydrated-io/dehydrated https://github.com/dehydrated-io/dehydrated . It exposes the different parts of the process (deploy challenge to DNS, deploy cert to filesystem, etc) as hooks, so it's pretty easy to integrate with anything and however you want, if you don't mind writing a bit of bash. There's a few scripts out there that use Cloudflare that you can use as well.
psd1 3y ago
I found LE + CF DNS trouble-free. Dockerfile: ``` FROM certbot/certbot RUN pip3 install certbot-dns-cloudflare cloudflare ``` docker-compose.yml: ``` volumes: - ${CREDENTIALS_DIRECTORY:-.}/cloudflare.ini:/cloudflare.ini - ${STATE_DIRECTORY:-./certbot}/:/etc/letsencrypt/ - ${LOGS_DIRECTORY:-/var/log/certbot}/:/var/log/letsencrypt/ command: " \ certonly \ --non-interactive \ --agree-tos \ --email postmaster@foo.bar \ --preferred-challenges dns-01 \ --dns-cloudflare \ --dns-cloudflare-credentials /cloudflare.ini \ --dns-cloudflare-propagation-seconds 30 \ -d foo.bar,*.foo.bar" ```
cpach 3y ago
This ACME client looks promising, but I haven’t tried it yet: https://github.com/go-acme/lego https://github.com/go-acme/lego

wejn 3y ago

A friend of mine runs dns01 thusly: https://ipng.ch/s/articles/2023/03/24/lego-dns01.html https://ipng.ch/s/articles/2023/03/24/lego-dns01.html

taskforcegemini 3y ago

do you use https/have a cert in your webserver as well, or just on the proxy?

petronio 3y ago

I've had a lot of success with https://github.com/dehydrated-io/dehydrated https://github.com/dehydrated-io/dehydrated . It exposes the different parts of the process (deploy challenge to DNS, deploy cert to filesystem, etc) as hooks, so it's pretty easy to integrate with anything and however you want, if you don't mind writing a bit of bash. There's a few scripts out there that use Cloudflare that you can use as well.

psd1 3y ago

I found LE + CF DNS trouble-free. Dockerfile: ``` FROM certbot/certbot RUN pip3 install certbot-dns-cloudflare cloudflare ``` docker-compose.yml: ``` volumes: - ${CREDENTIALS_DIRECTORY:-.}/cloudflare.ini:/cloudflare.ini - ${STATE_DIRECTORY:-./certbot}/:/etc/letsencrypt/ - ${LOGS_DIRECTORY:-/var/log/certbot}/:/var/log/letsencrypt/ command: " \ certonly \ --non-interactive \ --agree-tos \ --email postmaster@foo.bar \ --preferred-challenges dns-01 \ --dns-cloudflare \ --dns-cloudflare-credentials /cloudflare.ini \ --dns-cloudflare-propagation-seconds 30 \ -d foo.bar,*.foo.bar" ```

cpach 3y ago

This ACME client looks promising, but I haven’t tried it yet: https://github.com/go-acme/lego https://github.com/go-acme/lego