my general nick is fd0, but various variations exist because they had been in use, so you can also see me as fd1, fd0` etc.
Follow me on Twitter - Donate to OpenBSDCertbot is a tool written in python that will standardise the way
Next thing to do is to install Certbot. This is also done the standard way, from the pkg repository:
root@host# pkg_add certbot
quirks-2.414 signed on 2018-03-28T14:24:37Z
certbot-0.22.2:sqlite3-3.22.0p0: ok
certbot-0.22.2:libiconv-1.14p3: ok
certbot-0.22.2:gettext-0.19.8.1p1: ok
certbot-0.22.2:libffi-3.2.1p4: ok
certbot-0.22.2:bzip2-1.0.6p8: ok
certbot-0.22.2:python-2.7.14p1: ok
certbot-0.22.2:py-setuptools-28.6.1p0v0: ok
certbot-0.22.2:py-ConfigArgParse-0.12.0: ok
certbot-0.22.2:py-six-1.10.0p0: ok
certbot-0.22.2:py-cparser-2.18: ok
certbot-0.22.2:py-cffi-1.10.0: ok
certbot-0.22.2:py-enum34-1.1.6: ok
certbot-0.22.2:py-idna-2.5: ok
certbot-0.22.2:py-ipaddress-1.0.18: ok
certbot-0.22.2:py-asn1crypto-0.23.0: ok
certbot-0.22.2:py-cryptography-2.1.4p0: ok
certbot-0.22.2:py-openssl-16.2.0: ok
certbot-0.22.2:py-josepy-1.0.1p0: ok
certbot-0.22.2:py-configobj-5.0.6p1: ok
certbot-0.22.2:py-funcsigs-1.0.2p0: ok
certbot-0.22.2:py-pbr-1.8.1p0: ok
certbot-0.22.2:py-mock-2.0.0p0: ok
certbot-0.22.2:py-parsedatetime-2.4: ok
certbot-0.22.2:py-werkzeug-0.12.1: ok
certbot-0.22.2:py-chardet-3.0.4: ok
certbot-0.22.2:py-urllib3-1.22: ok
certbot-0.22.2:py-certifi-2017.4.17: ok
certbot-0.22.2:py-requests-2.18.4: ok
certbot-0.22.2:py-tz-2018.3: ok
certbot-0.22.2:py-pyRFC3339-1.0p1: ok
certbot-0.22.2:py-asn1-0.3.7v0: ok
certbot-0.22.2:py-ndg-httpsclient-0.4.3: ok
certbot-0.22.2:py-acme-0.22.2: ok
certbot-0.22.2:py-zopeevent-4.2.0p0: ok
certbot-0.22.2:py-zopeinterface-4.4.0: ok
certbot-0.22.2:py-zopecomponent-4.2.2p1: ok
certbot-0.22.2: ok
--- +python-2.7.14p1 -------------------
If you want to use this package as your default system python, as root
create symbolic links like so (overwriting any previous default):
ln -sf /usr/local/bin/python2.7 /usr/local/bin/python
ln -sf /usr/local/bin/python2.7-2to3 /usr/local/bin/2to3
ln -sf /usr/local/bin/python2.7-config /usr/local/bin/python-config
ln -sf /usr/local/bin/pydoc2.7 /usr/local/bin/pydoc
root@host# mkdir -p /etc/letsencrypt/certs # required for haproxy
root@host#
Certbot relies on python and therefor the list of installed packages and python modules is quite long, even though the occupied space is limited.
Certbot is now ready to be used. The first certificate request needs some identification and agreeing to terms of service.
certbot certonly -v \
-m <your e-mail address> --agree-tos \
--standalone --preferred-challenges http \
--http-01-port <the HAproxy defined port> \
-d xxx.domain.org -d yyy.domain.org -d zzz.domain.org
This will generate one multidomain certificate for the hostnames xxx.domain.org, yyy.domain.org and zzz.domain.org.
All management of the generated certificates can be done with certbot, generating, revoking, deleting and also renewing. All relevant files for certbot will be held under /etc/letsencrypt/
root@host# cd /etc/lestencrypt
root@host# find . -type d|sort
.
./certs
./renewal-hooks
./renewal-hooks/pre
./renewal-hooks/deploy
./renewal-hooks/post
./accounts
./accounts/acme-staging-v02.api.letsencrypt.org
./accounts/acme-staging-v02.api.letsencrypt.org/directory
./accounts/acme-staging-v02.api.letsencrypt.org/directory/<some hased value>
./accounts/acme-v01.api.letsencrypt.org
./accounts/acme-v01.api.letsencrypt.org/directory
./accounts/acme-v01.api.letsencrypt.org/directory/<some different hashed value>
./renewal
./keys
./csr
./archive
./archive/domain.org # contains all gerated certificates for this domain
./live
./live/domain.org # contains symbolic links to ../../archive/domain.org/*
root@host#
HAproxy expects all information regarding one certificate in one file, including the private key for the certificate. This can be automated the following way:
root@host# rm -f /etc/letsencrypt/certs/*
root@host# certbot renew -q
root@host# for DOMAIN in `ls /etc/letsencrypt/live`; do \
cat /etc/letsencrypt/live/$DOMAIN/fullchain.pem \
/etc/letsencrypt/live/$DOMAIN/privkey.pem > \
/etc/letsencrypt/certs/$DOMAIN.pem
done
root@host#
To make sure that all certificates will be recognised by HAproxy:
root@host# find /etc/letsencrypt/certs/ -type f -name \*\.pem > /etc/letsencrypt/certs/crt-list.txt
root@host# rcctl restart haproxy
Most of the above can be easily scripted.
In the meantime a new version of the acme protocol has been taken into use by Let’s Encrypt. This means that the certbot software needs an update as well. OpenBSD does not update its packages for other things than security fixes. This means an update of certbot, and its dependencies, need to be taken from a snapshot.
This has been done in the following way
root@host# export PKG_PATH="http://ftp.nluug.nl/pub/OpenBSD/snapshots/packages/`uname -p`/"
root@host# pkg_add -v certbot
This will update certbot to it’s latest version. In my case to 0.25.1. All dependencies will also be taken into account properly.