Certbot

Certbot
Image shows:	Certbot
Summary
Title:	Certbot
Description:	Certbot, from the Let's Encrypt project of the EFF, provides free and automated SSL certificates.
More
Notes:	For non-public sites, we can still generate certificates using DNS
Test:	Test on SSL Labs.com
Example:	See File:Certificate grade.png

Certbot is a tool that allows you to manage the Transport Layer Security (TLS) of your Webserver.

Let's Encrypt

We used to run certificates from StartSSL because they offer free one-year certificates. However, today we upgraded to using 'LetsEncrypt' and our certificates are both more secure and easier to manage. Instead of a "B" grade, we now have "A" grade security.

Certbot (code) is a fully-featured, extensible client for the Let's Encrypt CA (or any other CA that speaks the ACME protocol) that can automate the tasks of obtaining certificates and configuring web servers to use them. This client runs on Unix-based operating systems. It requires root access to manage yourself - but is built-in to many service providers today as it has become an industry standard.

Until May 2016, Certbot was named simply letsencrypt or letsencrypt-auto, depending on install method. Instructions on the Internet, and some pieces of the software, may still refer to this older name.

Certbot website at EFF.org (the Electronic Frontier Foundation).

Automation

Ansible has a ACME certificate module in the crypto' collection (community not core). However, using it is a two-step process. We opted instead to create an integration into the Meza platform that takes care of both installation and renewal.

With HAProxy

Like Lighttpd, Pound, Ejabberd and other servers, HAProxy expects a single .pem file that has the combined contents of the fullchain.pem and privkey.pem.

Fortunately, certbot offers a --pre-hook, a --post-hook and a --renew-hook that we can use. The hooks allow to stop and later restart the 'normal' services and also concatenate the generated certificate files into a .pem file for HAProxy.

Do not use the plugin.

On Amazon

If you're one of the millions of Amazon Web Services customers, you may be tempted to use their lookalike service called AWS Certificate Manager.

Don't.

AWS certificates can't even be copied between regions. AWS certificates can't be used on your own servers. AWS certificates have annoying limits. They use email in whois to validate (not going to work if you have domain privacy turned on)!!! Amazon should have just joined the rest of the world in supporting LetsEncrypt. Fortunately, LetsEncrypt can be used everywhere, including AWS.

On Cloudflare

Cloudflare offers "Keyless SSL" and "Universal SSL". Although these are excellent signs that Cloudflare is doing good work, it remains true that origin traffic may not be encrypted at all leading to a huge trust problem.

The best way for Cloudflare customers to encrypt fully, is to use Certbot. Cloudflare support echoes word-for-word what Let's Encrypt says in their community forum: How to get a Let's Encrypt certificate while using CloudFlare

tldr; Use the --webroot-path option with the certonly --preferred-challenges="dns", but you'll need to manually intervene. Optionally, if you just turn off the proxying while you issue the certificate, you can use TLS-SNI and HTTP-01 challenges (and then turn proxying back on.) For more advanced usage, check out the docs where they describe pre and post validation hooks

With the pre-hook and post-hook options, you can script the conditions needed to authenticate and renew. certbot renew --pre-hook "service nginx stop" --post-hook "service nginx start"

The --renew-hook only runs when a certificate has been successfully renewed, so use this script to do things like concatenate the fullchain and

Resources

1. https://letsencrypt.org/getinvolved/ Get Involved with Lets Encrypt
   1. https://letsencrypt.org/getting-started/ Getting Started
   2. https://github.com/letsencrypt/letsencrypt Code on GitHub
   3. https://letsencrypt.readthedocs.org/en/latest/ Docs
2. Apache docs
3. Ubuntu Server Guide - Certificates and Security
4. Ansible role for LetsEncrypt

FAQ

How do I obtain a new certificate?

1. setup the SSL virtual host in Apache, and be sure to include some SSLCertificateFile and SSLCertificateKeyFile directives using the "snake-oil" certs.
   e.g.
   SSLCertificateFile /etc/ssl/certs/ssl-cert-snakeoil.pem
   SSLCertificateKeyFile /etc/ssl/private/ssl-cert-snakeoil.key
   
2. Then run certbot
   /opt/certbot/certbot --apache -d example.org,www.example.org,wiki.example.org --dry-run
   /opt/certbot/certbot --apache -d example.org,www.example.org,wiki.example.org

What certs do I have?

sudo certbot certificates

How do I see more info about my certificates?

You can view the 'Security' pane in Chrome Developer Tools, but for quicker access from the command-line, use openssl

sudo openssl x509 -in /etc/haproxy/certs/demo.qualitybox.us.pem -text

Using keytool you can also quickly inspect the certificate of a host:

sudo keytool -printcert -sslserver equality-tech.com

How do I expand a cert to include some sub-domains?

Use the --expand option to put multiple domains in the same cert.

sudo /opt/certbot/certbot certonly --cert-name example.org --expand -d example.org,www.example.org,wiki.example.org,example.com,www.example.com,wiki.example.com

How do I create a wildcard certificate with LetsEncrypt?

See https://github.com/geerlingguy/ansible-role-certbot/pull/60#issuecomment-423919284

How do I cleanup my old/test certificates?

sudo /opt/certbot/certbot revoke --cert-path /etc/letsencrypt/live/baz.example.org/cert.pem

sudo /opt/certbot/certbot delete --cert-name baz.example.org

Electronic Frontier Foundation https://eff.org

Secure Sockets Layer = secure (encrypted) underpinning for HTTP

Domain Name System. An Named Host to IP Address lookup system

Transport Layer Security

HyperText Transfer Protocol = the foundation of data communication for the World Wide Web. See HTML