Changes

5,112 bytes added , 11:49, 15 May 2023

Fixed certbot

{{Feature

|image=Electronic Frontier Foundation video conferencing background certbot-logo-1 (28343180089).png

|imgdesc=Certbot

|title=

}}

{{#set:feature title = {{PAGENAME}} }}

{{#set:feature description = Certbot, from the Let's Encrypt project of the EFF, provides free and automated SSL certificates for QualityBox. }}

{{#set:feature notes = For non-public sites, we can still generate certificates using DNS }}

{{#set:feature tests = [https://www.ssllabs.com/ssltest/analyze.html?d={{SERVERNAME}} Test on SSL Labs.com] }}

Certbot is a tool that allows you to manage the Transport Layer Security ([[TLS]]) of your Webserver.

{{ambox|

|type = content

|text = auto renewal stripped some important params from the configuration in <tt>/etc/letsencrypt/renewal/wiki.freephile.org</tt>, so I had to add them back:

[renewalparams]

-authenticator = webroot

+authenticator = standalone

account = 3b0dcc96ceabfb4cf56597fe14ddee7a

server = https://acme-v02.api.letsencrypt.org/directory

manual_public_ip_logging_ok = None

+http01_port = 54321

+installer = None

+pref_challs = http-01

</syntaxhighlight>

The '''real''' solution is to upgrade Certbot, which will happen anyway when we upgrade the host, which will happen anyway when we move to [[Canasta]], so '''get 'er done!'''

Then, update this page content to reflect current usage.

[[User:Admin|freephile]] ([[User talk:Admin|talk]]) 11:49, 15 May 2023 (EDT)

<br />

}}

== Let's Encrypt ==

We used to run certificates from StartSSL because they offer free one-year certificates. However, today we upgraded to using 'LetsEncrypt' and our certificates are both more secure and easier to manage. Instead of a "B" grade, we now have "A" grade security. <ref>https://www.ssllabs.com/ssltest/analyze.html</ref>

[[File:~~AGrade~~Certificate grade.png|left~~|500px]] [[File:BGrade.png|right~~|500px]]

'''Certbot''' ([https://github.com/certbot/certbot code]) is a fully-featured, extensible client for the Let's Encrypt CA (or any other CA that speaks the ACME protocol) that can automate the tasks of obtaining certificates and configuring web servers to use them. This client runs on Unix-based operating systems. It '''requires''' root access and is '''beta''' software.

Ansible has a [https://docs.ansible.com/ansible/latest/letsencrypt_module.html letsencrypt module] however, using it is a two-step process. We opted instead to create a more robust Ansible playbook to install and automate certificates.

=== Current Setup for Meza ===

cd ~/src/ansible-certbot

# edit host file as needed, setup DNS as needed

# check if the user you expect to use can SSH to the host

ssh centos@demo.qualitybox.us

# activate ansible

source ~/bin/ansible/hacking/env-setup

ansible --version

# edit letsencrypt.yml as needed to identify the host for the play

ansible-playbook -i hosts letsencrypt.yml

# or if you need to use a different user for SSH

ansible-playbook -i hosts letsencrypt.yml --user=root

# if installing by package (default), then certbot is installed "normally". If by source, it's in /opt/certbot

## on the target host

# see if there are any certificates

certbot certificates

# stop HAProxy to make sure the host is accessible, but don't install into Apache, just use standalone

systemctl stop haproxy

certbot certonly --standalone -d demo.qualitybox.us

# then run meza deploy to concatenate the cert files into a .pem file installed into HAproxy

# or if you have to do it manually

rm -f /etc/haproxy/certs/meza.key

rm -f /etc/haproxy/certs/meza.crt

DOMAIN='demo.qualitybox.us' sudo -E bash -c 'cat /etc/letsencrypt/live/$DOMAIN/fullchain.pem /etc/letsencrypt/live/$DOMAIN/privkey.pem > /etc/haproxy/certs/$DOMAIN.pem'

# edit HAProxy to use the certificate

vim /etc/haproxy/haproxy.cfg

systemctl restart haproxy

systemctl status haproxy

# Now you should be able to access $DOMAIN with a green lock icon

</source>

== With HAProxy ==

There is even an experimental [https://github.com/greenhost/certbot-haproxy plugin] if you want to go that route, but it's not necessary.

Although a cron like <code>certbot renew --quiet --no-self-upgrade</code> will work to renew certs, it's not going to install them. So, a better approach is to modify haproxy and also setup a renewal script.

We have to modify the certbot configuration for (each) certificate. Notice how we specified the port at 54321, which we'll use in Haproxy:

<code>cat /etc/letsencrypt/renewal/demo.qualitybox.us.conf</code>

<pre>

# renew_before_expiry = 30 days

version = 0.25.1

archive_dir = /etc/letsencrypt/archive/demo.qualitybox.us

cert = /etc/letsencrypt/live/demo.qualitybox.us/cert.pem

privkey = /etc/letsencrypt/live/demo.qualitybox.us/privkey.pem

chain = /etc/letsencrypt/live/demo.qualitybox.us/chain.pem

fullchain = /etc/letsencrypt/live/demo.qualitybox.us/fullchain.pem

# Options used in the renewal process

[renewalparams]

account = f47c655802900ba026fb42e0bef8acd7

http01_port = 54321

authenticator = standalone

installer = None

pref_challs = http-01,

</pre>

Important parts of the Haproxy configuration. [https://www.digitalocean.com/community/tutorials/how-to-secure-haproxy-with-let-s-encrypt-on-centos-7 More detail]

<pre>

frontend www-https

bind *:443 ssl crt /etc/haproxy/certs

reqadd X-Forwarded-Proto:\ https

acl letsencrypt-acl path_beg /.well-known/acme-challenge/

use_backend letsencrypt-backend if letsencrypt-acl

[snip]

backend letsencrypt-backend

server letsencrypt 127.0.0.1:54321

</pre>

#!/bin/sh

# instead of manually creating a list like this

# declare -a arr=("demo.qualitybox.us" "freephile.qualitybox.us")

# loop through a dynamic list of directories in 'live'

for SITE in $(ls -D /etc/letsencrypt/live)

do

# move to correct let's encrypt directory

cd /etc/letsencrypt/live/$SITE

# echo -e "working in the /etc/letsencrypt/live/$SITE directory\n"

# cat files to make combined .pem for haproxy

cat fullchain.pem privkey.pem > /etc/haproxy/certs/$SITE.pem

# echo -e "created /etc/haproxy/certs/$SITE.pem\n"

done

# reload haproxy

systemctl reload haproxy

# echo -e "reloaded haproxy\n"

</source>

# use crontab -e as 'root' to setup cron to renew expiring certificates

30 2 * * * /usr/bin/certbot renew --renew-hook "/root/bin/renew.sh" >> /var/log/certbot.log

== On Amazon ==

The best way for Cloudflare customers to encrypt '''fully''', is to use Certbot. Cloudflare support echoes [https://support.cloudflare.com/hc/en-us/articles/214820528-How-to-Validate-a-Let-s-Encrypt-Certificate-on-a-Site-Already-Active-on-Cloudflare word-for-word] what Let's Encrypt says in their community forum: [https://community.letsencrypt.org/t/how-to-get-a-lets-encrypt-certificate-while-using-cloudflare/6338 How to get a Let's Encrypt certificate while using CloudFlare]

tldr; Use the <code>--webroot-path </code> option with the <code>certonly--preferred-challenges="dns"</code>, but you'll need to manually intervene. Optionally, if you just turn off the proxying while you issue the certificate, you can use TLS-SNI and HTTP-01 challenges (and then turn proxying back on.) For more advanced usage, check out the docs where they describe [https://certbot.eff.org/docs/using.html#pre-and-post-validation-hooks pre and post validation hooks]

With the pre-hook and post-hook options, you can script the conditions needed to authenticate and renew.

<code>certbot renew --pre-hook "service nginx stop" --post-hook "service nginx start"</code>

The <code>--renew-hook</code> only runs when a certificate has been successfully renewed, so use this script to do things like concatenate the fullchain and

== Resources ==

: You can view the 'Security' pane in Chrome Developer Tools, but for quicker access from the command-line, use '''openssl'''

: <source lang="bash">sudo openssl x509 -in /etc/haproxy/certs/demo.qualitybox.us.pem -text</source>

: Using <code>keytool</code> you can also quickly inspect the certificate of a host:

: <source lang="bash">sudo keytool -printcert -sslserver equality-tech.com</source>

; How do I expand a cert to include some sub-domains? (wildcard certs are not supported):

Admin

Image-reviewer, Bureaucrats, Check users, confirmed, Interface administrators, Administrators (Semantic MediaWiki), Curators (Semantic MediaWiki), Editors (Semantic MediaWiki), staff, Suppressors, sysadmin, Administrators, uploadaccess, Upload Wizard campaign editors, Widget editors

1,495

edits

Changes

Certbot (view source)

Revision as of 11:49, 15 May 2023