Integrate Let's Encrypt SSL certificates into ISPConfig

I usually just use

Code:

git clone https://github.com/letsencrypt/letsencrypt
cd letsencrypt
letsencrypt-auto --help

 

While no one is answering to my previous messages, I have a new permission issue when attempting to renew:

WARNING:letsencrypt.renewal:Attempting to renew cert from /etc/letsencrypt/renewal/domain.tld.conf produced an unexpected error: ("Couldn't create root for {0} http-01 challenge responses: {1}", 'domain.tld, OSError(13, 'Permission denied')). Skipping.

 

Does the user running the command have permission to create folders in that location? Can you add an strace before the command to see where it fails?

 

Yeah it run as root.

All renewal attempts failed. The following certs could not be renewed:
/etc/letsencrypt/live/domain.tld/fullchain.pem (failure)
1 renew failure(s), 0 parse failure(s)

[{WIFEXITED(s) && WEXITSTATUS(s) == 1}], 0, NULL) = 23192
rt_sigaction(SIGINT, {SIG_DFL, [], SA_RESTORER, 0x7efd3f6bc0e0}, {0x443660, [], SA_RESTORER, 0x7efd3f6bc0e0}, 8) = 0
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=23192, si_uid=0, si_status=1, si_utime=0, si_stime=0} ---
wait4(-1, 0x7ffe86c72710, WNOHANG, NULL) = -1 ECHILD (No child processes)
rt_sigreturn() = 0
rt_sigprocmask(SIG_BLOCK, [CHLD], [], 8) = 0
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
exit_group(1) = ?
+++ exited with 1 +++

 

Hi there,
I used Alex's script, but can't get it to work.
I'm seeing this in the /var/log/letsencrypt logs:

Code:

2016-04-27 20:12:04,302:DEBUG:letsencrypt.main:Exiting abnormally:
Traceback (most recent call last):
  File "/root/.local/share/letsencrypt/bin/letsencrypt", line 11, in <module>
    sys.exit(main())
  File "/root/.local/share/letsencrypt/local/lib/python2.7/site-packages/letsencrypt/main.py", line 692, in main
    return config.func(config, plugins)
  File "/root/.local/share/letsencrypt/local/lib/python2.7/site-packages/letsencrypt/main.py", line 504, in obtain_cert
    le_client = _init_le_client(config, auth, installer)
  File "/root/.local/share/letsencrypt/local/lib/python2.7/site-packages/letsencrypt/main.py", line 356, in _init_le_client
    acc, acme = _determine_account(config)
  File "/root/.local/share/letsencrypt/local/lib/python2.7/site-packages/letsencrypt/main.py", line 341, in _determine_account
    config, account_storage, tos_cb=_tos_cb)
  File "/root/.local/share/letsencrypt/local/lib/python2.7/site-packages/letsencrypt/client.py", line 122, in register
    if tos_cb is not None and not tos_cb(regr):
  File "/root/.local/share/letsencrypt/local/lib/python2.7/site-packages/letsencrypt/main.py", line 337, in _tos_cb
    return obj.yesno(msg, "Agree", "Cancel", cli_flag="--agree-tos")
  File "/root/.local/share/letsencrypt/local/lib/python2.7/site-packages/letsencrypt/display/util.py", line 164, in yesno
    yes_label=yes_label, no_label=no_label)
  File "/root/.local/share/letsencrypt/local/lib/python2.7/site-packages/dialog.py", line 3749, in yesno
    kwargs)
  File "/root/.local/share/letsencrypt/local/lib/python2.7/site-packages/dialog.py", line 1765, in _widget_with_no_output
    widget_name, output))
PythonDialogBug

Btw, I have the Let's Encrypt git cloned into /opt/letsencrypt folder... does this matter ?
Should I move it to /etc/letsencrypt? Because there is a file (cli.ini) needed to be placed there.

UPDATE:
I had to move it to that folder... silly me

 

@till letsencrypt has changed
https://certbot.eff.org/all-instructions/

now to install is

Code:

wget https://dl.eff.org/certbot-auto
chmod a+x certbot-auto

 

Nice. Uhm... Do I need to delete the letsencrypt folders in root?

 

no. not need.
if u remove root .local/share/letsencrypt first time u launch cerbot it will reload all necessary stuff here
(41Mb on my debian8)

 

Hi guys, quick question. Is letsencrypt certificate generation supported from remote API call on ISPConfig 3.1?

I am currently using 3.0.5.4p8 multiserver setup with remove API with few hundred sites, and I need letsencrypt, so I am wondering which is the best route to take. I can wait for ISPConfig 3.1 to go live if I would be able to generate certificates by the API (although the last upgrade of ISPConfig didn't go smoothly), or I can try to make some patch outside of IPSConfig.

 

since pretty much everything can be done through the api I think that can also be done. However not using 3.1 yet so I can't say for sure. Did you check the documentation whether it was already added?

 

Does ISPConfig automatically generate certificates for added subdomains? For example, if I had already checked the Let's Encrypt box, and the certificates have already been created for a domain and its subdomains, what happens when I add a new subdomain? Currently it doesn't seem to generate any more certificates.

 

How do we renew the certificates? Or does ispconfig do it for us?

 

I just installed the Beta 2 because I want to experiment with this.

Because I currently only have the FQDN of the server that is globally resolvable to this server, I decided to try to get the ISPConfig page itself to be encrypted using an Let's Encrypt certificate. But I seem to be completely unable to find where to tell ISPConfig to use Let's Encrypt for it's own certificate (or for IMAP, SMTP, POP3). Am I blind or is there no GUI for this? What's the preferred way to handle this?

The server did (does) have a Let's Encrypt certificate for it's FQDN. I had configured ISPConfig 3.0 to use it. But after upgrading (and reconfiguring) ISPConfig fell back to the old (by now expired) certificate.

 

how about adding an option to also get LE certs for the actual ISPC "main domain" name/hostname?

 

mailserver etc will be more difficult as you can only have a limited amount of fqdn in SAN... that's why I do that seperate on chosen domains for postfix/dovecot

 

current limit is 100 SANs per cert. But what would be smart way from ISPC Interface to add the which SAN to were. You can't use the DNS intro as e.g. you may only want to add mail.domain.tld to postfix/dovecot and domain.tld to sFTP.

Currently I use a simple setup like this:

Code:

#!/usr/bin/env bash 

days=60
email="[email protected]"
ispcDomain="ispc.domain.tld"


#******************************************************************************#
#                                                                              #
#                              HERE BE DRAGONS                                 #
#                                                                              #
#******************************************************************************#


declare -a maildomains=( "${ispcDomain}"
                         'mail.otherdomain.tld'
                         'mail.newdomain.tld'
                         '....'
                       ) 

for i in "${maildomains[@]}"; do
 domains="${domains} -d ${i}"
done 


# Get the period after which certs should be renewed
if [[ ! "${days}" -gt 0 ]]; then 
 echo "Couldn't get the correct amount of days after which certs should be renewed." 
 echo "Please check your config and retry." 
 exit 1 
fi 

fileTime=$(stat -c %Y "/etc/ispcSSL/live/${ispc.domain.tld}/fullchain.pem") 
curTime=$(date +%s) 
diff=$(( (curTime - fileTime) / 86400 )) 

if [[ ${diff} -ge ${days} ]]; then 
 cd "/root/letsencrypt/" 
 ./letsencrypt-auto --config-dir /etc/ispcSSL --text --agree-tos --rsa-key-size 4096 --email "${email}" ${domains} -a webroot --webroot-path "/var/www/" certonly 

 systemctl reload postfix 
 systemctl restart dovecot 
fi

Of course I have a config in /etc/apache2/conf-available that rewrites all domain.tld/.well-known folders to /var/www/.well-known.

As you can also see, I made a seperate folder fo the mail ssl certs in /etc so they won't interfere with the normal one (/etc/ispcSSL).

The script itself is fairly simple.

1. Manually supply a list of domains you want to get a cert for
2. Read out the last modified time of the fullchain.pem (could be improved to read out the actual issue/expiration date using openssl)
3. If 60 days or more have passed since creation of cert, then request a new cert
4. Reload/restart services

P.S.: Still using older git client...