I've been downloading SSL certificates from my domain provider, using cat to join them together to make the fullchain.pem, uploading them to the server, and myself adding a 90 day calendar reminder. Every time I did this I'd think I should find out about this Certbot thing.
Well, I finally got around to it, and it was one of those jobs which turns out to be so easy you wish you'd done it ages ago.
The install was simple (I'm using nginx/ubuntu).
It scans up your server conf files to see which sites are being served, asks you a couple of questions, obtains the Let's Encrypt certificate for them, installs it, updates your conf files to use it, and sets up a cron job to check if it's time to renew the certificate, which it will also do auto-magically.
I was so pleased with it I made a donation to the EFF for it, then I started to think about how amazingly useful Let's Encrypt is, and gave them one too. It's just a really good time to be in this hobby.
I highly recommend Certbot. If you've been putting this off, or only just hearing about it, make some time for it.
I'm obviously a fan of LE but a simple self-hosted option with a custom CA would be great for local machines:
Use DNS verification and wildcard certs and all this goes away.
+1
I use acme-dns and it works very well. It's a basic DNS server that only serves the Let's Encrypt DNS challenges - it only allows clients to create TXT records, in the exact format that Let's Encrypt needs. This is great for security as you don't have to give Certbot/whatever full access to your main DNS servers.
Let's Encrypt followers CNAMEs which is how this works - you CNAME the
_acme-challengesubdomain to point to a subdomain hosted by the acme-dns server.Let's Encrypt is fine with IPv6-only DNS servers, so I have acme-dns running on one of my VPSes only over IPv6 (since I'm using the IPv4 for my regular DNS server). Good VPS providers provide a /64 IPv6 range.
This.... Is what I've wanted but never looked up if it was possible. Thank you. I've been manually renewing my cert for ages...
In theory you could generate a wildcard to a domain then use it.
My use case is for domains hosted on a VPS rather than my home server-hosted stuff. None of that is exposed to the internet except via Tailnet. I've got a domain saved up for that but haven't figured it out how to do it since the CA can't access my server to verify it. I have the feeling the answer is going to be ten more commenters telling me to check out Caddy.
It's easy* to setup Hashicorp Vault with your own CA and do automated cert generation and rotation, if you are willing to integrate everything into Vault and install your root CA everywhere. (*not really harder than any other Vault setup, but yaknow). I may go down this route eventually since I don't think a device I don't control has ever accessed anything I selfhost, or ever will.
I have a wildcard subdomain pointing to my public IP, and forward port 80 to an LXC container with certbot. Port 80 appears closed outside the brief window when certbot is renewing certs. Inside my network I have my PiHole configured to return the local IP for each service.
Nothing exposed to the internet at all. There is a record of my hostnames on Let's Encrypt but not concerned if someone will, say, deduce apollo-idrac is the iDRAC service for a Dell rackmount server called apollo and the other Greek/Roman gods are VMs on it. Seemed like a house of cards that would never work reliably, but three odd years later I only have issues if a DNS resolver insists on bypassing my PiHole. And that DNS resolver is SystemD-ResolveD which should crawl back into whatever hellhole it came out of.