Intro
I recently turned off my GoDaddy web site certificate and implemented one that cost me nothing. This will save me $69 per year.
I wrote up my experience in this article: Idea for free web server certificates: Let’s Encrypt
When I originally wrote that article it was a theoretical concept, but since then I’ve encountered web sites using those certificates so I realized that their CA must be widely accepted now and I decided to try for myself. The ACME (automated certificate management environment) environment was something completely new to me and the terminology a little confusing (as a user I don’t “issue” certificates, so whose perspective does the description take anyway?), but I got it to work in the end with the help of a command-line-based utility called acme.sh. I am actually more comfortable with command-line than with GUI programs. You get greater control and greater understanding.
Example of issuing a certificate using the manual DNS method
If you have full control over DNS but not the web server this approach is a good one.
$ sudo acme.sh ‐‐issue ‐‐dns ‐d www2.drjohnstechtalk.com
2021 update
Now the syntax is this:
acme.sh –issue –dns –yes-I-know-dns-manual-mode-enough-go-ahead-please -d www2.drjohnstechtalk.com
and once you’ve made the DNS entries, this:
acme.sh –issue –dns –yes-I-know-dns-manual-mode-enough-go-ahead-please -d www2.drjohnstechtalk.com –renew
[Thu Feb 23 11:55:52 EST 2017] Single domain='www2.drjohnstechtalk.com' [Thu Feb 23 11:55:52 EST 2017] Getting domain auth token for each domain [Thu Feb 23 11:55:52 EST 2017] Getting webroot for domain='www2.drjohnstechtalk.com' [Thu Feb 23 11:55:52 EST 2017] _w='dns' [Thu Feb 23 11:55:52 EST 2017] Getting new-authz for domain='www2.drjohnstechtalk.com' [Thu Feb 23 11:55:54 EST 2017] The new-authz request is ok. [Thu Feb 23 11:55:54 EST 2017] Add the following TXT record: [Thu Feb 23 11:55:54 EST 2017] Domain: '_acme-challenge.www2.drjohnstechtalk.com' [Thu Feb 23 11:55:54 EST 2017] TXT value: '7kU6pGgcNRtrPKuN2Wu1TIGS7YZDBhuiumLb9aEJwqc' [Thu Feb 23 11:55:54 EST 2017] Please be aware that you prepend _acme-challenge. before your domain [Thu Feb 23 11:55:54 EST 2017] so the resulting subdomain will be: _acme-challenge.www2.drjohnstechtalk.com [Thu Feb 23 11:55:54 EST 2017] Please add the TXT records to the domains, and retry again. [Thu Feb 23 11:55:54 EST 2017] Please add '--debug' or '--log' to check more details. [Thu Feb 23 11:55:54 EST 2017] See: https://github.com/Neilpang/acme.sh/wiki/How-to-debug-acme.s/drjohnstechtalk.com/drjohnstechtalk.com/g |
If you see an error like:
Usage: acme.sh --issue -d a.com -w /path/to/webroot/a.com/ |
you probably left out the -d argument or something. I do that all the time for some reason. Go back and check your arguments.
Also note the order of arguments is significant! You have to put the ‐d last!
Anyway, after you’ve worked through any syntax errors like that, make the requested DNS entry in the zone file (do not include the quotes around the TXT value). Verify your entry with a command like this:
$ dig txt www2.drjohnstechtalk.com
Then run acme.sh again like this
$ sudo acme.sh ‐‐renew ‐d www2.drjohnstechtalk.com
[Thu Feb 23 12:02:18 EST 2017] Renew: 'www2.drjohnstechtalk.com' [Thu Feb 23 12:02:18 EST 2017] Single domain='www2.drjohnstechtalk.com' [Thu Feb 23 12:02:18 EST 2017] Getting domain auth token for each domain [Thu Feb 23 12:02:19 EST 2017] Verifying:www2.drjohnstechtalk.com [Thu Feb 23 12:02:22 EST 2017] Success [Thu Feb 23 12:02:22 EST 2017] Verify finished, start to sign. [Thu Feb 23 12:02:23 EST 2017] Cert success. -----BEGIN CERTIFICATE----- MIIFDjCCA/agAwIBAgISAzFs92uVHvnQCId6qFoaui9gMA0GCSqGSIb3DQEBCwUA MEoxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MSMwIQYDVQQD ExpMZXQncyBFbmNyeXB0IEF1dGhvcml0eSBYMzAeFw0xNzAyMjMxNjAyMDBaFw0x NzA1MjQxNjAyMDBaMCAxHjAcBgNVBAMTFXd3dzIucmVmaW5pc2guYmFzZi51czCC ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALa9QjcqPSZxXrJmt7kxV9ii AAI7W0fQdWIk6aDHLfkhsSt55eASOAe05oxnZNqEmcJgXd+2+xUUmm8T5F92l4co TFiIcMIQ5Jr7Gwg61RnDUe87vI4gctechhhnGcE//4iaJ8Va19exg8HD19dfpdGg 9J2DVnUBqKh4pvItUVe3h8KZOmftQZlLy1QXnEfwEyTj4kGo3phBgOIqh2x15/8Q tKtM9yr4TKO8clgKLeyXV90ftg4t7kjCdtPx6oRIIq27CO3nwzFq/vFqg6HprE4b RziUv1yajjw7aHkyhsjWmxdXBlIrokxK3EBrNUo3FUzlLHGGFT2RM1rkbhdaHB0C AwEAAaOCAhYwggISMA4GA1UdDwEB/wQEAwIFoDAdBgNVHSUEFjAUBggrBgEFBQcD AQYIKwYBBQUHAwIwDAYDVR0TAQH/BAIwADAdBgNVHQ4EFgQUCvxAhkhpo5Elmge/ 3fz5asbprXEwHwYDVR0jBBgwFoAUqEpqYwR93brm0Tm3pkVl7/Oo7KEwcAYIKwYB BQUHAQEEZDBiMC8GCCsGAQUFBzABhiNodHRwOi8vb2NzcC5pbnQteDMubGV0c2Vu Y3J5cHQub3JnLzAvBggrBgEFBQcwAoYjaHR0cdrjo2NlcnQuaW50LXgzLmxldHNl bmNyeXB0Lm9yZy8wIAYDVR0RBBkwF4IVd3d3Mi5yZWZpbmlzaC5iYXNmLnVzMIH+ BgNVHSAEgfYwgfMwCAYGZ4EMAQIBMIHmBgsrBgEEAYLfEwEBATCB1jAmBggrBgEF BQcCARYaaHR0cDovL2Nwcy5sZXRzZW5jcnlwdC5vcmcwgasGCCsGAQUFBwICMIGe DIGbVGhpcyBDZXJ0aWZpY2F0ZSBtYXkgb25seSBiZSByZWxpZWQgdXBvbiBieSBS ZWx5aW5nIFBhcnRpZXMgYW5kIG9ubHkgaW4gYWNjb3JkYW5jZSB3aXRoIHRoZSBD ZXJ0aWZpY2F0ZSBQb2xpY3kgZm91bmQgYXQgaHR0cHM6Ly9sZXRzZW5jcnlwdC5v cmcvcmVwb3NpdG9yeS8wDQYJKoZIhvcNAQELBQADggEBADHFgJ3O8v/0zdG48Y1D ci4wSQqZQSRtalknubVLRC12cr8ct1m0nZ7bxxQnZ/bSFShhcjepFowOfjfdY2ar GzKP9IRgWavwm259WX5gM5FKUeN/Pjcz++vwUB8ci2+DpZu1tBf0eZcZ6JKsehij A3lSPb4Ttq/GqDodumeJmvH4/FjCsjIqCJfQQYlz42QdZsLcA2l3oQ8smX0ZK8gh sIm0SX4RggfiNGuNjw/tkfeC4xfjVNUSjKepUqgsVe63F6gRNjjm+/zsIlPLTdw3 AXGxE71Ww68avev7vRCvp+zPa43DQfVfV98v5M4i0M1/bT0Qh/4hLECma9wBBXb8 jXM= -----END CERTIFICATE----- [Thu Feb 23 12:02:23 EST 2017] Your cert is in /root/.acme.sh/www2.drjohnstechtalk.com/www2.drjohnstechtalk.com.cer [Thu Feb 23 12:02:23 EST 2017] Your cert key is in /root/.acme.sh/www2.drjohnstechtalk.com/www2.drjohnstechtalk.com.key [Thu Feb 23 12:02:23 EST 2017] The intermediate CA cert is in /root/.acme.sh/www2.drjohnstechtalk.com/ca.cer [Thu Feb 23 12:02:23 EST 2017] And the full chain certs is there: /root/.acme.sh/www2.drjohnstechtalk.com/fullchain.cer |
More complex example of issuing a SAN certificate using the manual DNS approach
$ ./acme.sh ‐‐issue ‐d johnstechtalk.mobi ‐‐dns ‐d www.johnstechtalk.mobi ‐d drjohnstechtalk.mobi ‐d www.drjohnstechtalk.mobi
[Mon Jan 23 09:21:55 EST 2017] Multi domain='DNS:www.johnstechtalk.mobi,DNS:drjohnstechtalk.mobi,DNS:www.drjohnstechtalk.mobi' [Mon Jan 23 09:21:55 EST 2017] Getting domain auth token for each domain [Mon Jan 23 09:21:55 EST 2017] Getting webroot for domain='johnstechtalk.mobi' [Mon Jan 23 09:21:55 EST 2017] _w='dns' [Mon Jan 23 09:21:55 EST 2017] Getting new-authz for domain='johnstechtalk.mobi' [Mon Jan 23 09:21:57 EST 2017] The new-authz request is ok. [Mon Jan 23 09:21:57 EST 2017] Getting webroot for domain='www.johnstechtalk.mobi' [Mon Jan 23 09:21:57 EST 2017] _w='dns' [Mon Jan 23 09:21:57 EST 2017] Getting new-authz for domain='www.johnstechtalk.mobi' [Mon Jan 23 09:21:57 EST 2017] The new-authz request is ok. [Mon Jan 23 09:21:57 EST 2017] Getting webroot for domain='drjohnstechtalk.mobi' [Mon Jan 23 09:21:57 EST 2017] _w='dns' [Mon Jan 23 09:21:57 EST 2017] Getting new-authz for domain='drjohnstechtalk.mobi' [Mon Jan 23 09:21:58 EST 2017] The new-authz request is ok. [Mon Jan 23 09:21:58 EST 2017] Getting webroot for domain='www.drjohnstechtalk.mobi' [Mon Jan 23 09:21:58 EST 2017] _w='dns' [Mon Jan 23 09:21:58 EST 2017] Getting new-authz for domain='www.drjohnstechtalk.mobi' [Mon Jan 23 09:21:58 EST 2017] The new-authz request is ok. [Mon Jan 23 09:21:58 EST 2017] Add the following TXT record: [Mon Jan 23 09:21:58 EST 2017] Domain: '_acme-challenge.johnstechtalk.mobi' [Mon Jan 23 09:21:58 EST 2017] TXT value: 'CDK_dACa_29apV30lc68Vo-mAx3e923ZOh6u-kyhXLo' [Mon Jan 23 09:21:58 EST 2017] Please be aware that you prepend _acme-challenge. before your domain [Mon Jan 23 09:21:58 EST 2017] so the resulting subdomain will be: _acme-challenge.johnstechtalk.mobi [Mon Jan 23 09:21:58 EST 2017] Add the following TXT record: [Mon Jan 23 09:21:58 EST 2017] Domain: '_acme-challenge.www.johnstechtalk.mobi' [Mon Jan 23 09:21:58 EST 2017] TXT value: 'UC6JLg1hbXo0oRlYwSyrSRMD5nZgEKgdcIDZfhlqCrU' [Mon Jan 23 09:21:58 EST 2017] Please be aware that you prepend _acme-challenge. before your domain [Mon Jan 23 09:21:58 EST 2017] so the resulting subdomain will be: _acme-challenge.www.johnstechtalk.mobi [Mon Jan 23 09:21:58 EST 2017] Add the following TXT record: [Mon Jan 23 09:21:58 EST 2017] Domain: '_acme-challenge.drjohnstechtalk.mobi' [Mon Jan 23 09:21:58 EST 2017] TXT value: 'y8ZCkJ-PXxGbeQFxh7RULCLGKyHH3G7FMFhKpMNF7ow' [Mon Jan 23 09:21:58 EST 2017] Please be aware that you prepend _acme-challenge. before your domain [Mon Jan 23 09:21:58 EST 2017] so the resulting subdomain will be: _acme-challenge.drjohnstechtalk.mobi [Mon Jan 23 09:21:58 EST 2017] Add the following TXT record: [Mon Jan 23 09:21:58 EST 2017] Domain: '_acme-challenge.www.drjohnstechtalk.mobi' [Mon Jan 23 09:21:58 EST 2017] TXT value: '8nyb_V7AKaxy0U5pGTKmUejKEXgPv66VKne8yZYZMDg' [Mon Jan 23 09:21:58 EST 2017] Please be aware that you prepend _acme-challenge. before your domain [Mon Jan 23 09:21:58 EST 2017] so the resulting subdomain will be: _acme-challenge.www.drjohnstechtalk.mobi [Mon Jan 23 09:21:59 EST 2017] Please add the TXT records to the domains, and retry again. [Mon Jan 23 09:21:59 EST 2017] Please add '--debug' or '--log' to check more details. [Mon Jan 23 09:21:59 EST 2017] See: https://github.com/Neilpang/acme.sh/wiki/How-to-debug-acme.sh |
Then you add the DNS records they requested in the zone file, for instance,
_acme-challenge.johnstechtalk.mobi IN TXT CDK_dACa_29apV30lc68Vo-mAx3e923ZOh6u-kyhXLo |
Then you rerun acme.sh, but with the renew argument:
$ ./acme.sh ‐‐renew ‐d johnstechtalk.mobi
and you should get your SAN certificate issued to you! All the files – private key, intermediate CERT, newly-issued SAN certificate – in ~/.acme.sh/johnstechtalk.mobi/
Of course just put in your own domain names in place of mine. I don’t know how quickly you have to act to put in your TXT records for the DNS authentication challenge. I edited zone files by hand and got them in within a few minutes.
And note the order of the arguments in the original acme.sh command. Often the switch order is immaterial in Linux, but for this command it matters a bit. You have your first mentioned domain, then the dns switch, then your other domain names.
Authorization expires
I got into trouble today, these many months later because my authorization had expired. The error looks like this:
[Sat Feb 3 17:14:00 EST 2018] _CURL='curl -L --silent --dump-header /root/.acme.sh/http.header '
[Sat Feb 3 17:14:01 EST 2018] _ret='0'
[Sat Feb 3 17:14:01 EST 2018] code='404'
[Sat Feb 3 17:14:01 EST 2018] drjohnstechtalk.com:Challenge error: {"type":"urn:acme:error:malformed","detail":"Expired authorization","status": 404}
[Sat Feb 3 17:14:01 EST 2018] Skip for removelevel:
[Sat Feb 3 17:14:01 EST 2018] pid
[Sat Feb 3 17:14:01 EST 2018] _clearupdns
[Sat Feb 3 17:14:01 EST 2018] Dns not added, skip.
[Sat Feb 3 17:14:01 EST 2018] _on_issue_err
[Sat Feb 3 17:14:01 EST 2018] Please add '--debug' or '--log' to check more details.
[Sat Feb 3 17:14:01 EST 2018] See: https://github.com/Neilpang/acme.sh/wiki/How-to-debug-acme.sh
[Sat Feb 3 17:14:02 EST 2018] Diagnosis versions: |
Turns out there was a 10-month validity to my one-time DNS authorization which I did not know. So I switched to web root authorization and that seemed to work. That went like this:
$ acme.sh ‐‐issue ‐d drjohnstechtalk.com ‐w /webroot/drjohns
And I had to run that as root.
References and related
Idea for free web server certificates: Let’s Encrypt
Info about acme.sh
A great review of the state of hosting companies preparedness for offering SSL circa March 2018 in their hosting packages – so you can compare side-by-side – is in this Naked Security article: https://nakedsecurity.sophos.com/2018/03/12/with-4-months-to-switch-on-https-are-web-hosting-companies-ready/