Problem
Currently, Let's encrypt want to listen port 80. Fine, but our ports 80 are busy with actual webservers.
Furthermore, we need certificates for Dwellers, but are not willing to do maintenance tasks directly on Dwellers when it could be avoided.
Solution offered
To build a service to get certificates and dispatch them to relevant web servers.
We could assign a dedicated IPv6 to a FreeBSD jail for this use.
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Resolved | dereckson | T822 SSL certificates: migrate from Startcom to Let's encrypt | |||
| Resolved | dereckson | T654 Apply Let's encrypt SSL certificates for *.nasqueron.org | |||
| Resolved | dereckson | T559 SSL certificate for docker.nasqueron.org | |||
| Resolved | dereckson | T551 Test a Let's encrypt certificate on quux.nasqueron.org | |||
| Resolved | dereckson | T560 Install letsencrypt on Ysul | |||
| Wontfix | dereckson | T606 Create a let's encrypt certificate generator jail |
This task has been identified as suitable for the December product backlog for infrastructure. It's included in our product backlog and will be discussed for inclusion to sprint backlog this E3 meeting.
Create the jail
$ ezjail-admin create letsencrypt 'lo1|127.0.1.1,gif0|2001:470:1f12:9e1::3' $ ezjail-admin start letsencrypt
Configure the jail and install nginx, Let's encrypt
$ ezjail-admin console letsencrypt $ cat > /etc/hosts ::1 localhost localhost.nasqueron.org 127.0.0.1 localhost localhost.nasqueron.org 2001:470:1f12:9e1::3 setstyin.nasqueron.org $ cat > /etc/resolv.conf nameserver 2001:4860:4860::8888 nameserver 2001:4860:4860::8844 $ pkg install nginx py27-letsencrypt $ cat >> /etc/rc.conf nginx_enable="YES" $ /usr/local/etc/rc.d/nginx start
DNS configuration
setstyin.nasqueron.org. 86400 IN AAAA 2001:470:1f12:9e1::3
Test run
$ setenv DOMAINS "-d setstyin.nasqueron.org" $ setenv DIR /var/letsencrypt-auto $ mkdir -p $DIR $ rehash $ letsencrypt certonly --server https://acme-v01.api.letsencrypt.org/directory -a webroot --webroot-path=$DIR --agree-dev-preview $DOMAINS [...] - The following 'urn:acme:error:unknownHost' errors were reported by the server: Domains: setstyin.nasqueron.org Error: The server could not resolve a domain name [...]
IPv6 issue
This approach won't currently work pending upstream resolution:
Furthermore, the Let's encrypt server wants to contact the server where the domain is installed to get a confirmation.
But it's an interesting proof of concept and we could deploy it on nginx.
Deleted jail
$ ezjail-admin stop letsencrypt Stopping jails: letsencrypt. $ ezjail-admin delete letsencrypt