Let’s encrypt automation on Debian

Until the CA system is completely abolished, this appears to works great with LE -- free certificates and a guarantee that no other CA can impersonate you.

The ACME protocol could conceivably be extended to update SRV records along with the certificate for some DNS providers.

Re: Let’s encrypt automation on Debian

#4

Post by wyldfire » Thu, Dec 03, 2015, 1:55 PM UTC

IshKebab wrote: post #2

I really hope letsencrypt doesn't delay the real solution - DANE.

Remedial question, for the unfamiliar folks: how do I establish a bootstrap trust w/DNSSEC? Does it require backwards-incompatible changes at the root?

Re: Let’s encrypt automation on Debian

#5

Post by schoen » Thu, Dec 03, 2015, 2:26 PM UTC

Most people shouldn't need both cert.pem and fullchain.pem, because fullchain.pem is "full" because it also contains a copy of cert.pem (unlike chain.pem, which doesn't). (I chose these names for the structure of Let's Encrypt's certificate storage.)

Re: Let’s encrypt automation on Debian

#6

Post by diafygi » Thu, Dec 03, 2015, 2:30 PM UTC

FYI, if you don't want to install all the dependencies of the official letsencrypt client, I made a https://github.com/diafygi/acme-tiny

Re: Let’s encrypt automation on Debian

#7

Post by nereid666 » Thu, Dec 03, 2015, 2:42 PM UTC

diafygi wrote: post #6

FYI, if you don't want to install all the dependencies of the official letsencrypt client, I made a https://github.com/diafygi/acme-tiny

Very useful. Thx!

Re: Let’s encrypt automation on Debian

#8

Post by ausjke » Thu, Dec 03, 2015, 2:46 PM UTC

This might be a dumb question, after I auto-generate all those ssl certs, how am I going to certify it at some CA? so that all browser will not pop up a warning page when the ssl-site is accessed? What's the key difference between letsencrypt and self-signed ssl certificate?

Re: Let’s encrypt automation on Debian

#9

Post by [deleted] » Thu, Dec 03, 2015, 2:51 PM UTC

ausjke wrote: post #8

This might be a dumb question, after I auto-generate all those ssl certs, how am I going to certify it at some CA? so that all browser will not pop up a warning page when the ssl-site is accessed? What's the key difference between letsencrypt and self-signed ssl certificate?

[deleted]

Re: Let’s encrypt automation on Debian

#10

Post by diafygi » Thu, Dec 03, 2015, 2:51 PM UTC

ausjke wrote: post #8

This might be a dumb question, after I auto-generate all those ssl certs, how am I going to certify it at some CA? so that all browser will not pop up a warning page when the ssl-site is accessed? What's the key difference between letsencrypt and self-signed ssl certificate?

The certificates that Let's Encrypt issues are cross-signed by IdenTrust (a real CA) so browsers should trust the certificate you get from Let's Encrypt. NOTE: just like with other TLS certs, you will need to include the Let's Encrypt intermediate certificate in your webserver config so that it can be chained back to IdenTrust.

EDIT: IdenTrust, not Entrust, sorry!