{"id":5339,"date":"2020-12-10T16:21:53","date_gmt":"2020-12-10T16:21:53","guid":{"rendered":"https:\/\/rakhesh.com\/?p=5339"},"modified":"2020-12-10T21:57:56","modified_gmt":"2020-12-10T21:57:56","slug":"lets-encrypt-on-my-raspberry-pi","status":"publish","type":"post","link":"https:\/\/rakhesh.com\/linux-bsd\/lets-encrypt-on-my-raspberry-pi\/","title":{"rendered":"Let&#8217;s Encrypt on my Raspberry Pi"},"content":{"rendered":"<p>Some months ago I had created some certs on my Pi via Let&#8217;s Encrypt. I forgot to blog about it and today when I wanted to generate some more certs my mind drew a blank. :) I know I had done <em>something<\/em> in the past as I could see the certs, but I have absolutely no memory of doing it. That&#8217;s the problem when you don&#8217;t make a blog entry coz then you have nothing to go back and refer to.<\/p>\n<p>In fact, searching my blog for this today I realized that I had generated some Let&#8217;s Encrypt certs for work couple of years ago <a href=\"https:\/\/rakhesh.com\/windows\/certificates-in-the-time-of-lets-encrypt\/\">via PowerShell<\/a>. When I read the blog post I remembered what I had done, but I had completely forgotten about it.<\/p>\n<p>Anyhoo. <a href=\"https:\/\/letsencrypt.org\/getting-started\/\">Let&#8217;s Encrypt<\/a>. Uses the ACME Protocol. There are many clients that can talk this protocol (I <a href=\"https:\/\/rakhesh.com\/linux-bsd\/gitea-on-openbsd-6-8\/\">alluded it earlier<\/a> in the case of OpenBSD which comes with a client <a href=\"https:\/\/man.openbsd.org\/acme-client.1\">of its own<\/a>). The official client is called <a href=\"https:\/\/certbot.eff.org\/\">certbot<\/a>. If you go to the certbot <a href=\"https:\/\/certbot.eff.org\/\">website<\/a> to download it it recommends <a href=\"https:\/\/certbot.eff.org\/lets-encrypt\/debianbuster-other\">installing Snap<\/a> and going that route (yes, even for something like Debian Buster which does not have Snap in-built). Why?! I remember finding an alternative last time around and I came across it again today. Hidden in the <a href=\"https:\/\/certbot.eff.org\/docs\/install.html\">docs is a section<\/a> on how to get it via non-Snap methods, and they have a Debian package too for Buster and above (else install Backports to get it).<\/p>\n<pre class=\"lang:sh decode:true \">sudo apt update\nsudo apt install certbot<\/pre>\n<p>Cool, so that&#8217;s that. Next step is to decide how you want to get certs. Back when I did it on OpenBSD it was for a public website so things were slightly easy in that their ACME client could automate things as it knows OpenBSD&#8217;s web-server, and it is a publicly available name, so things were smoother.<\/p>\n<p>At home though what I want is to generate certs for each of my machines. The certbot client has plugins for Apache and Nginx but I can&#8217;t use them coz my home machines don&#8217;t have any public IP. I suppose I could just generate the certs on one machine and copy them around etc. but I want to keep things simple and automatic. In my case the solution would be to use one of their <a href=\"https:\/\/certbot.eff.org\/docs\/using.html#dns-plugins\">DNS plugins<\/a>. They support the following:<\/p>\n<ul>\n<li>certbot-dns-cloudflare<\/li>\n<li>certbot-dns-cloudxns<\/li>\n<li>certbot-dns-digitalocean<\/li>\n<li>certbot-dns-dnsimple<\/li>\n<li>certbot-dns-dnsmadeeasy<\/li>\n<li>certbot-dns-gehirn<\/li>\n<li>certbot-dns-google<\/li>\n<li>certbot-dns-linode<\/li>\n<li>certbot-dns-luadns<\/li>\n<li>certbot-dns-nsone<\/li>\n<li>certbot-dns-ovh<\/li>\n<li>certbot-dns-rfc2136<\/li>\n<li>certbot-dns-route53<\/li>\n<li>certbot-dns-sakuracloud<\/li>\n<\/ul>\n<p>Hmm. Step 1, my home DNS zone is a fake one like <code>rakhesh.home<\/code> so time to get a public one. Step 2, choose one of the providers above I can programmatically access to create DNS records for the ACME verification.<\/p>\n<p>I&#8217;ll go with the name <code>raxnet.uk<\/code> and host it on Route 53. <a href=\"https:\/\/certbot-dns-route53.readthedocs.io\/en\/stable\/\">Here&#8217;s<\/a> the documentation for the route53 plugin. The plugin needs to be installed separately; I searched for it in apt and <a href=\"https:\/\/packages.debian.org\/buster\/python3-certbot-dns-route53\">found<\/a> it as <code>python3-certbot-dns-route53<\/code>. Instructions to use it are simple and found on their <a href=\"https:\/\/github.com\/certbot\/certbot\/tree\/master\/certbot-dns-route53\">GitHub<\/a> site and <a href=\"https:\/\/certbot-dns-route53.readthedocs.io\/en\/stable\/\">docs<\/a>.<\/p>\n<pre class=\"lang:sh decode:true \">sudo apt install python3-certbot-dns-route53<\/pre>\n<p>I created the zone on Route 53 and noted its Zone ID. Next I created a policy in <a href=\"https:\/\/console.aws.amazon.com\/iam\/home?#\/policies\">IAM<\/a> based on the sample offered in the plugin docs (when in the policy screen select JSON and put this in):<\/p>\n<pre class=\"lang:js mark:3,21 decode:true\">{\n    \"Version\": \"2012-10-17\",\n    \"Id\": \"raxnet.uk-dns-route53 policy\",\n    \"Statement\": [\n        {\n            \"Effect\": \"Allow\",\n            \"Action\": [\n                \"route53:ListHostedZones\",\n                \"route53:GetChange\"\n            ],\n            \"Resource\": [\n                \"*\"\n            ]\n        },\n        {\n            \"Effect\": \"Allow\",\n            \"Action\": [\n                \"route53:ChangeResourceRecordSets\"\n            ],\n            \"Resource\": [\n                \"arn:aws:route53:::hostedzone\/Z00811912W0CAEB6R0R0M\"\n            ]\n        }\n    ]\n}<\/pre>\n<p>The policy allows whoever it is applied to to list my zones and also change resource records specifically for the new zone I created (that&#8217;s where the Z00811912W0CAEB6R0R0M Zone ID comes in).<\/p>\n<p>I then created a user in IAM. Let&#8217;s call it <code>pi1-certbot<\/code> as I&#8217;ll be using this on that particular device and I&#8217;d like to have a separate account per device. Tick the option for programmatic access, and leave the console access unticked. I attached the policy I created above to this user and in the final step was given my access keys. You can place these keys in a folder in <code>~\/.aws\/config<\/code>, but I went with making a new file called <code>\/etc\/pi1-certbot-awskey<\/code>:<\/p>\n<pre class=\"lang:default decode:true\">[default]\naws_access_key_id=AKIAIOSFODNN7EXAMPLE\naws_secret_access_key=wJalrXUtnFEMI\/K7MDENG\/bPxRfiCYEXAMPLEKEY<\/pre>\n<p>I also changed this file to be not read\/ writeable by anyone else except root.<\/p>\n<p>Next step is to do the certificate request via <code>certbot<\/code>. I made a script for this so I can reuse:<\/p>\n<pre class=\"lang:sh decode:true\">#!\/usr\/bin\/env bash\n\nif [[ -r $1 ]]; then\n  AWS_CONFIG_FILE=$1 \\\n    certbot certonly \\\n      -n --agree-tos --email me@rakhesh.com \\\n      --dns-route53 \\\n      --dns-route53-propagation-seconds 30 \\\n      -d $2\nfi\n\n# what the options mean:\n# -n            - non-interactive\n# --agree-tos   - agree to the TOS\n# --email       - email address for any urgent messages\n# --dns-route53 - use route53 as verification option\n# -d            - the domain to verify\n<\/pre>\n<p>I placed this in <code>\/opt<\/code>. Feel free to place this wherever. This script takes two arguments &#8211; one is the credentials file I created above, other is the domain name to create a cert for.<\/p>\n<pre class=\"lang:sh decode:true\">$ sudo \/opt\/certbot-renew.sh \/etc\/pi1-certbot-awskey pi1.raxnet.uk\nSaving debug log to \/var\/log\/letsencrypt\/letsencrypt.log\nCredentials found in config file: \/etc\/pi1-certbot-awskey\nPlugins selected: Authenticator dns-route53, Installer None\nObtaining a new certificate\nPerforming the following challenges:\ndns-01 challenge for pi1.raxnet.uk\nWaiting for verification...\nCleaning up challenges\n\nIMPORTANT NOTES:\n - Congratulations! Your certificate and chain have been saved at:\n   \/etc\/letsencrypt\/live\/pi1.raxnet.uk\/fullchain.pem\n   Your key file has been saved at:\n   \/etc\/letsencrypt\/live\/pi1.raxnet.uk\/privkey.pem\n   Your cert will expire on 2021-03-10. To obtain a new or tweaked\n   version of this certificate in the future, simply run certbot\n   again. To non-interactively renew *all* of your certificates, run\n   \"certbot renew\"\n - Your account credentials have been saved in your Certbot\n   configuration directory at \/etc\/letsencrypt. You should make a\n   secure backup of this folder now. This configuration directory will\n   also contain certificates and private keys obtained by Certbot so\n   making regular backups of this folder is ideal.\n - If you like Certbot, please consider supporting our work by:\n\n   Donating to ISRG \/ Let's Encrypt:   https:\/\/letsencrypt.org\/donate\n   Donating to EFF:                    https:\/\/eff.org\/donate-le<\/pre>\n<p>I&#8217;d want this to be renewed automatically so I added this to my root&#8217;s crontab via <code>sudo crontab -e<\/code>:<\/p>\n<pre class=\"lang:default decode:true \">@daily \/opt\/certbot-renew.sh \/etc\/pi1-certbot-awskey pi1.raxnet.uk<\/pre>\n<p>And that&#8217;s it. Now I have certs for this host.<\/p>\n<p><strong>Update<\/strong>: I added a <code>-q<\/code> switch to the command line in my script so there&#8217;s no output. Useful since I am adding it as a <code>crontab<\/code> entry. I am not showing the modification above just wanted to mention for completeness.<\/p>\n<p><strong>Update 2<\/strong>: I made a variant of the above that also copies the certs over. Remember I said I had done this work some months ago? That was for adding certs to some websites hosted internally using Caddy. I couldn&#8217;t use Caddy to get certs as the servers weren&#8217;t public so I used Let&#8217;s Encrypt with Route53 verification. The following variant copies over any updated files to the Caddy certs folder and also restart Caddy so it picks up the new certs.<\/p>\n<pre class=\"lang:default decode:true\">#!\/usr\/bin\/env bash\n\nif [[ -r $1 ]]; then\n  AWS_CONFIG_FILE=$1 \\\n    certbot certonly \\\n      -n -q --agree-tos --email me@rakhesh.com \\\n      --dns-route53 \\\n      --dns-route53-propagation-seconds 30 \\\n      -d $2\nfi\n\nif [[ -d \/etc\/caddy\/certs\/${2} ]]; then\n  # compare if the fullcert chain has changed\n  if (! cmp -s \/etc\/caddy\/certs\/${2}\/fullchain.pem \/etc\/letsencrypt\/live\/${2}\/fullchain.pem); then\n        # if there are changes, copy the file over\n        cp -f \/etc\/letsencrypt\/live\/${2}\/fullchain.pem \/etc\/caddy\/certs\/${2}\/fullchain.pem\n\n        # set ownership to the caddy user\n        chown caddy:root \/etc\/caddy\/certs\/${2}\/fullchain.pem\n        chmod 644 \/etc\/caddy\/certs\/${2}\/fullchain.pem\n\n        # reload caddy\n        systemctl reload caddy\n  fi\n\n  # compare the private key for the cert\n  if (! cmp -s \/etc\/caddy\/certs\/${2}\/privkey.pem \/etc\/letsencrypt\/live\/${2}\/privkey.pem); then\n        # if there are changes, copy the file over\n        cp -f \/etc\/letsencrypt\/live\/${2}\/privkey.pem \/etc\/caddy\/certs\/${2}\/privkey.pem\n\n        # set ownership to the caddy user\n        chown caddy:root \/etc\/caddy\/certs\/${2}\/privkey.pem\n        chmod 644 \/etc\/caddy\/certs\/${2}\/privkey.pem\n\n        # reload caddy\n        systemctl reload caddy\n  fi\nelse\n  mkdir \/etc\/caddy\/certs\/${2}\n  chown caddy:root \/etc\/caddy\/certs\/${2}\n\n  cp -f \/etc\/letsencrypt\/live\/${2}\/fullchain.pem \/etc\/caddy\/certs\/${2}\/fullchain.pem\n  chown caddy:root \/etc\/caddy\/certs\/${2}\/fullchain.pem\n  chmod 644 \/etc\/caddy\/certs\/${2}\/fullchain.pem\n\n  cp -f \/etc\/letsencrypt\/live\/${2}\/privkey.pem \/etc\/caddy\/certs\/${2}\/privkey.pem\n  chown caddy:root \/etc\/caddy\/certs\/${2}\/privkey.pem\n  chmod 644 \/etc\/caddy\/certs\/${2}\/privkey.pem\nfi\n\n# what the options mean:\n# -n            - non-interactive\n# -q            - quiet\n# --agree-tos   - agree to the TOS\n# --email       - email address for any urgent messages\n# --dns-route53 - use route53 as verification option\n# -d            - the domain to verify\n\n\n# list of all the files https:\/\/certbot.eff.org\/docs\/using.html#where-are-my-certificates<\/pre>\n<p>\u00a0<\/p>\n\n","protected":false},"excerpt":{"rendered":"<p>Some months ago I had created some certs on my Pi via Let&#8217;s Encrypt. I forgot to blog about it and today when I wanted to generate some more certs my mind drew a blank. :) I know I had done something in the past as I could see the certs, but I have absolutely &hellip; <a href=\"https:\/\/rakhesh.com\/linux-bsd\/lets-encrypt-on-my-raspberry-pi\/\" class=\"more-link\">Continue reading <span class=\"screen-reader-text\">Let&#8217;s Encrypt on my Raspberry Pi<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","enabled":false}}},"categories":[333,76],"tags":[981,649,932,980,907],"jetpack_publicize_connections":[],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts\/5339"}],"collection":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/comments?post=5339"}],"version-history":[{"count":0,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts\/5339\/revisions"}],"wp:attachment":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/media?parent=5339"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/categories?post=5339"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/tags?post=5339"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}