Setting up Dehydrated

challenge types http-01 and dns-01

Introduction

we want to allow legacy/non-ECC SSL clients (e.g. slackware.com and orange.fr outbound MTAs) to connect so we’re keeping RSA as a default. However we’re also providing ECDSA as an alternative with far more ciphers to offer as a result.

Install

binaries

apt install dehydrated
#dehydrated-apache2

from source

git clone https://github.com/lukas2511/dehydrated.git

ls -lhF /usr/local/bin/dehydrated #noexist
cp dehydrated/dehydrated /usr/local/bin/
dehydrated -h

Challenge HTTP-01

mkdir -p /etc/dehydrated/
vi /etc/dehydrated/config

IP_VERSION=4
CA="https://acme-v02.api.letsencrypt.org/directory"
CHALLENGETYPE="http-01"
WELLKNOWN="/var/www/dehydrated"
#WELLKNOWN="/var/www/html/.well-known/acme-challenge"
CONTACT_EMAIL=...

#KEY_ALGO=prime256v1
#KEY_ALGO=secp384r1
#KEY_ALGO=rsa

prepare the shared folder for HTTP-01 challenges

mkdir -p /var/www/dehydrated/
echo ok > /var/www/dehydrated/ok.txt
#mkdir -p /var/www/html/.well-known/acme-challenge/
#echo ok > /var/www/html/.well-known/acme-challenge/ok.txt

this goes in conjunction with an all vhosts setting we define in nginx.conf.

check remotely that you are well known on the clear-text web

from your workstation

curl -I http://pub.nethence.com/.well-known/acme-challenge/ok.txt

Challenage DNS-01

cd /root/
wget https://raw.githubusercontent.com/sebastiansterk/dns-01-manual/master/hook.sh
chmod +x hook.sh

vi /etc/dehydrated/config-dns01

IP_VERSION=4
CA="letsencrypt"
CHALLENGETYPE="dns-01"
DOMAINS_TXT="${BASEDIR}/domains-dns01.txt"
HOOK=/root/hook.sh
CONTACT_EMAIL=...

Ready to go

accept the terms and attempt to get your CSR signed

    dehydrated --register --accept-terms
    find /etc/dehydrated/accounts/
    cd /etc/ssl/

yet another certificate with

    KEY_ALGO=rsa

dealing with http-01

vi /etc/dehydrated/domains.txt

DOMAIN.TLD
HOST.DOMAIN.TLD
OTHERDOMAIN.TLD

mkdir -p /etc/dehydrated/certs/ECC/
dehydrated --cron
dehydrated --cron --algo prime256v1 --out /etc/dehydrated/certs/ECC
dehydrated --cleanup

dealing with dns-01

vi /etc/dehydrated/domains-dns01.txt

*.DOMAIN.TLD > DOMAIN_TLD

mkdir -p /etc/dehydrated/certs/ECC/
dehydrated --config /etc/dehydrated/config-dns01 --cron
dehydrated --config /etc/dehydrated/config-dns01 --cron --algo secp384r1 --out /etc/dehydrated/certs/ECC
dehydrated --cleanup

and edit your zone accordingly.

You are now ready to use those CA-signed certs with e.g. NGINX, Postfix and Dovecot.

Automation for http-01

DON’T FORGET TO RELOAD THE DAEMONS E.G.

draft: is reload enough incl. for dovecot?

vi /root/RELOAD-SSL

#!/bin/bash
# is reload enough?
/usr/local/sbin/nginx -s reload && echo nginx reloaded
/usr/sbin/postfix reload && echo postfix reloaded
/usr/sbin/dovecot reload && echo dovecot reloaded

chmod +x /root/RELOAD-SSL

and simply run the thing in a cron job ONCE A WEEK

# not sure at what time this is executed
#vi /etc/cron.weekly/dehydrated

vi /root/WEEKLY

...
/usr/local/bin/dehydrated --cron --keep-going && /root/RELOAD-SSL
/usr/local/bin/dehydrated --cron --keep-going --algo prime256v1 --out /etc/dehydrated/certs/ECC && /root/RELOAD-SSL
# --cleanup
# --force

choose a nice time of yours and don’t tell anyone (just in case somebody is doing something nasty with the network…

crontab -e

XX X * * 0 /root/WEEKLY 2>&1

Moar fine-tuning

dealing with self-made curve?

    dehydrated --signcsr $domain.csr --full-chain > $domain.crt

Resources

Dehydrated: a bash client for Let’s Encrypt https://www.aaflalo.me/2016/09/dehydrated-bash-client-lets-encrypt/

WELLKNOWN https://github.com/lukas2511/dehydrated/blob/master/docs/wellknown.md

WELLKNOWN documentation gives conflicting statements #193 https://github.com/lukas2511/dehydrated/issues/193

Dehydrated и Let’s Encrypt https://sysadmin.pm/dehydrated-letsencrypt/

I can not renew a certificate (dehydrated) https://community.letsencrypt.org/t/i-can-not-renew-a-certificate-dehydrated/77487

dns-01

https://github.com/dehydrated-io/dehydrated/blob/master/docs/examples/domains.txt

https://serverfault.com/questions/750902/how-to-use-lets-encrypt-dns-challenge-validation https://github.com/dehydrated-io/dehydrated/blob/master/docs/dns-verification.md https://github.com/dehydrated-io/dehydrated/wiki https://community.letsencrypt.org/t/dns-01-problem-with-dehydrated/116338 https://www.aaflalo.me/2017/02/lets-encrypt-with-dehydrated-dns-01/ https://blog.znedw.com/lets-encrypt-wildcard-nsd.html