Hacker News Reader

Comment by diafygi | Hacker News Reader

FYI, if you don't want to install the official Let's Encrypt client on your production server, I created a simple python script that will automate the ACME process for you. It doesn't have to run on your server, and it doesn't ask for your private keys.

https://github.com/diafygi/letsencrypt-nosudo

The only thing that has to be run as sudo on your production server is a simple python one-liner that temporarily serves the required file. The script prints out this one-liner so you can copy and paste it into your server's terminal, then kill it when the challenge is done.

View on HN

How is this different from/superior to Let's Encrypt's built-in "standalone authenticator"? [0]

[0] https://github.com/letsencrypt/lets-encrypt-preview/blob/mas...

The standalone authenticator still requires (1) installing/running the letsencrypt client on your production server, (2) letting it run as root, and (3) letting it access your private keys. My script requires none of these things.

I would add that it's also easier to understand. I've been having a lot of trouble figuring out ACME's workflow. This has been pretty helpful.

Thanks for this.

I would like to use this service, but I do not want a program to do things for me on my server unless it's part of the OS distribution, so this will help.

Why do you need sudo to serve a file though? Is it a restricted port?

Hopefully the Let's Encrypt client will be part of most server operating systems in the future, too!

Reading the code, it seems the file is served on port 443 (HTTPS).

The overview speaks of a "here's my key!" / "you are registered!" step that letsencrypt-nosudo doesn't seem to have. It seems that your first communication with the CA is during step 2 (requesting challenges). Does this affect your script's ability to do things like subject alternative names?

This script takes certificate signing requests (CSR) as input. If you want a subject alternative name, it's up to you to add that to your CSR file before you run the script.

The official Let's Encrypt client is mostly focused on ease of use. This script is mostly focused on not knowing your secrets or requiring privileged access, and it assumes you know what a CSR is and how to install a signed certificate on your webserver.

Does your script support doing the DVSNI challenge instead, to avoid needing to install a file on the web server?

It used to, but that meant you had to scp the generated dvsni cert to your server[1], which is more complex than asking the user to start serving a string over a specific url (which is what the SimpleHTTP challenge requires).

[1]: https://github.com/diafygi/letsencrypt-nosudo/blob/9607deb7b...

Strikes me you could also go through the process using letsencrypt in a container (eg Docker on Linux) and extract the results.

This is a good idea, but the docker daemon runs as root so it's at least theoretically possible to break out of the container and start messing with the host, as root.

As is said in the post:

> the address of the CA is hardcoded in the program so be sure to use the official lets-encrypt

Now, the idea of a nosudo letsencrypt is a good idea, but if such a thing should exist it should be made on the officiel repo and audited like lets encrypt was (note that this is just my opinion).

This script is less than 400 lines of code. Please, read through it! Would love for someone else to audit it or submit bugs!

Reply on news.ycombinator.com