curl http://nginx.org/keys/nginx_signing.key | sudo apt-key add -
(This adds a key or keys downloaded over an unauthenticated http connection to one's Debian keyring, allowing whatever keys the network sends back to authenticate any future package updates.) I wrote to the author with a note expressing my concern.This does assume that gpg verifies that the key retrieved matches the ID requested, which I assume it does. Otherwise that'd be quite a serious bug.
I'm looking at you Jenkins![0]
[0] https://wiki.jenkins-ci.org/display/JENKINS/Installing+Jenki...
Also, anyone suggesting that this method of downloading and installing software is secure due to its use of HTTPS is incredibly reckless.
I have "alias webserver='python -m SimpleHTTPServer'" in my shell config, but I think I'll switch to Caddy.
As for getting notified if something goes wrong I use the following in my crontab:
10 5 * * * root test -e /usr/local/bin/letsencrypt.sh && /usr/local/bin/letsencrypt.sh -c > /dev/null
letsencrypt.sh outputs errors to stderr, so any errors will be sent to the root account. To get that working, do: apt-get install postfix
echo 'postmaster: root' > /etc/aliases
echo 'root: igor@example.com' >> /etc/aliases
newaliases
Problem solved.Could not they do something nicer with systemd and email?
In my mind, I'm seeing "state of the art" being more like a combo of Ur/Web for apps, robust implementation of OP2 web browser for client, lighttpd rewritten in Haskell, HTTPS component written in SPARK or Rust, all running on GenodeOS or CheriBSD in isolated partitions, C parts compiled with CompCert extended with Softbound + CETS, anti-fuse FPGA doing I/O offloading/mediation, and hardware done in Bluespec. That is state of the art with probably badass results. This submission is... more run of the mill. Immediately useful, though. :)
Here's my notes on setting up LE on IIS if anyone one is interested, it's done by using Powershell/ Package manager.
//1. Install (you will get some security prompts) Install-Module -Name ACMESharp
Import-Module ACMESharp
Initialize-ACMEVault
New-ACMERegistration -Contacts mailto:somebody@example.org -AcceptTos
//2. Request the challange, this is for a website currently running on IIS. 'WebSiteRef ' refers to the name of the site within IIS
New-ACMEIdentifier -Dns demo.velox.io -Alias demo Complete-ACMEChallenge demo -ChallengeType http-01 -Handler iis -HandlerParameters @{ WebSiteRef = 'Demo' }
Submit-ACMEChallenge demo -ChallengeType http-01
//3. Create & download the certificate
New-ACMECertificate demo -Generate -Alias demoCert
Submit-ACMECertificate demoCert
Update-ACMECertificate demoCert
Get-ACMECertificate demoCert -ExportPkcs12 "C:\Users\USER\desktop\demoCert.pfx"
You can now install this on your server.
Add a config.sh and setup nginx alias. Then just add domains to the domains.txt and have the script run via cron daily.
Finished
> sed -i 's|PasswordAuthentication yes|PasswordAuthentication no|g' /etc/ssh/sshd_config
Will not work if string is commented out: > grep PasswordAuthentication /etc/ssh/sshd_config
# PasswordAuthentication yes
> sed -i 's|PasswordAuthentication yes|PasswordAuthentication no|g' /etc/ssh/sshd_config
> grep PasswordAuthentication /etc/ssh/sshd_config
# PasswordAuthentication noHere's the modified script using certonly and the --force-renew flag.
#!/bin/bash
# Force-renew the "Let's Encrypt" certificates for a given domain
# Run this as root as a BI-MONTHLY cron job
export DOMAINS="yourdomain.com,www.yourdomain.com"
export LOGFILE="/var/log/letsencrypt/renewal_yourdomain.log"
echo "Stopping nginx temporarily to renvew certificates for $DOMAINS ..."
service nginx stop
echo "Calling /opt/letsencrypt/letsencrypt-auto certonly --standalone --force-renew -d $DOMAINS"
if ! /opt/letsencrypt/letsencrypt-auto certonly --standalone --force-renew -d $DOMAINS > $LOGFILE 2>&1 ; then
echo "certonly call failed, restarting nginx"
service nginx start
echo "LOG info:"
cat $LOGFILE
# TODO: email administrator...
exit 1
fi
echo "certonly call succeeded, restarting nginx"
service nginx start
Note: don't run this as a daily cron job since this has --force-renew...Besides, the official script is just one part of the project; the others are (1) free certs and (2) a standard protocol, which you can use with other tools.
It's made me think we should have a Swagger or API Blueprint of the spec on github that everyone can keep up to date. What do you think?
The former is documented in the ACME specification[1], currently being worked on by the IETF. There are many low-level ACME libraries for basically every language[2], and a pretty decent guide on writing your own client as well[3].
[1]: https://ietf-wg-acme.github.io/acme/
[2]: https://github.com/letsencrypt/letsencrypt/wiki/Links#librar...
/opt/letsencrypt/letsencrypt-auto certonly --rsa-key-size 4096 --server https://acme-v01.api.letsencrypt.org/directory -a webroot --webroot-path=$DIR -d $DOMAINS
...and using the secp384r1 curve for ECDHE key exchange: # in your nginx.conf
ssl_ecdh_curve secp384r1;
Arguably, the real state of the art is to use an ECDSA certificate. Let's Encrypt recently started supported them, they offer a equivalent level of security to RSA at much lower bit lengths (a 384 bit ECDSA key is considered equivalent to a 7680 bit RSA key) and a few recent TLS vulnerabilities (like DROWN) have targeted implementation details of RSA.I also recommand https://sslcatch.com which sends you a warning email if your certificate is about to expire. I have a crontab to renew it but this can be also helpful just in case.
Wrote about the process here: https://clay.fail/posts/hip-http2-using-docker/