Let’s Encrypt is a new certificate authority backedby Mozilla, Akamai, EFF, Facebook and others, which provides free, automatedSSL/TLS certificates. The public beta started on December 3, 2015 and a whole lot of certificates have been issued already:

Several clients to automate issuing, renewing and revoking certificates have been released both by the community and the Let’s Encrypt team. This post is an overview and comparison of 10 popular Let’s Encrypt clients:

• letsencrypt-auto, the official Let’s Encrypt client
• acme-tiny, a tiny semi-automatic Python implementation
• gethttpsforfree.com, a static website to assist the manual process
• simp_le, another Python implementation
• letsencrypt-nosudo, the predecessor of acme-tiny and gethttpsforfree
• acmetool, an ACME client in Go
• lego, an ACME client and library written in Go
• letsencrypt.sh, a Bash ACME client implemenation
• acme, ACME implementation in PHP
• lescript, a PHP library

Jun 18, 2020 That's why emacsclient lets you run Emacs as a daemon and connect to it as a client, negating the startup time and letting you jump directly into editing. The two primary ways of getting Emacs onto your Mac are by either downloading it from Emacs For MacOS X or by installing it through homebrew using brew cask install emacs. Nov 05, 2020 SSL.com customers can now use the popular ACME protocol to request and revoke SSL/TLS certificates. ACME (Automated Certificate Management Environment) is a standard protocol for automated domain validation and installation of X.509 certificates, documented in IETF RFC 8555. As a well-documented standard with many open-source client.

ACME

The Automated Certificate Management Environment (ACME)protocol defines a way of automatically obtaining trusted certificateswithout human intervention. First, the control of a domain has to be proven,then the agent can request, renew and revoke certificates:

Certificates issued by Let’s Encrypt are valid for 90 days, and are expected to be renewed automatically. More background information can be found on the Let’s Encrypt - How It Works page.

At the time of writing, these rate limits has been in place:

• 10 Registrations per IP per 3 hours
• 5 Certificates per Domain per 7 days (incl. subdomains)

SSL Certificates & Signing

Obtaining a valid SSL certificate generally includes the following steps:

1. You create a private and public key pair on the server.
2. You create a Certificate Signing Request (CSR) which includes the domain name, organization name, the public key, and other information. The CSR is signed with your private key.
3. You send the CSR to the certificate authority (in this case Let’s Encrypt).
4. The certificate authority signs the request, thus producing a public certificate.
5. You use the public certificate in your webserver.

For more information on configuring a webserver with certificates, check out these links:

• cipherli.st - Example configuration for Apache, nginx and Lighttpd

These tests are going to obtain a certificate for a domain such as www.example.comand setting up automatic certificate renewal.

Domain ownership verification requires the ACME server being able to access a specific fileon the domain. To accomplish this, we assume a webserver is running and servesfiles from /var/www/htdocs/ (the webroot) and it’s subdirectories. For instance, a file at /var/www/htdocs/.well-known/acme-challenge/8303 should be accessible via www.example.com/.well-known/acme-challenge/8303.

Official Let’s Encrypt Client

• github.com/letsencrypt/letsencrypt
  • 4,355 commits, 131 contributors
• Mode: Automatic / Interactive / Manual
• License: Apache 2.0
• Language: Python
• Lines of code: 8,612 (core), ~16,000 (total)
• Dependencies: many

The official Let’s Encrypt client, letsencrypt-auto, isa heavyweight, fully automated Python program with various modes of operation and installers (for instance to automagically update Apache and nginx configurations).

The standard client automatically installs various system dependencies via the standard package manager (see the source code and /bootstrap/), and sets up a virtualenv witha number of Python dependencies. The client is also available as a Docker image,which avoids the necessity to install packages system-wide.

In case of an error (eg. the ACME server is not reachable), the official client gracefully terminates with an info message.

The official Let’s Encrypt client also supports config files, which may beeasier to automate with a cronjob (see this postfor more infos).

• Official client, active community
• Well documented, and well tested
• Can do a lot of things, including server configs (experimental!)
• Accessible for non-technical users
• Complex program, many moving parts, hard to review
• Runs as root and installs dependencies without asking

Standard Installation

Obtaining a certificate

To obtain a certificate without stopping a running webserver, we are going to use the webroot method, whichonly requires write access for the webroot to save the authentication file.

This command creates the private and public keys, generate a certificate signing request, get the challenge from the ACME server, saves it to the webroot, and downloads the signed certificate in /etc/letsencrypt/live/example.com/. The processis fully automated and results in the certificate and private key, ready to be used by your webserver.

Alternatively the offial Let’s Encrypt client includes a manual plugin, whichcan generate a certificate from another computer than the webserver(akin to gethttpsforfree.com or letsencrypt-nosudo).You can run this plugin with the command ./letsencrypt-auto certonly --manual.

Renewal

To renew certificates automatically, simply add the --renew parameter to the above command:

acme-tiny

• github.com/diafygi/acme-tiny
  • 55 commits, 11 contributors
• Mode: Automatic / Semi-Automatic
• License: MIT
• Language: Python
• Lines of code: ~200
• Dependencies: None

Acme-tiny is a tiny Python script which assists with issuing and renewing certificates. You generatethe private key and create a certificate signing request (CSR) manually, and acme-tiny handles the rest (submitting the CSRto the ACME server, receiving the authentication files, putting it in the acme-challenge folder and receiving the final certificate). The output of this script is the signed certificate.

• Documentation (in the README)
• Super simple, no dependencies
• Easy to embed in custom Python application

Installation

Obtaining a certificate

At this point chained.pem contains the signed certificate chain and, along with domain.key, can be used to run a http server(more infos).

Renewal simply requires running this script again with the same parameters.

gethttpsforfree.com

• github.com/diafygi/gethttpsforfree
  • 70 commits, 10 contributors
• Mode: Semi-Manual
• License: MIT
• Language: HTML & JavaScript
• Lines of code: 1228 JS, 443 HTML

gethttpsforfree.com is a website which helps users to manually generate all the necessary information to create a certificate signing request (CSR), guiding a user through the whole ACME process:

Homebrew Web

1. Manually create a public and private key.
2. Manually create a certificate signing request (CSR).
3. Manually sign a number of requests with the private key.
4. Manually verify ownership by serving the signed requests (either through an existing webserver or a simple Python webserver).
5. The website tells the ACME server to check for the verifications, and in case of success provides you with the signed certificate.

The website provides OpenSSL commands at each step, and waits for the output of the commands to be pasted back into the website to verify the success. The website never asks for any kind of private key. It can be saved and used locally without any server side logic.

• Works as advertised
• Static site allows to save and use later

simp_le

• github.com/kuba/simp_le
  • 112 commits, 9 contributors
• Mode: Fully or Semi-Automatic
• License: GPLv3
• Language: Python
• Lines of code: 775 Python, 126 Shell Script, 41 YAML
• Dependencies: Some

simp_le is an ACME client written in Python. It works similar to acme-tiny, but canalso generate the private key and CSR automatically. Requires a small number of dependencies to be installed.

Installation

Os-acme-client (Let's Encrypt) - HTTP-01 Validation Not ...

Obtaining a certificate

On success, this command produces 4 files: account_key.json, cert.pem, fullchain.pem and key.pem,which can be used from your webserver’s SSL configuration (see here for an example integration in Apache).

Renewal works by using the same command.

Exit codes:

• 0 if certificate data was created or updated;
• 1 if renewal not necessary;
• 2 in case of errors.

letsencrypt-nosudo

• github.com/diafygi/letsencrypt-nosudo
  • 45 commits, 5 contributors
• Mode: Manual (assisted)
• License: AGPL
• Language: Python
• Lines of code: 400
• Dependencies: None

This program is a predecessor of acme-tiny and functionally equivalent to gethttpsforfree.com (made by the same author). The script guides you through the whole process and ask you do run all the necessary commands in the terminal.

You generate a private key and certificate signing request (CSR), then run sign_csr.py to get the signed certificate. The script goes through the ACME protocol with the Let’s Encrypt certificate authority and outputs the signed certificate to stdout.

Installation

Obtaining a certificate

acmetool

• github.com/hlandau/acme
  • 103 commits, 1 contributors
• Mode: Automatic / Interactive
• License: MIT
• Language: Go
• Lines of code: ~6,000
• Dependencies: None (Binary Release)

acmetool is an ACME client written in Go, supporting automatic domain verification with webroot and standalone methods as well as an interactive wizard. acmetool stores credentials and certificates at /var/lib/acme/live/HOSTNAME/{cert,chain,fullchain,privkey} by default and includes support to import certificates from the official client.

Homebrew-Cask

acmetool furthermore provides a reconcile option which makes sure all desired hostnameshave valid certificates which don’t expire soon.

Installation

You can either get a binary release, or build from source as described in the Readme:

Obtaining a certificate

You need to set the webroot to /var/run/acme/acme-challenge as describedin the docs, or use the proxy method. The command acmetool want tries all available methods.

lego

• github.com/xenolf/lego
  • 162 commits, 4 contributors
• Mode: Automatic
• License: MIT
• Language: Go
• Lines of code: ~2,000
• Dependencies: None (Binary Release)

Lego is an ACME library and standalone application written in Go. It can be downloaded asa binary release or build by yourself.

Running the standalone version requires the permission to bind to port 80 and 443,which conflicts with a webserver which is already running.

Installation

Obtaining a certificate

letsencrypt.sh

OPNsense 20.7.7 Released

• github.com/lukas2511/letsencrypt.sh
  • 111 commits, 6 contributors
• Mode: Automatic
• License: Unspecified
• Language: Shell Script (Bash)
• Lines of code: ~600 (Bash)
• Dependencies: None / OpenSSL, curl, sed

Installation

Obtaining a certificate

Create a file called domains.txt which contains the domains and subdomains you want togenerate certificates for:

This requests two certificates, for example.com and example.net. The other domains in the corresponding line are their alternative names.

letsencrypt.sh writes the challenge files by default into the directory '${SCRIPTDIR}/.acme-challenges'. To adjust this to your webroot, you need to create a config file (config.sh) with another $WELLKNOWN path (see config.sh.example):

Then simply run letsencrypt.sh (⇾ show output).

acme-client

• github.com/kelunik/acme-client
  • 3 commits, 1 contributors
• Mode: Automatic
• License: MIT
• Language: PHP (7)
• Lines of code: ~400
• Dependencies: Few

acme-client is an ACME client written in PHP, built on top of the acme PHP library by the same author.

It requires PHP 7 and composer to install it’s dependencies.

Installation

Obtaining a certificate

See Full List On Docs.microsoft.com

lescript

• github.com/analogic/lescript
  • 3 commits, 1 contributors
• Mode: Automatic
• License: BSD
• Language: PHP
• Lines of code: ~450
• Dependencies: PHP 5.4.8+ with OpenSSL and curl extension

lescript is a very simplistic PHP ACME client library, with an example CLI wrapper.

Installation

Author Topic: Trouble With Letsencrypt

Obtaining a certificate

Use the library as shown in _example.php.

If you have suggestions or feedback, please let me know via @metachris.