j-c-m / ubnt-letsencrypt Goto Github PK

add firewall rules for Let's Encrypt

Can you add support for 2.x.x?

Trying to set this up on my Edgerouter following the readme.

Initially, when trying to verify, I got the following error:
x.x.x:Verify error:DNS problem: NXDOMAIN looking up A for x.x.x - check that a DNS record exists for this domain

Then I added the following DNS entry to my domain
Name Type Content TTL x.x.x A <public ip> 24h

After waiting a few hours for it to propagate, I tried again getting the following error:
x.x.x:Verify error:Invalid response from http://x.x.x/.well-known/acme-challenge/yTbuZSbFz5iZbzkuegIMEnARPTLQZhlPzg-a4qUvtkw [x.x.x.x]: Please add '--debug' or '--log' to check more details. See: https://github.com/acmesh-official/acme.sh/wiki/How-to-debug-acme.sh

cat /config/.acme.sh/lighttpd.log
outputs nothing, so the log seems to be empty

THANK YOU. This worked great on my EdgeRouter.

I did run into one hiccup and that is the FQDN you use MUST be associated with an A record. It will NOT work with a CNAME record. I had a CNAME record established because my primary DNS provider doesn't support the dyndns protocol for dynamic IP updates. I had to delete that and create an A record. May be worth mentioning this in the README.

One other suggestion is to start at the top by saying all of these commands are to be performed on the EdgeRouter. I was initially confused as to if I could / should run the Install acme.sh & scripts portion on my computer.

A question: does the hostname need to continue to resolve externally in order for this to continue to work? What happens if the A record is deleted, or replaced with a CNAME record? Or if the IP address on the A record no longer matches the IP address of the EdgeRouter?

Thanks for the script and associated process. I'm using and EdgeRouter X.

I've learned that the lighttpd.pid file either at /var/run or /run may not have valid content. This causes the script to hang.

I did a quick tweak to use pidof "lighttpd" to kill the running GUI.

Hi Jesse,

Full of enthousiasm I started with this today, of course forgetting to make a fresh system backup before proceeding ;-).

After the first line already I was no longer able to connect to my EdgeRouter's LAN interface via HTTPS, Connection refused. I thought it had to do with not completing the entire process, since I hadn't gotten any errors.

But even after going through the entire thing, I am still not able to connect to HTTPS on the LAN side, still connection refused. I do still have access via SSH, so I can still edit the config.

This entire thing is on me, I don't think there's any real issues with your process, but, can you point out what I should edit in my config to revert the entire process? Or should I forget about that entirely and try restoring a backup?

Any help would be greatly appreciated!

Best regards,
Erik

Great Tool by the way worked like a champ. My question is such, I registered the subdomain as "edgerouter.foo.org", which worked. But now I would like to register not only "edgerouter.foo.org" but also "edgerouter" & the IP of the router. Can I do that? If so, do I have to uninstall? If not what commands to have clear out?

Much thanks!

I've verified that I've set my DNS to my WAN IP, but am now getting caught up on I assume a firewall:

[Fri May  5 21:49:19 PDT 2017] The new-authz request is ok.
[Fri May  5 21:49:20 PDT 2017] Verifying:router.roomj.com
[Fri May  5 21:49:24 PDT 2017] Pending
[Fri May  5 21:49:26 PDT 2017] Pending
[Fri May  5 21:49:29 PDT 2017] router.roomj.com:Verify error:Could not connect to router.roomj.com
[Fri May  5 21:49:29 PDT 2017] Please add '--debug' or '--log' to check more details.
[Fri May  5 21:49:29 PDT 2017] See: https://github.com/Neilpang/acme.sh/wiki/How-to-debug-acme.sh

Hi,

first of all, I'd like to thank you for your great work!

I'd like comment the following statement in README.md, which might be true for most network configurations, but not always.
You can include additional common names for your certificate, so long as they resolve to the same WAN address:

In my opinion, it should read something like this:
You can include additional common names for your certificate, so long as they are configured on any interface of the router, accessible from internet.

I use IPv6 and I have an unique global IPv6 address configured on WAN and LAN interfaces of the router. So I could use WAN and LAN name in the certificate request without any trouble.

Also, static host names are not necessary, as soon as are resolved by configured DNS server.

When running "sudo /config/scripts/renew.acme.sh -d subdomain.example.com -i eth0", I'm getting the following error.

/config/scripts/renew.acme.sh: line 1: 404:: command not found

Running EdgeRouter Lite v1.10.11 and with LAN IP of Router and FQDN in the hosts file on my browsing computer set system static-host-mapping seems to be redundant.
Might help someone.

There's no scripts folder in /config and the README doesn't say to create one. It's confusing because it isn't clear if it should be /configs/.acme.sh/scripts or /configs/scripts until you see it later in the file.

Can this be adapted to work on an EdgeSwitch?

When running the installation command on an EdgeRouter X (v2.0.9-hotfix.7) the following output is generated:

username@gate:~$ curl https://raw.githubusercontent.com/j-c-m/ubnt-letsencrypt/master/install.sh | sudo bash
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   764  100   764    0     0   1133      0 --:--:-- --:--:-- --:--:--  1135
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  216k  100  216k    0     0   295k      0 --:--:-- --:--:-- --:--:--  295k
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  3479  100  3479    0     0   5806      0 --:--:-- --:--:-- --:--:--  5808
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0Warning: Failed to create the file /config/ssl/cacert.pem: No such file or
Warning: directory
  0  216k    0   849    0     0   1068      0  0:03:27 --:--:--  0:03:27  1067
curl: (23) Failed writing body (0 != 849)
username@gate:~$

The folder /config/ssl/ does not exist.

First off, thanks for creating this. I've been looking for a way to automate what has been a difficult task on the Edgerouter.

I believe I have followed your installation and setup instructions explicitly.

root@gw1# sudo /config/scripts/renew.acme.sh -d subdomain.domain.com -i eth0
2017-04-17 02:20:23: (network.c.409) can't bind to port: XX.XX.XX.XX 80 Address already in use 
[Mon Apr 17 02:20:42 EDT 2017] Registering account
[Mon Apr 17 02:20:43 EDT 2017] Registered
[Mon Apr 17 02:20:45 EDT 2017] Update success.
[Mon Apr 17 02:20:46 EDT 2017] ACCOUNT_THUMBPRINT='XXXXXXXXXXXXXXXXXXXXXXXX'
[Mon Apr 17 02:20:46 EDT 2017] Creating domain key
[Mon Apr 17 02:20:52 EDT 2017] Single domain='subdomain.domain.com'
[Mon Apr 17 02:20:53 EDT 2017] Getting domain auth token for each domain
[Mon Apr 17 02:20:53 EDT 2017] Getting webroot for domain='subdomain.domain.com'
[Mon Apr 17 02:20:53 EDT 2017] Getting new-authz for domain='subdomain.domain.com'
[Mon Apr 17 02:20:54 EDT 2017] The new-authz request is ok.
[Mon Apr 17 02:20:55 EDT 2017] Verifying:subdomain.domain.com
[Mon Apr 17 02:20:59 EDT 2017] subdomain.domain.com:Verify error:Invalid response from http://subdomain.domain.com/.well-known/acme-challenge/xQ_TfskOZj9sizeYS7e0WbSAwwxZAh8TVk2m2tGbNWE: 
[Mon Apr 17 02:20:59 EDT 2017] Please add '--debug' or '--log' to check more details.
[Mon Apr 17 02:20:59 EDT 2017] See: https://github.com/Neilpang/acme.sh/wiki/How-to-debug-acme.sh

I am replacing subdomain.domain.com with the FQDN of my router, reachable from the Internet. I did attempt to run --debug on acme.sh. Any thoughts on why this is failing?

How does one restore the working setup after a firmware upgrade? I installed EdgeRouter X v2.0.9-hotfix.4. Afterwards I began getting browser 404 errors when accessing the FQDN. The GUI is still accessible with the local IP, after the inevitable browser cert error complaining the cert was issued for the FQDN, not the IP.

I currently run EdgeRouter ER-X/ER-X-SFP/EP-R6: Firmware v1.10.10 on several devices
Recently the following error is given (with --debug 3) SSL certificate problem: unable to get local issuer certificate

curl is using an out of date cacert.pem for SSL communications

# update to the latest version of the script
curl https://raw.githubusercontent.com/j-c-m/ubnt-letsencrypt/master/install.sh | sudo bash
# get the most recent cacert.pem
sudo curl --insecure https://curl.se/ca/cacert.pem --output /config/ssl/cacert.pem
# make acme.sh use it
echo CA_BUNDLE=\'/config/ssl/cacert.pem\' | sudo tee -a /config/.acme.sh/account.conf

Hope this saves someone some time
mh

Many thanks for your work on this. Very handy and elegant solution.

set system task-scheduler task renew.acme interval 1d

Does this need to be set at 90 days ? or does it check the cert daily to see if it needs renewing ?

I had to make two additional configuration changes before the local lookup of the FQDN for the router would work:

1. Add the "localise-queries" option to the DNS forwarding configuration so that it would look at the static host-name map in /etc/hosts before forwarding to the external nameservers:

   set service dns forwarding options localise-queries

   My configuration is now:

    forwarding {
      cache-size 150
      listen-on switch0
      name-server 8.8.8.8
      name-server 8.8.4.4
      options localise-queries
   }

2. Configure the DHCP server with the router IP address as the only DNS server.

Installed on ER4 and upon initial script run, GUI is shut down, and the script seems to hang. Have to break out and restart GUI manually. Version 1.10.

I tried to run renew.acme.sh to get a new certificate before going on vacation for an extended time. It gave me an error about it not being due (which is correct) and suggested that I use '--force' to proceed.

I am unable to get this argument to work. It doesn't work at the start or the end of the command argument list.

[Sat Sep 29 18:51:19 CDT 2018] Stopping GUI service.
[Sat Sep 29 18:51:21 CDT 2018] Starting temporary ACME challenge service.
[Sat Sep 29 18:51:24 CDT 2018] Domains not changed.
[Sat Sep 29 18:51:24 CDT 2018] Skip, Next renewal time is: Wed Oct 31 05:26:25 UTC 2018
[Sat Sep 29 18:51:24 CDT 2018] Add '--force' to force to renew.
[Sat Sep 29 18:51:24 CDT 2018] Stopping temporary ACME challenge service.

sudo /config/scripts/renew.acme.sh -d mydomain.com -d additionaldomain.com -d additionaldomain.com -d additionaldomain.com --force -i eth0 /config/scripts/renew.acme.sh: illegal option -- - Usage: /config/scripts/renew.acme.sh -d <mydomain.com> [-d <additionaldomain.com>]
I wish to do this as I haven't yet automated the updating of some of the additionaldomain.com jails and have to perform the movement manually.

This isn't an issue, I just wanted to say thank you - this worked flawlessly and under 5 minutes start to finish.
Thanks for the repo and instructions!

Installing newly on an Edgerouter:

$ sudo /config/scripts/renew.acme.sh -d router.example.org
[Fri Oct 18 22:35:09 EDT 2019] Stopping GUI service.
[Fri Oct 18 22:35:34 EDT 2019] Starting temporary ACME challenge service.
It seems that you are using sudo, please read this link first:
https://github.com/Neilpang/acme.sh/wiki/sudo
[Fri Oct 18 22:35:34 EDT 2019] Stopping temporary ACME challenge service.
[Fri Oct 18 22:35:35 EDT 2019] Starting GUI service.

Adding --force to the acme.sh invocation fixes it, but feels like a blunt hammer.

I think I've followed all the instructions correctly, but I'm getting:

[Fri May  5 21:10:51 PDT 2017] The new-authz request is ok.
[Fri May  5 21:10:51 PDT 2017] Verifying:router.roomj.com
[Fri May  5 21:10:55 PDT 2017] router.roomj.com:Verify error:No valid IP addresses found for router.roomj.com
[Fri May  5 21:10:55 PDT 2017] Please add '--debug' or '--log' to check more details.
[Fri May  5 21:10:55 PDT 2017] See: https://github.com/Neilpang/acme.sh/wiki/How-to-debug-acme.sh
[Fri May  5 21:10:57 PDT 2017] Stopping temporary acme challenge service.
[Fri May  5 21:10:58 PDT 2017] Starting gui service.

However, my IP address does appear to be configured correctly:

me@ubnt# host -t a router.roomj.com
router.roomj.com has address 192.168.1.1

Thank you for this solution!

[Thu Apr 22 16:01:54 EDT 2021] Verifying: x.x.com [Thu Apr 22 16:01:58 EDT 2021] x.x.com:Verify error:Invalid response from http://x.x.com/.well-known/acme-challenge/qWnOyp_vXMXpRdTI2nv1v4NKFfXw2IL_oWjxiTD8WRo [x.x.x.x]: [Thu Apr 22 16:01:58 EDT 2021] Please add '--debug' or '--log' to check more details. [Thu Apr 22 16:01:58 EDT 2021] See: https://github.com/acmesh-official/acme.sh/wiki/How-to-debug-acme.sh [Thu Apr 22 16:01:59 EDT 2021] Stopping temporary ACME challenge service.

[Fri Mar 17 08:16:56 PDT 2017] The nc doesn't support '-4', '-6' or local-address, please install 'netcat-openbsd' and try again.
[Fri Mar 17 08:16:56 PDT 2017] See https://github.com/Neilpang/acme.sh/wiki/Install-preparations

My certificate initialization fails further down but I think that's because my firewall rules are blocking, but I don't know if this nc issue is related.

[Thu Apr 1 10:19:40 UTC 2021] home.domain.com:Verify error:No valid IP addresses found for home.domain.com
[Thu Apr 1 10:19:40 UTC 2021] Please add '--debug' or '--log' to check more details.
[Thu Apr 1 10:19:40 UTC 2021] See: https://github.com/acmesh-official/acme.sh/wiki/How-to-debug-acme.sh

Hi and thank you for this script!

Plainly following the instructions, I ran into No such file or directory errors in context of the reload cmd, since the certificate files ended up being stored at /config/.acme.sh/subdomain.example.com_ecc (note the _ecc suffix) instead of the expected /config/.acme.sh/subdomain.example.com.

Here's the complete output:

$ sudo /config/scripts/renew.acme.sh -d subdomain.example.com
[...]
[Sun Feb  5 18:53:19 CET 2023] Your cert is in: /config/.acme.sh/subdomain.example.com_ecc/subdomain.example.com.cer
[Sun Feb  5 18:53:19 CET 2023] Your cert key is in: /config/.acme.sh/subdomain.example.com_ecc/subdomain.example.com.key
[Sun Feb  5 18:53:19 CET 2023] The intermediate CA cert is in: /config/.acme.sh/subdomain.example.com_ecc/ca.cer
[Sun Feb  5 18:53:19 CET 2023] And the full chain certs is there: /config/.acme.sh/subdomain.example.com_ecc/fullchain.cer
[Sun Feb  5 18:53:20 CET 2023] Run reload cmd: cat /config/.acme.sh/subdomain.example.com/subdomain.example.com.cer /config/.acme.sh/subdomain.example.com/subdomain.example.com.key > /config/ssl/server.pem; cp /config/.acme.sh/subdomain.example.com/ca.cer /config/ssl/ca.pem
cat: can't open '/config/.acme.sh/subdomain.example.com/subdomain.example.com.cer': No such file or directory
cat: can't open '/config/.acme.sh/subdomain.example.com/subdomain.example.com.key': No such file or directory
cp: can't stat '/config/.acme.sh/subdomain.example.com/ca.cer': No such file or directory
[Sun Feb  5 18:53:20 CET 2023] Reload error for :
[Sun Feb  5 18:53:20 CET 2023] Stopping temporary ACME challenge service.
[Sun Feb  5 18:53:21 CET 2023] Starting GUI service.

I temporarily worked around this by symlinking subdomain.example.com to subdomain.example.com_ecc, but of course, this is not a stable solution.

What would you propose to do?

Thank you.

Hi,
seems there's a problem when you domain is handle by CloudFlare. It timeout.

I keep getting these errors when trying to run renew.acme.sh for the first time. I have done with your instructions say and also the closed issue about using this for WAN IP. Is there certain ports that need to be exposed?

[Tue May 30 17:50:43 MDT 2017] Stopping gui service.
[Tue May 30 17:50:43 MDT 2017] Starting temporary acme challenge service.
[Tue May 30 17:50:43 MDT 2017] Unknown parameter : /tmp/server.key
[Tue May 30 17:50:43 MDT 2017] Stopping temporary acme challenge service.
[Tue May 30 17:50:44 MDT 2017] Starting gui service.
2017-05-30 17:50:44: (network.c.537) SSL: BIO_read_filename('/config/ssl/server.pem') failed

Thanks for your help on this issue.

Hi,

when running renew.acme.sh we run into this error:

$ sudo /config/scripts/renew.acme.sh -d *****************************
[Mon Jun 21 13:14:14 CEST 2021] Stopping GUI service.
[Mon Jun 21 13:14:15 CEST 2021] Starting temporary ACME challenge service.
[Mon Jun 21 13:14:18 CEST 2021] Using CA: https://acme.zerossl.com/v2/DV90
[Mon Jun 21 13:14:28 CEST 2021] Create account key ok.
[Mon Jun 21 13:14:28 CEST 2021] No EAB credentials found for ZeroSSL, let's get one
[Mon Jun 21 13:14:28 CEST 2021] acme.sh is using ZeroSSL as default CA now.
[Mon Jun 21 13:14:28 CEST 2021] Please update your account with an email address first.
[Mon Jun 21 13:14:28 CEST 2021] acme.sh --register-account -m [email protected]
[Mon Jun 21 13:14:28 CEST 2021] See: https://github.com/acmesh-official/acme.sh/wiki/ZeroSSL.com-CA
[Mon Jun 21 13:14:28 CEST 2021] Please add '--debug' or '--log' to check more details.
[Mon Jun 21 13:14:28 CEST 2021] See: https://github.com/acmesh-official/acme.sh/wiki/How-to-debug-acme.sh
[Mon Jun 21 13:14:29 CEST 2021] Stopping temporary ACME challenge service.
[Mon Jun 21 13:14:30 CEST 2021] Starting GUI service.

Didn't experience this in the past. Apparently acme.sh has switched to ZeroSSL by default. renew.acme.sh needs to be adjusted to use Lets Encrypt, instead of ZeroSSL.

Thanks,
Christoph

Everytime this runs it kills the GUI on multiple devices. Re-running the script just says port are already in use. I have to reboot the router to fix this. v1.10.1 on the ER's.

Is it possible to change the scripts to retrieve a wildcard certificate?

Cheers
Ola

Here is the command and logs. My domain name and challenge code in the logs are replaced for privacy.

sudo /config/scripts/renew.acme.sh -d mydomain.com
[Mon Aug 3 21:28:24 UTC 2020] Stopping GUI service.
[Mon Aug 3 21:28:25 UTC 2020] Starting temporary ACME challenge service.
[Mon Aug 3 21:28:28 UTC 2020] Single domain='mydomain.com'
[Mon Aug 3 21:28:28 UTC 2020] Getting domain auth token for each domain
[Mon Aug 3 21:28:32 UTC 2020] Getting webroot for domain='mydomain.com'
[Mon Aug 3 21:28:33 UTC 2020] Verifying: mydomain.com
[Mon Aug 3 21:28:38 UTC 2020] Pending
[Mon Aug 3 21:28:41 UTC 2020] Pending
[Mon Aug 3 21:28:45 UTC 2020] mydomain.com:Verify error:Fetching http://mydomain.com/.well-known/acme-challenge/[my-challenge-code]: Timeout during connect (likely firewall problem)
[Mon Aug 3 21:28:45 UTC 2020] Please add '--debug' or '--log' to check more details.
[Mon Aug 3 21:28:45 UTC 2020] See: https://github.com/acmesh-official/acme.sh/wiki/How-to-debug-acme.sh
[Mon Aug 3 21:28:46 UTC 2020] Stopping temporary ACME challenge service.
[Mon Aug 3 21:28:47 UTC 2020] Starting GUI service.

The script gets as far as this. I also had to edit the acme script to include my email address.

[Wed Aug 9 18:49:18 AEST 2017] host:Verify error:Fetching http://host/.well-known/acme-challenge/S9_83SABeIYOQaHZ6xHo4L3BGkfoMgcLffgjm_Cc22o: Timeout
[Wed Aug 9 18:49:18 AEST 2017] Debug: get token url.
[Wed Aug 9 18:49:18 AEST 2017] GET
[Wed Aug 9 18:49:18 AEST 2017] url='http://host/.well-known/acme-challenge/S9_83SABeIYOQaHZ6xHo4L3BGkfoMgcLffgjm_Cc22o'
[Wed Aug 9 18:49:18 AEST 2017] timeout='1'
[Wed Aug 9 18:49:18 AEST 2017] _CURL='curl -L --silent --dump-header /config/.acme.sh/http.header --connect-timeout 1'
[Wed Aug 9 18:49:18 AEST 2017] Please refer to https://curl.haxx.se/libcurl/c/libcurl-errors.html for error code: 7
[Wed Aug 9 18:49:18 AEST 2017] ret='7'
[Wed Aug 9 18:49:18 AEST 2017] Debugging, skip removing: /config/.acme.sh/webroot/.well-known
[Wed Aug 9 18:49:18 AEST 2017] pid

Looks great. Thanks for doing it. I plan to try it later or tomorrow for LAN. Do you foresee any issues doing the same for WAN access? I assume I can just swap in the external public IP address?