Let's Encrypt (now with DNS verification)

[stitch]

Howdy FreeNAS folks!

I'd like to ask if the acme.sh script could be integrated into FreeNAS for simple setup and refreshing of Let's Encrypt certificates?

https://github.com/Neilpang/acme.sh

The script allows you to keep your NAS well away from facing the internet and uses DNS verification to validate that you requested the certificate. It works with a variety of cloud providers DNS APIs out of the box. It would just require slapping a GUI on it and running a CRON job to refresh it every 60 days.

The script supports FreeBSD out of the box.

Cheers!

 

[garm]

Please create a feature request out of this, would save me a Tuesday evening every 90 days!!

 

[tmueko]

Why don't you just download it into somewhere on your zpool?

cd /mnt/POOL/DATASTORE/...
git clone https://github.com/Neilpang/acme.sh
./acme.sh/acme.sh -h


 

[danb35]

https://forums.freenas.org/index.php?resources/lets-encrypt-with-freenas-11-1-and-later.82/

Edit: This doesn't, of course, do anything about getting LE support into the FreeNAS GUI, but it does at least address @garm's concern about needing to manually renew every few months.

The problem that I see with including it in the GUI (and I've mentioned this in a few threads now) is one of consistency. Many (most?) DNS hosts don't have a public API at all. Of those that do, only a (relatively) few are supported by acme.sh. Of those, the credentials required are all different--between those three issues, coming up with an implementation that would be broadly applicable, and still easy to use*, seems like it would be tricky. An additional problem is that, in almost all cases, the API credentials are far too powerful; if an attacker were able to compromise them, he'd have full control over your entire domain's DNS (even the ability to steal your domain).

If iX were willing to host their own acme-dns instance, though, that could accomplish something. It would still require one, one-time manual DNS adjustment by the user (set up a CNAME from _acme-challenge.freenas.yourdomain.tld to something like e09eabd6-5ff6-480e-8b60-340484c5f67c.auth.ixsystems.com), and it would expose users to a risk of misissuance (for that FQDN only) if iX were either to be compromised or go rogue, but it would be something that could be standardized in the FreeNAS install, and the infrastructure demands on iX shouldn't be excessive.

* I guess a solution that would cover all the supported DNS hosts, but not be easy to use, would be to just have a text box where the user enters the appropriate credentials in the format acme.sh expects, like:

Code:

CF_Key="fairugrewiervhq4985ghaperv"
CF_Email="me@example.com"

 

[seedz]

there's always the nginx reverse proxy method, that i finally got working again under 11.2 in there (meaning, i finally found some time to search) :
https://forums.freenas.org/index.php?threads/11-2-web-gui-doesnt-work-behind-a-reverse-proxy.63781/