Package: letsencrypt-remote
letsencrypt-remoteWarningletsencrypt-remote has been renamed tocertsling.
Install that package for further updates.An opinionated script to sign tls keys vialetsencrypton your local computer by forwarding the HTTP challenge via ssh.InstallationBest installed viapipsi:% pipsi install letsencrypt-remoteOr some other way to install a python package with included scripts.RequirementsYou need anopensslexecutable in your path for key generation and signing.Testing with staging serverWith the-soption you can use the staging server ofletsencrypt.
This is advised, so you don’t run into quota limits or similar until your setup works.
The resulting certificate won’t validate, but otherwise has the same content as a regular certificate.Basic usageCreate a directory with the email address as the name, which you want to use for authentication with letsencrypt.
For examplewebmaster@example.com:% mkdir webmaster@example.comCreate a ssh connection to your server which forwards a remote port to the local port8080:% ssh root@example.com -R 8080:localhost:8080On your server the webserver needs to proxy requests toexample.com:80/.well-known/acme-challenge/*to that forwarded port.
An example for nginx:location /.well-known/acme-challenge/ {
    proxy_pass http://localhost:8080;
}From the directory you created earlier, invoke theletsencrypt-remotescript with for example:% cd webmaster@example.com
% letsencrypt-remote example.com www.example.comOn first run, you are asked whether to create auser.keyfor authorization with letsencrypt.After that, challenges for the selected domains are created and a server is started on port8080to provide responses.
Your remote web server proxies them through the ssh connection to the locally running server.If all went well, you get a server key and certificate in a newexample.comfolder:% ls example.com
...
example.com-chained.crt
example.com.crt
example.com.keyTheexample.com-chained.crtfile contains the full chain of you certificate together with the letsencrypt certificate.Advanced usageTo use DNS based authentication, you need to havesocaton your server.
Additionally you need to setup your DNS, so it delegates_acme-challengerequests to your server.
For that you can add something similar to this to your zone file or equivalent:_acme-challenge IN NS www
_acme-challenge.www IN NS wwwFor the forwarding, you need to add port8053::
Create a ssh connection to your server which forwards a remote port to the local port8080:% ssh root@example.com -R 8080:localhost:8080 -R 8053:localhost:8053Then in that ssh session, run the following to forward UDP port53to TCP on port8053:# socat -T15 udp4-recvfrom:53,reuseaddr,fork tcp:localhost:8053Forletsencrypt-remoteyou need to add the–dns`option:% letsencrypt-remote --dns example.com www.example.comIt will then first try the HTTP challenge and if that fails it will try the DNS challenge.Changelog0.7.0 - 2016-12-30Renamed tocertsling.
[fschulze]Use symmetric difference inverify_domains. This catches problems due to
typos in domain names and some other cases.
[solidgoldbomb]Update list of issuer names checked inverify_crt.
[solidgoldbomb (Stacey Sheldon)]More detailed error reporting.
[fschulze]Ask to agree to terms of use of letsencrypt and allow updating the registration.
[fschulze]0.6.0 - 2016-05-09Upgrade to new X3 authority.
[fschulze]0.5.0 - 2016-02-12Allow selection of letsencrypt.org staging server with-soption.
[fschulze]0.4.1 - 2016-01-29Fix issue that the-chained.crtfile wasn’t updated.
[fschulze]0.4.0 - 2016-01-12Initial release
[fschulze]