Package: lecm
Let’s EncryptCertificates Manager (lecm) is an
utility that allows one to manage (generate and renew) Let’s Encrypt SSL
certificates.GoalThe goal oflecmis to be able to generate and renewLet’s EncryptSSL certificates automatically.lecmis configuration driven. Each certificate that needs to be managed
is described in the configuration file.InstallationUsing pypiYou just need to$ pip install lecmDebian-based distro (Debian, Ubuntu, …)There is anofficial Debian package for lecm$ sudoapt-getinstall lecmHow to run itlecmis configuration driven. The configuration file is (by order of
priority):The one specified on the command line (lecm--conf/path/to/conf.yml)The one specified in the environment variable$LECM_CONFIGURATIONThe/etc/lecm.conflecmsupports various commands:--generatelecm--generatewill generate SSL certificates for items listed in the
configuration file that are not present in the filesystem.--renewlecm--renewwill renew SSL certificates already present on the filesystem
if its expiry date is lower than theremaining_daysvalue.--forcelecm--forcewill force the regeneration or renewal of SSL certificates, even
if its expiry date is not lower than theremainin_daysvalue.--listlecm--listwill display basic informations about currently configured items.+--------- +----------------------------------+---------------+------------------------------------------------------------------+-----------------------------------------------------------+------+
|  In Sync |               Item               |     Status    |                          subjectAltName                          |                          Location                         | Days |
+--------- +----------------------------------+---------------+------------------------------------------------------------------+-----------------------------------------------------------+------+
|  True    |   lecm-test.distributed-ci.io    |   Generated   |                 DNS:lecm-test.distributed-ci.io                  |    /etc/letsencrypt/pem/lecm-test.distributed-ci.io.pem   |  89  |
|  False   | lecm-test-test.distributed-ci.io | Not-Generated | DNS;lecm-test-test.distributed-ci.io,DNS:lecm.distributedi-ci.io | /etc/letsencrypt/pem/lecm-test-test.distributed-ci.io.pem | N/A  |
+----------+----------------------------------+---------------+------------------------------------------------------------------+-----------------------------------------------------------+------+--list-detailslecm--list-detailswill display details informations about currently configured items.+--------- +----------------------------------+---------------+------------------------------------------------------------------+---------------------------+--------------+-----------------------------------------------------------+------+------+--------+------+
|  In Sync |               Item               |     Status    |                          subjectAltName                          |        emailAddress       |  Environment |                          Location                         | Type | Size | Digest | Days |
+--------- +----------------------------------+---------------+------------------------------------------------------------------+---------------------------+--------------+-----------------------------------------------------------+------+------+--------+------+
|  True    |   lecm-test.distributed-ci.io    |   Generated   |                 DNS:lecm-test.distributed-ci.io                  | distributed-ci@redhat.com |  production  |    /etc/letsencrypt/pem/lecm-test.distributed-ci.io.pem   | RSA  | 4096 | sha256 |  89  |
|  False   | lecm-test-test.distributed-ci.io | Not-Generated | DNS;lecm-test-test.distributed-ci.io,DNS:lecm.distributedi-ci.io | distributed-ci@redhat.com |    staging   | /etc/letsencrypt/pem/lecm-test-test.distributed-ci.io.pem | RSA  | 2048 | sha256 | N/A  |
+----------+----------------------------------+---------------+------------------------------------------------------------------+---------------------------+--------------|-----------------------------------------------------------+------+------+--------+------+ConfigurationEvery parameters are either applicable globally or within the scope of a certificate. The finest specification wins.ParameterScopeDefaultDescriptionpathglobal, certificateNoneFolder where will reside all the relevant filestypeglobal, certificateRSAType of the key to generate (Possible: RSA, DSA)sizeglobal, certificate4096Size of the key to generatedigestglobal, certificatesha256Digest of the key to generateversionglobal, certificate3Version of the SSL Certificate to generatesubjectAltNameglobal, certificateNonesubjectAltName value of the Certificate Signing Request (csr)countryNameglobal, certificateNonecountryName value of the Certificate Signing Request (csr)stateOrProvinceNameglobal, certificateNonestateOrProvinceName value of the Certificate Signing Request (csr)localityNameglobal, certificateNonelocalityName value of the Certificate Signing Request (csr)organizationNameglobal, certificateNoneorganizationName value of the Certificate Signing Request (csr)organizationalUnitNameglobal, certificateNoneorganizationalUnitName value of the Certificate Signing Request (csr)commonNameglobal, certificateNonecommonName value of the Certificate Signing Request (csr)emailAddressglobal, certificateNoneemailAddress value of the Certificate Signing Request (csr)account_key_nameglobal, certificateaccount_$fqdn.keyName of the account key to generateremaining_daysglobal, certificate10Number of days of validity below which the SSL Certificate should be renewedservice_nameglobal, certificatehttpdService that needs to be reloaded for the change to be taken in considerationservice_providerglobal, certificatesystemdService management system (Possible: systemd, sysv)environmentglobal, certificateproductionLet’s Encrypt environment to use (Possible: production, staging)Configuration file example---
path: /etc/letsencrypt

certificates:
  my.example.com:
  app.example.com:
    subjectAltName:
      - app.example.com
      - app1.example.com
      - app2.example.comMore example can be found in thesample/directory.Httpd and Nginxlecmdoes not configure the webservers, they have to be previously
configured to be able to answer the challenges. NOTE: Let’s
Encrypt will perform a plain HTTP request to port 80 on your server, so you
must serve the challenge files via HTTP. See the HTTP Challenge section
of theACME specificationfor more details.httpdAlias /.well-known/acme-challenge /etc/letsencrypt/challenges/my.example.com
<Directory /etc/letsencrypt/challenges/my.example.com>
    Require all granted
</Directory>nginxlocation /.well-known/acme-challenge/ {
  alias /etc/letsencrypt/challenges/my.example.com/;
  try_files $uri =404;
}