Let's Encrypt: Certbot For OpenBSD's httpd
Tags: security, letsencrypt, certbot, openbsd
Published: 2018-12-14 15:56:52

---
title: Let's Encrypt: Certbot For OpenBSD's httpd
published: true
description: In OpenBSD as well as other operation systems, it's easy and comfortable to have their big help 😊
tags: security, letsencrypt, certbot, openbsd
cover_image: https://thepracticaldev.s3.amazonaws.com/i/ngw6k9ucxyrbt7wcsj1i.jpg
canonical_url: https://obsd.solutions/en/blog/2018/12/15/letsencrypt-certbot-with-httpd-on-openbsd-64/index.html
series: OpenBSD TLS connection
---

*\* The cover image is originally by [markusspiske](https://pixabay.com/en/users/markusspiske-670330/) and edited with great appreciation.*

## Intro

[Let's Encrypt](https://letsencrypt.org/) is "a free, automated, and open Certificate Authority".
[Certbot](https://certbot.eff.org/) is "an easy-to-use automatic client that fetches and deploys SSL/TLS certificates for your web server", well known as “the official Let’s Encrypt client”.

I remember well how excited I felt when I read Let's Encrypt's ["Our First Certificate Is Now Live"](https://letsencrypt.org/2015/09/14/our-first-cert.html) in 2015.
How wonderful [the goal of them](https://letsencrypt.org/about/) is; it's to "give people the digital certificates they need in order to enable HTTPS (SSL/TLS) for websites, for free" "to create a more secure and privacy-respecting Web"!
Since 2018, they have begun to support even [ACME v2 and Wildcard Certificate](https://community.letsencrypt.org/t/acme-v2-and-wildcard-certificate-support-is-live/55579)!

Well, in [OpenBSD](https://www.openbsd.org/) as well as other operation systems, it's easy and comfortable to have their big help 😊

### Envrionment

- OS: OpenBSD 6.4 amd64
- Web Server: OpenBSD's httpd
- Certification: Let's Encrypt with Certbot 0.27

### Reference

- [OpenBSD's httpd](https://obsd.solutions/en/blog/2018/10/05/openbsd-httpd-63-web-server/index.html)

## How To Install Certbot

Just:

```shell-session
# pkg_add certbot
```

## How To Obtain Certificates

First, let's prepare a directory as webroot:

```shell-session
# mkdir /var/www/%your-webroot%
```

Next, edit [`/etc/httpd.conf`](https://man.openbsd.org/httpd.conf.5) in order to build a web server of `%your-domain%` listening to Let's Encrypt's HTTP challenge for certification:

```conf
# [/etc/httpd.conf]

types {
        include "/usr/share/misc/mime.types"
}

ext_addr = egress

# ...

cert_domain = %your-domain%
server $cert_domain {
        listen on $ext_addr port 80
        root "/%your-webroot%"
        directory auto index
}
```

Then reload the configuration:

```shell-session
# rcctl restart httpd
```

OK. We're ready.

*(\* You don't need to stop the web server temporarily to [release port 80 for `--standalone`](https://certbot.eff.org/docs/using.html#standalone) thanks to `--webroot`! \*)*

Let's try to obtain a new certificate:

```shell-session
# certbot certonly --webroot -w /var/www/%your-webroot% -d %your-domain%
```

*\* Note: The meanings of the above subcommand and options are below according to [the manual](https://certbot.eff.org/docs/using.html):*

| Subcommand/Option | Description |
| ------------------ | ----------- |
| `certonly` | Obtain or renew a certificate, but do not install it. |
| `--webroot` | Place files in a server's webroot directory for authentication. |
| `--webroot-path WEBROOT_PATH`, `-w WEBROOT_PATH` | Webroot / `public_html` path[s individually]. |
| `-d DOMAIN`, `--domains DOMAIN` | Specified domain[s individually]. |

Besides, it's possible to omit `--webroot -w /var/www/%your-webroot%` because you are asked later (and so it becomes non-automatic process).

*\* Note: If it's your first time, you are asked your email address where the CA (certificate authority) will send notification emails. Alternatively, you can use the `-m EMAIL, --email EMAIL` option on the command line.*

Anyway, `certbot` outputs like this:

```shell-session
# certbot certonly --webroot -w /var/www/%your-webroot% -d %your-domain%

Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator webroot, Installer None
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for %your-domain%
Using the webroot path /var/www/%your-webroot% for all unmatched domains.
Waiting for verification...
Cleaning up challenges

IMPORTANT NOTES:
 - Congratulations! Your certificate and chain have been saved at:
   /etc/letsencrypt/live/%your-domain%/fullchain.pem
   Your key file has been saved at:
   /etc/letsencrypt/live/%your-domain%/privkey.pem
   Your cert will expire on 20??-??-??. To obtain a new or tweaked
   version of this certificate in the future, simply run certbot
   again. To non-interactively renew *all* of your certificates, run
   "certbot renew"
 - If you like Certbot, please consider supporting our work by:

   Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
   Donating to EFF:                    https://eff.org/donate-le

```

We receive the sweet "Congratulations!" message.
Let's reflect gotten `fullchain.pem` and `privkey.pem` in `/etc/httpd.conf`:

```conf
# [/etc/httpd.conf]

types {
        include "/usr/share/misc/mime.types"
}

ext_addr = egress

# ...

#cert_domain = %your-domain%
#server $cert_domain {
#        listen on $ext_addr port 80
#        root "/%your-webroot%"
#        directory auto index
#}

server "%your-domain%" {
        listen on $ext_addr port 80
        block return 301 "https://$SERVER_NAME$REQUEST_URI"
}
server "%your-domain%" {
        listen on $ext_addr tls port 443
        tls {
                certificate     "/etc/letsencrypt/live/%your-domain%/fullchain.pem"
                key             "/etc/letsencrypt/live/%your-domain%/privkey.pem"
        }
        root "/%your-webroot%"
        directory auto index
}
```

And then:

```shell-sessiox
# rcctl restart httpd
```

Now we obtain the web server to create HTTPS connection whenever it's accessed at last!

### How To Manage Obtained Certificates

Please bear in mind that [Let's Encript's certificates are valid for 90 days](https://letsencrypt.org/docs/faq/) and [why it is](https://letsencrypt.org/2015/11/09/why-90-days.html).

These are the basic subcommands of `certbot`:

| Subcommand | Description |
| ---------- | ----------- |
| certificates | List certificates managed by Certbot |
| [renew](https://certbot.eff.org/docs/using.html#renewing-certificates) | Renew all certificates (or one specified with `--cert-name`) |
| delete       | Clean up all files related to a certificate |
| [revoke](https://certbot.eff.org/docs/using.html#revoking-certificates) | Revoke a certificate specified with `--cert-path` or `--cert-name` |

##### To list

```shell-session
# certbot certificates
Saving debug log to /var/log/letsencrypt/letsencrypt.log

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Found the following certs:
  Certificate Name: %your-domain%
    Domains: %your-domain%
    Expiry Date: 20??-??-?? ??:??:??+00:00 (VALID: 90 days)
    Certificate Path: /etc/letsencrypt/live/%your-domain%/fullchain.pem
    Private Key Path: /etc/letsencrypt/live/%your-domain%/privkey.pem
  Certificate Name: ...
```

##### To renew

Simple usage is like this to "renew any previously-obtained certificates that expire in less than 30 days":

```shell-session
# certbot renew
```

Pre/Post-Hooks are available:

```shell-session
# certbot renew --pre-hook "rcctl stop httpd" --post-hook "rcctl start httpd"
```

##### To delete

Delete a certificate completely:

```shell-session
# certbot delete --cert-name %your-domain%
```

<center>✿ ✿ ✿</center>

Happy serving 🌵