dehydrated

Lets Encrypt and the dehydrated script here: https://github.com/lukas2511/dehydrated Not affiliated - other than as a user of the script.

You could use Cloudflare for DNS and their API[1] for updating a subdomain of your own to your dynamic ip. With that, you could also use the dehydrated[2] script with dns challenges to host subdomains with ssl on your lan. It's all easily automated, as well. [1]:https://gist.github.com/larrybolt/6295160 [2]: https://github.com/lukas2511/dehydrated I can't suggest that cloudflare script, as I've long since rolled my own, but there are plenty of examples out there.

We've fully automated Lets Encrypt on our handful of servers and so far it works really well, with only a few glitches. It's specific to our setup but: -> We do DNS verification through Dehydrated (https://github.com/lukas2511/dehydrated). Because we use in-house DNS running PowerDNS with a MySQL backend, updates to records are a cinch. -> Dehydrated has "hooks" that allows you to call your own scripts for each step of the verification process. We have an on-prem sysadmin box that does remote administration of the servers (so that none of our servers have direct access to any other server, just in case of a breach), so we just had to update a few commands to work with Dehydrated's hooks. -> Each remote server has its own directory within the Dehydrated environment, and there's an "update" script that runs from cron that: a) asks that part

If you are going this scale, there is another way: Use your own DNS server and try the DNS-01 challenge. My setup works with [0]letsencrypt.sh, [1]pdns_api.sh, [2]PowerDNS4 (MySQL backend w/ replication) and a little script that distributes the certs and restarts services. The nice thing is, this works for anything you can put in DNS, you do not need not to respond to a HTTP request for a name (think mail server). [0] https://github.com/lukas2511/letsencrypt.sh [1] https://github.com/silkeh/pdns_api.sh [2] https://github.com/PowerDNS/pdns

https://github.com/lukas2511/letsencrypt.sh provides a BASH script that only uses OpenSSL/cURL and similar tools to retrieve LetsEncrypt certificates. It also provides support for the dns-01 ACME challenge (which quite handily lets a certificate be requested and retrieved without having to write files anywhere, only requiring a DNS TXT record). To handle different DNS provider APIs, letsencrypt.sh delegates the DNS operations to a hook script: this little Go program implements the hook command line interface and uses the Linode DNS API to create/destroy the required TXT records. More info is available from the project README at https://github.com/IdeaSynthesis/letsencrypt-dns01-hooks/blo... .

I still prefer this simple single file shell script: https://github.com/lukas2511/letsencrypt.sh

It's worth pointing out here that reusing a static keypair with Let's Encrypt is currently more or less straight-forward using acme-tiny. https://github.com/diafygi/acme-tiny Edit: Looks like https://github.com/lukas2511/letsencrypt.sh is capable of doing the same, as pointed out in another comment.

For people that want something much smaller (dependency-wise), I can recommend letsencrypt.sh which – together with cron – achieves the same goal: https://github.com/lukas2511/letsencrypt.sh

I have been happy with https://github.com/lukas2511/letsencrypt.sh. I am trying to get it packaged for Debian/Ubuntu and either get it into Debian-proper or at least host the repo myself to make it easier to use for the common case. Since nginx reloads the cert on a SIGHUP it makes it really easy to have zero downtime renews. As for getting notified if something goes wrong I use the following in my crontab: 10 5 * * * root test -e /usr/local/bin/letsencrypt.sh && /usr/local/bin/letsencrypt.sh -c > /dev/null letsencrypt.sh outputs errors to stderr, so any errors will be sent to the root account. To get that working, do: apt-get install postfix echo 'postmaster: root' > /etc/aliases echo 'root: igor@example.com' >> /etc/aliases newaliases Problem solved.

I just use https://github.com/lukas2511/letsencrypt.sh/ single bash script. Add a config.sh and setup nginx alias. Then just add domains to the domains.txt and have the script run via cron daily. Finished

Don't forget this[1] gem which is my favorite way to use letsencrypt. It will let me run it by cron (or periodic on FreeBSD) plus I can have my own post-run script that takes my certificates and keys and puts them in the format I need for Hitch (SSL termination for Varnish), push those changes, restart the service _inside_ a FreeBSD jail automatically. It's advanced setups like this where LetsEncrypt fails out of the box, but it's nice we have tools like this at our disposal now. [1] https://github.com/lukas2511/letsencrypt.sh

Not a tutorial, but I was having trouble with that damn 'official' Letsencrypt client and the complexity of adding a .wellknown directory on every site I needed a certificate for. So I saw the light in the form of a bash-script [0], wrote a short hookscript, and now I can centrally manage through DNS. There are a couple of example scripts [1], and it really simple to write your own. [0] https://github.com/lukas2511/letsencrypt.sh [1] https://github.com/lukas2511/letsencrypt.sh/wiki/Examples-fo...

I use https://github.com/lukas2511/letsencrypt.sh and it handles all the openssl stuff for you, I've found it to be really nice and light-weight. You just give it a directory to put the ACME challenge files in and a list of your domains

I found https://github.com/lukas2511/letsencrypt.sh to be quite nice and easy.

The ACME protocol is open and as a result there are several alternative clients which do not require root. Here's a few: https://github.com/diafygi/letsencrypt-nosudo https://github.com/kuba/simp_le https://github.com/lukas2511/letsencrypt.sh Or you can go a more manual approach via https://gethttpsforfree.com/ but you will need to manually renew your certificate every 90 days.