acme-nosudo

Like I said, I haven't used the their client, just going off what I've come across in researching it briefly. Something must have changed then, there are multiple ways to configure it, or what I read previously was just wrong. I thought that was why repos like https://github.com/diafygi/letsencrypt-nosudo existed for a time. That's good news nonetheless.

The ACME protocol is open and as a result there are several alternative clients which do not require root. Here's a few: https://github.com/diafygi/letsencrypt-nosudo https://github.com/kuba/simp_le https://github.com/lukas2511/letsencrypt.sh Or you can go a more manual approach via https://gethttpsforfree.com/ but you will need to manually renew your certificate every 90 days.

Very close to https://github.com/diafygi/letsencrypt-nosudo

Have you tried letsencrypt-nosudo[1]? Also, mind testing my new browser-based client, gethttpsforfree[2]? [1]: https://github.com/diafygi/letsencrypt-nosudo [2]: https://github.com/diafygi/gethttpsforfree

Ah! Ok, I think you need to add the intermediate certificate[1] that chains the Let's Encrypt Authority X1 to the IdenTrust root. Here's instructions on how to do this for nginx: https://github.com/diafygi/letsencrypt-nosudo#how-to-use-the... [1]: https://letsencrypt.org/certs/lets-encrypt-x1-cross-signed.p...

I'm really pleased to see this initiative and I've used the private beta with letsencrypt-nosudo[0] to issue a certificate, but after successfully getting a certificate my site failed the SSL Labs test[1] with an 'unknown CA' error, even though I used the newer one that should have been trusted. It was probably down to user error and the additional complexity of denying sudo privileges for the set up script, but it took much more work than I expected. Then I noticed the certs will only ever be good for 90 days, and I'll have to do this multiple times a year! Bottom line for me is that with DV certs so inexpensive and simple to get, I'd rather pay a few dollars a year for normal commercial certificates. I can do things like use CloudFront at a custom subdomain with HTTPS without needing to point DNS somewhere every few months to get a cert

Boom, done. 428 lines. Only python and openssl as dependencies. https://github.com/diafygi/letsencrypt-nosudo It takes a CSR and user public key as input. Then, it prints the signing commands you need to run (so it doesn't have to know your private keys). Then, prints the command you need to run on your server. Finally, it prints your signed cert. Enjoy! The official Let's Encrypt client is aimed at an audience that doesn't know what a CSR is. For those that do and just want their free certs, I wrote this script to them to get their free certs without having to trust any client.

https://github.com/diafygi/letsencrypt-nosudo If you don't trust the official letsencrypt client, you can use this script to get your free certs. It doesn't install things or ask for sudo access or your private keys or have to be run on your server (except for one challenge response one-liner you can inspect). I wrote it specifically so people who didn't trust the letsencrypt client could still get free certs.

If you just want a free cert, you can use my letsencrypt-nosudo client[1], which doesn't ask for your private key or sudo access or have to be run on your server (except for one copy-paste line you can inspect). The official letsencrypt client is geared much more towards someone who doesn't understand how TLS certs work. For people who know what they're doing, you can use lightweight clients like mine to just get your free cert. [1]: https://github.com/diafygi/letsencrypt-nosudo

Is this something they can implement themselves? https://github.com/diafygi/letsencrypt-nosudo

For this specific reason I'm a lot more comfortable running the "nosudo"[0] variant, which tells you to install the keys yourself. A recently released Ruby gem also looks promising, in that it's a much better codebase with a tonne of tests.[1]. [0] https://github.com/diafygi/letsencrypt-nosudo [1] https://github.com/unixcharles/acme-client

This python script is informative: https://github.com/diafygi/letsencrypt-nosudo/blob/master/si... A good start for trying to figure out the workflow.

It used to, but that meant you had to scp the generated dvsni cert to your server[1], which is more complex than asking the user to start serving a string over a specific url (which is what the SimpleHTTP challenge requires). [1]: https://github.com/diafygi/letsencrypt-nosudo/blob/9607deb7b...

FYI, if you don't want to install the official Let's Encrypt client on your production server, I created a simple python script that will automate the ACME process for you. It doesn't have to run on your server, and it doesn't ask for your private keys. https://github.com/diafygi/letsencrypt-nosudo The only thing that has to be run as sudo on your production server is a simple python one-liner that temporarily serves the required file. The script prints out this one-liner so you can copy and paste it into your server's terminal, then kill it when the challenge is done.