acmetool

Nagios, in combination with with check_mk 'raw edition' (https://mathias-kettner.com/editions.html). The Nagios configuration is automatically generated via Puppet resource collection. SSL certificate expiry is easily checked with a nagios check (use the -C flag on check_http). If you use Letsencrypt with a client like acmetool (https://github.com/hlandau/acme) your certs will never expire. Of course the nagios check is still necessary to ensure acmetool keeps doing its job! Domain name expiry checking could also be a nagios job, or alternatively you could write a small script that checks whois output and execute it regularly with cron. Configuring your registrar for auto-renewal helps avoid a certain class of errors ("I forgot to renew!") but not others ("my credit card expired and the e-mail notifications from my registrar didn't reach

I've really enjoyed using https://github.com/hlandau/acme and we use it in prod. I'm not sure how up to date https://github.com/hlandau/acme#comparison-list-of-client-im... is.

As everyone is mentioning their favorite tools, I like acmetool[1] in particular. I began to work on a docker/compose/nginx integration[2], but never finished it due shifting priorities. The missing piece was a reload hook for nginx. It would have been easy with simple cgi script (just send nohup), but alas, nginx does not support cgi. [1] https://github.com/hlandau/acme [2] https://github.com/zokier/acmetool-docker

Does this package only support HTTPs domain validation? Would be nice if it would help with DNS based validation as well. I'm using github.com/hlandau/acme/acmeapi at the moment, but the API isn't documented well. Their command line client is better, but library is more convenient when you have custom storage for certs. Also a question for someone who has it running in production. What is the best way to handle TOS updates? Do you just setup some notifications when this happens or accept automatically? I'm not sure how often this happens, but the last update was this month.

I've found the best tool for getting certs from LE is this: https://github.com/hlandau/acme

I've found acmetool perfect for my use and this table explains why: https://github.com/hlandau/acme#comparison-list-of-client-im... The biggest feature the official letsencrypt client was missing was triggering restarts of other services after certificate renewal.

Unfortunately lots of Go code on GitHub has significant oversights, this included. I remember reporting a DoS bug in a different Go acme library identical to this one I found in acmetool in less than 60s: https://github.com/hlandau/acme/blob/master/acmeapi/ocsp.go#... In case it is not obvious, anyone in a privileged point on the network can fill resb with enough data that the program panics due to OOM and crashes. ioutil.ReadAll really needs a big warning in the docs because I have seen this pattern far too often.

I'm one of the developers of that paid plugin. We developed it primarily for my day job (as a web host, SSL is one of the worst support burdens for us), but it's been really successful for other hosts as well. The situation certainly sucks for shared hosting customers who do not have access to LE. However, cPanel have stated that they will be delivering the functionality as an out-of-release plugin between 11.56 and 11.58. If you don't want to pay, I suggest taking a look at one of the dependency-free, root-less tools, such as acmetool[1]. You should be able to plug this into your crontab without any issues. Depends how limited your SSH is, though. 1. https://github.com/hlandau/acme . Great tool. Unfortunately the official Let's Encrypt client tooling is really quite poor. Python was not a good choice (way too many dependencies get pulled

The official let's encrypt client is very heavy-weight. In my case I've build a much simpler thing using acmetool (https://github.com/hlandau/acme) which is mcuh simpler to use and nicely runs without root rights. In my case, a lot of the routing of domains to customers is stored in a postgres database and a trigger fires an event anyways, so I have a little daemon that listens to these events and the fires off acmetool as needed in order go generate certificates. I just completed this last week, so when I've seen this article here, I thought that I just wasted some time over this because now there's an integrated nginx solution, but thankfully, this is just an article about doing what I was doing using a tool that's more complicated to use and brings half of an OS installation as dependencies. For those interested, https://gist.github.co

I think this is a nice option. I gave it a try —and read the source code. :) I opted for acmetool[1] though, which albeit much larger (and thus much more difficult to verify), is easier to use [2]. The more impressive option I've seen is caddy server [3] which sets up everything automatically. You start the server and it automatically requests certificates, serves your content (static, fcgi, proxy etc) through TLS and redirects plain traffic to SSL. You don't even need to know what let's encrypt or ssl is. It has a bug though, every time you start the server it requests a new certificate, so after a few restarts you will get your domain temporarily banned from let's encrypt. [1] https://github.com/hlandau/acme.t or `go get github.com/hlandau/acme/cmd/acmetool` [2] acmetool quickstart && acmetool want example.com www.example.com [3] https: