getssl

There's at least one ACME client that has this as an explicit feature: > Get certificates for remote servers - The tokens used to provide validation of domain ownership, and the certificates themselves can be automatically copied to remote servers (via ssh, sftp or ftp for tokens). The script doesn't need to run on the server itself. This can be useful if you don't have access to run such scripts on the server itself, e.g. if it's a shared server. * https://github.com/srvrco/getssl It's written in Bash, so dependencies aren't too heavy.

getssl was written with a bit of a focus on this: > Get certificates for remote servers - The tokens used to provide validation of domain ownership, and the certificates themselves can be automatically copied to remote servers (via ssh, sftp or ftp for tokens). The script doesn't need to run on the server itself. This can be useful if you don't have access to run such scripts on the server itself, e.g. if it's a shared server. * https://github.com/srvrco/getssl

> certbot is a python program, better hope it keeps working There is also https://github.com/srvrco/getssl which is a bash script. I have lightly audited it years ago and it did not seem to upload your private keys anywhere... I've used it occasionally, but I don't let it run as root, so I need to copy the retrieved certs into the the server config manually.

A 'competitor' to this would be GetSSL which is a pure-shell ACME client (plus OpenSSL and cURL) and can be executed on one host, but send verification tokens to remote systems (where you may not have cron access): > Get certificates for remote servers - The tokens used to provide validation of domain ownership, and the certificates themselves can be automatically copied to remote servers (via ssh, sftp or ftp for tokens). The script doesn't need to run on the server itself. This can be useful if you don't have access to run such scripts on the server itself, as it's a shared server for example. * https://github.com/srvrco/getssl

Been ussing this script https://github.com/srvrco/getssl

> acme.sh Another shell-based ACME client I like is dehyradted. But for sending certs to remote systems from one central area, perhaps the shell-based GetSSL: > Obtain SSL certificates from the letsencrypt.org ACME server. Suitable for automating the process on remote servers. * https://github.com/srvrco/getssl In general, what you may want to do is configure Ansible/Puppet/etc, and have your ACME client drop the new cert in a particular area and have your configuration management system push things out from there.

> yet still easily get certs for things like imap.example.com - which would not run a web server. Well, depending on the OS, you could start up a web server during the LE verification process and then bring it down once that's done. You'd only have to run in on port 80 for probably less than a minute. But yes, you could this mechanism to have "_acme-challenge.imap.example.com" (which is what the ACME protocol uses) be a CNAME to point to something.auth.example.com that is more dynamic. Or even a completely different domain like foo.bar.example.ORG. In your example.com zone file you'd put NS and A(AAA) records to point to the DNS server that handles the queries for the auth sub-domain. > And also split cert renewal to vps/container isolated from things like smtp/imap that need the certs. It's easier to run the ACME client on the host in qu

> I also serve many domains with this project so I don't have the nice DNS-01 ACME verification features because not all DNS providers have an API. Are you aware of using ACME DNS aliasing with CNAMEs? * https://www.eff.org/deeplinks/2018/02/technical-deep-dive-se... * https://github.com/Neilpang/acme.sh/wiki/DNS-alias-mode * https://dan.langille.org/2019/02/01/acme-domain-alias-mode/ My work's DNS provider does not have a handy API, so if we want a cert for the internal-only foo.example.com, we point _acme-challenge.foo to _acme-challenge.foo.dnstest.example.com. And the NS server for the dnstest.example.com lives in our DMZ and is only there to answer ACME queries from Let's Encrypt. We set up some scripting to allow updates to the NS server via nsupdate. And there are ACME clients written specifically around the idea of having the clie

Agreed. If I remember correctly it even destroyed a site once when it was attempting to make sure their validator could reach the verification file. I just did what everyone said: "it's so easy, just run it on auto mode with apache and it'll configure your cert for you". Turned out to be a huge PITA. Recently I had to renew that site again (I've been postponing and dreading it) and looked for a different client. The getssl bash script[1] had its own problems (all caused by me not taking the time to read the readme, but the default settings were a bit odd), but overall a 10× better experience than the official client. Much less magic, much more a unix-like tool ("it does only one thing, and one thing very well"). [1] https://github.com/srvrco/getssl