TLS mit acme.sh

• Abhängigkeiten git und socat installieren. socat wird nur für die standalone Web-Challenge, nicht aber für die DNS-Challenge benötigt

apt install git socat

• acme.sh per git aus dem Repository laden

git clone https://github.com/Neilpang/acme.sh

• acme.sh installieren

cd acme.sh
./acme.sh --install

• Test: ein Zertifikat für den Namen nsXX.defaultroutes.de per standalone Webservice anfordern (Port 80 auf dem Server muss frei sein)

./acme.sh  --issue  -d vmXX.defaultroutes.de  --standalone
[Tue Mar 20 11:27:00 UTC 2018] Standalone mode.
[Tue Mar 20 11:27:01 UTC 2018] Registering account
[Tue Mar 20 11:27:01 UTC 2018] Registered
[Tue Mar 20 11:27:02 UTC 2018] ACCOUNT_THUMBPRINT='B4YKRQUJv42qkv9SH_2JP-FD_JsEyKkmgt7wRVsug3c'
[Tue Mar 20 11:27:02 UTC 2018] Creating domain key
[Tue Mar 20 11:27:02 UTC 2018] The domain key is here: /root/.acme.sh/vmXX.defaultroutes.de/ns04.defaultroutes.de.key
[Tue Mar 20 11:27:02 UTC 2018] Single domain='vmXX.defaultroutes.de'
[Tue Mar 20 11:27:02 UTC 2018] Getting domain auth token for each domain
[Tue Mar 20 11:27:02 UTC 2018] Getting webroot for domain='vmXX.defaultroutes.de'
[Tue Mar 20 11:27:02 UTC 2018] Getting new-authz for domain='vmXX.defaultroutes.de'
[Tue Mar 20 11:27:02 UTC 2018] The new-authz request is ok.
[Tue Mar 20 11:27:03 UTC 2018] Verifying:ns04.defaultroutes.de
[Tue Mar 20 11:27:03 UTC 2018] Standalone mode server
[Tue Mar 20 11:27:06 UTC 2018] Success
[Tue Mar 20 11:27:06 UTC 2018] Verify finished, start to sign.
[Tue Mar 20 11:27:07 UTC 2018] Cert success.
-----BEGIN CERTIFICATE-----
MIIFDTCCA/WgAwIBAgISBGvqztwcY0p9jGrx/psiyxfLMA0GCSqGSIb3DQEBCwUA
MEoxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MSMwIQYDVQQD
ExpMZXQncyBFbmNyeXB0IEF1dGhvcml0eSBYMzAeFw0xODAzMjAxMDI3MDdaFw0x
[...]
qIOIRUmRSuTLXDWjih7kTKSLzDr8NEsvIm9qh8EmUsPEYDqye0lU2hV1evaHZXkQ
pQOxfr9yf0eGvS5jj2kW1AVi2Dz3880c0M0jUJH7JyMOs3KrVk2VorGfVTctlx8c
4g==
-----END CERTIFICATE-----
[Tue Mar 20 11:27:07 UTC 2018] Your cert is in  /root/.acme.sh/vmXX.defaultroutes.de/vmXX.defaultroutes.de.cer
[Tue Mar 20 11:27:07 UTC 2018] Your cert key is in  /root/.acme.sh/vmXX.defaultroutes.de/vmXX.defaultroutes.de.key
[Tue Mar 20 11:27:08 UTC 2018] The intermediate CA cert is in  /root/.acme.sh/vmXX.defaultroutes.de/ca.cer
[Tue Mar 20 11:27:08 UTC 2018] And the full chain certs is there:  /root/.acme.sh/vmXX.defaultroutes.de/fullchain.cer

• Apache2 installieren

apt install apache2

• prüfen, das Apache2 gestartet wurde

 systemctl status apache2
● apache2.service - The Apache HTTP Server
   Loaded: loaded (/lib/systemd/system/apache2.service; enabled; vendor preset: enabled)
   Active: active (running) since Tue 2018-03-20 18:23:16 UTC; 32s ago
 Main PID: 3292 (apache2)
   CGroup: /system.slice/apache2.service
           ├─3292 /usr/sbin/apache2 -k start
           ├─3294 /usr/sbin/apache2 -k start
           └─3295 /usr/sbin/apache2 -k start

Mar 20 18:23:16 dnssec04 systemd[1]: Starting The Apache HTTP Server...
Mar 20 18:23:16 dnssec04 systemd[1]: Started The Apache HTTP Server.

• im Browser unter der URL http://vm01.defaultroutes.de sollte nun die Apache Startseite erscheinen

• für die folgende Übung muss die DNS-Zone (hier zoneXX.defaultroutes.de) eine per update-policy local; dynamische Zone sein! Die Schlüssel für diese Zone liegen unter /var/cache/bind/keys:

zone "zoneXX.defaultroutes.de" IN {
  type master;
  file "zoneXX.defaultroutes.de.signed";
  update-policy local;
  auto-dnssec maintain;
  key-directory "/var/cache/bind/keys";
};

• Variablen für nsupdate festlegen. acme.sh sichert diese Werte in einer Konfigurationsdatei, so das diese Variablen nur bei der Abfrage des ersten Zertifikats notwendig sind

export NSUPDATE_SERVER="vmXX.defaultroutes.de"
export NSUPDATE_KEY="/run/named/session.key"

• Zertifikat von Let's Encrypt per DNS-Challenge (DNS-01) Verfahren holen

acme.sh --issue --dns dns_nsupdate -d mail.zoneXX.defaultroutes.de
[Tue Mar 20 19:44:32 UTC 2018] Creating domain key
[Tue Mar 20 19:44:32 UTC 2018] The domain key is here: /root/.acme.sh/mail.zoneXX.defaultroutes.de/mail.zoneXX.defaultroutes.de.key
[Tue Mar 20 19:44:32 UTC 2018] Single domain='mail.zoneXX.defaultroutes.de'
[Tue Mar 20 19:44:32 UTC 2018] Getting domain auth token for each domain
[Tue Mar 20 19:44:32 UTC 2018] Getting domain auth token for each domain
[Tue Mar 20 19:44:32 UTC 2018] Getting webroot for domain='mail.zoneXX.defaultroutes.de'
[Tue Mar 20 19:44:32 UTC 2018] Getting new-authz for domain='mail.zoneXX.defaultroutes.de'
[Tue Mar 20 19:44:33 UTC 2018] The new-authz request is ok.
[Tue Mar 20 19:44:33 UTC 2018] Found domain api file: /root/.acme.sh/dnsapi/dns_nsupdate.sh
[Tue Mar 20 19:44:33 UTC 2018] adding _acme-challenge.mail.zoneXX.defaultroutes.de. 60 in txt "lbzmtcAVubbyRDz-gBN55wjHYPKLjQIyyiP4KrJQ09E"
[Tue Mar 20 19:44:33 UTC 2018] Sleep 120 seconds for the txt records to take effect
[Tue Mar 20 19:46:35 UTC 2018] Verifying:mail.zoneXX.defaultroutes.de
[Tue Mar 20 19:46:38 UTC 2018] Success
[Tue Mar 20 19:46:38 UTC 2018] Removing DNS records.
[Tue Mar 20 19:46:38 UTC 2018] removing _acme-challenge.mail.zoneXX.defaultroutes.de. txt
[Tue Mar 20 19:46:39 UTC 2018] Verify finished, start to sign.
[Tue Mar 20 19:46:39 UTC 2018] Cert success.
-----BEGIN CERTIFICATE-----
MIIFGzCCBAOgAwIBAgISBBx1boz7RAlwuGEahkfhJBT3MA0GCSqGSIb3DQEBCwUA
MEoxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MSMwIQYDVQQD
[...]
/ZL3My2q1rBtnTTA8r/14wwK+ATtWsQgZxdOuyJwxBTN5GxH59xDGUh/0+HzZTWS
kxJRv5S/pC4UgumlZbs7O96iqGbLN2kSSDt18RfDWcmv+Ers/vdBs9FKNdLtWQ3I
nze6F11ma+/VRfMckVVS
-----END CERTIFICATE-----
[Tue Mar 20 19:46:39 UTC 2018] Your cert is in  /root/.acme.sh/mail.zoneXX.defaultroutes.de/mail.zoneXX.defaultroutes.de.cer
[Tue Mar 20 19:46:39 UTC 2018] Your cert key is in  /root/.acme.sh/mail.zoneXX.defaultroutes.de/mail.zoneXX.defaultroutes.de.key
[Tue Mar 20 19:46:40 UTC 2018] The intermediate CA cert is in  /root/.acme.sh/mail.zoneXX.defaultroutes.de/ca.cer
[Tue Mar 20 19:46:40 UTC 2018] And the full chain certs is there:  /root/.acme.sh/mail.zoneXX.defaultroutes.de/fullchain.cer