Let's Encrypt with FreeNAS 11.1 and later 0.3

[bluonek]

@danb35 I was trying to figure out what this script does with the privkey. After a layman review it seems it only ingests it into an array but never actually uses it. Any insight on this? Maybe I missed it in the abstractions. Thanks!

 

[danb35]

It's POSTed to the server through the API along with the certificate in lines 92-102.

 

[bluonek]

It's POSTed to the server through the API along with the certificate in lines 92-102.

Makes sense. I was looking right at those lines, but thought it was just making an array, missed that it was actually pushing the json to TrueNAS in that very call. Thanks! =)

 

[yupbenji]

Worth noting it looks like this can be done within the UI in Scale now. https://www.truenas.com/docs/scale/...ertificates/settingupletsencryptcertificates/

 

[danb35]

Worth noting it looks like this can be done within the UI in Scale now. https://www.truenas.com/docs/scale/...ertificates/settingupletsencryptcertificates/

I think it's already been noted up-thread. Yes, it can (just as it can with CORE), but with extremely limited choice of DNS hosts. CORE only includes Route53; SCALE includes Route53 and Cloudflare. I think Cloudflare is a good choice for a lot of people--it's featureful and free, and I've been using it myself for some time--but it's still a far cry from the 150+ providers supported by acme-dns.

It doesn't help that the TrueNAS UX for cert creation is needlessly Byzantine with nonsensical defaults--you're required to create a CSR, and enter a bunch of information (all of which is required--name, city, state, country, etc.) which Let's Encrypt is going to strip out of the cert. It then defaults to renewing 10 days before cert expiration, which means you'll certainly get one, and possibly two, warning emails that your cert is about to expire.

 

[revengineer]

How do I go about updating just acme.sh script? Do I just run curl https://get.acme.sh | sh -s email=you@yourdomain.com again, or do I also need to redo other steps?

 

[danb35]

acme.sh updates itself every time it runs.

 

[revengineer]

acme.sh updates itself every time it runs.

Nice that's convenient. Thanks for the quick response!

 

[MrBucket101]

You can configure acme certs in the scale UI now.

 

[victort]

You can configure acme certs in the scale UI now.

This is for CORE though.

Hoping CORE 13.3 will have the option as well.

 

[revengineer]

I am running CORE and I do not see this ACEM cert in the GUI of 13.0-U6.1. @danb35 description and script running in jail work great.

 

[danb35]

You can configure acme certs in the scale UI now.

Yes, we know; it was posted just five posts above yours. And it's also a feature in CORE--if you're using one of the two (for SCALE) or one (for CORE) supported DNS providers. As was posted four posts above yours.

This is for CORE though.

It's for either, really; the API is the same in this regard.

It appears that CORE 13.3 will slightly expand the list of supported providers--Cloudflare seems pretty likely, and it sounded like there were one or two others that were going to be added as well. If you're using a supported provider, getting your cert through the GUI may make sense. Though if you're also using FTPS, S3, or WebDAV, or other services that would use a certificate, you may still want to use my script to ensure they all change to use the new cert when it's issued.

I am running CORE and I do not see this ACEM cert in the GUI of 13.0-U6.1

It's in System -> ACME DNS, set up an authenticator there (if you have Route53 DNS, the only one that's supported), and go from there. It's ugly and awkward, but I believe it works.

 

[revengineer]

It's in System -> ACME DNS, set up an authenticator there (if you have Route53 DNS, the only one that's supported), and go from there. It's ugly and awkward, but I believe it works.

This actually does ring a bell. I checked it out early on but had to abandon because cloudflare is not supported. As I wrote before, very happy with your provided solution now, and there are reasons to continue to stick with it.