Easy way to add SSL certs to TurnKey appliances

It'd be great if there was a really easy way to add 3rd party trusted SSL certs to TurnKey appliances. The quicker, easier, most reliable way possible...

Want to back this issue? Post a bounty on it! We accept bounties via Bountysource.

Its Pretty Easy and I think it could be scripted. Difficulty comes when you get into EV Certs that have multiple layers to them.

Could for instance however Generate CSR at first Boot
Be Presented with the CSR text.
Go to your SSL Provider in another Window
Drop the CSR, buy the CERT, Get Emailed Back
Then firstboot, or in Webmin Later, tie the CSR and Cert(s) together.

Could also get a contract with a Cert provider to do this via API. Basically have it run through the Hub if you want (would need a yes/no branch on the inithook).

Doing all this also assumes DNS is setup to the IP. Also issues of Host Names, FQDN, Variations on certs available etc.

I like Namecheap.com
Really not hard to setup the way it is if running a rapidssl cert.

My thought for now is to make a Button link to Docs for (at least my) Appliances.

One of the sections would give a clear instruction on how to install a simple SSL via Webmin and SSH.

I think this solves it for now. Can be a project moving forward.

Having a Standard Port for the Console Index.php page on various Apps would make consistency just as having Webshell and Webmin does. I will start this in my next round at least for mine. I think it is important that apps give good "driving instructions" in general. Could save everyone time.

Ideally we'd love to be able to do this via the Hub. But to start with we'll probably just have some helper script (so via commandline)

@l-arnold

On #392 (comment) @l-arnold provided some info directly relevant to the Magento appliance but is possibly also generically useful for this issue.

How about using Let's Encrypt SSL certificates:

https://letsencrypt.org/howitworks/

They promise to give them for free and to install them programatically (via a script). So, I can imagine that each appliance can get automatically a free SSL certificate on init hooks.

That's the plan! 👍

PS I've been meaning to update this issue for a few days - since I discovered that Let's Encrypt is now in Public Beta...

I was thinking along these lines when I added the --csr option to turnkey-make-ssl-cert. My thought was to make it easier for the admin to generate a certificate request in a standard format accepted by providers like StartCom. The problem I see with acquiring a certificate during firstboot is that a fair amount of information about the certificate owner needs to be collected for the certificate request. If many appliances are to be created, then some method of pre-seeding the common information is needed.

@Dude4Linux

Moving this to v14.2 as we'd like to push the v14.1 out soon. Obviously feature requests that have already been included will stay; but otherwise focus for v14.1 is now shifting to bugfixing and maintenance.

@Dude4Linux - Very good points.

I must admit that that's why I was thinking doing it via the Hub (obviously supported on the free plan) might be the best way to go. Although obviously supporting pre-seeding would be useful too.

Let's Encrypt is now live and no longer in beta.

Adding support for automated Let's Encrypt SSL setup would be a great improvement over self-signed certs, IMO.

Let's Encrypt certs do expire every 90 days, so automated renewal will also be needed.

Installing LetsEncrypt SSL certs for HTTPS-based services

Refer to https://letsencrypt.org/getting-started/ as needed.

Do this as your non-root sudo user (it will require sudo, but let's do it that way instead of running this as root). On some platforms, this command installs a build toolchain if one is not present. You may not want to leave a build toolchain on production servers.

$ git clone https://github.com/letsencrypt/letsencrypt
$ cd letsencrypt
$ ./letsencrypt-auto --help  # this installs a build toolchain

Now, get a cert for yourself. Since the letsencrypt client in 'standalone' mode needs to use ports 80 and 443, we need to shut down any web server that is running on those ports. lighttpd is the default on the OpenVPN gateway appliance.

Once you're ready*:

$ sudo service lighttpd stop
$ ./letsencrypt-auto certonly --standalone -d yourbox.example.org

Now enter an email as requested and agree to the terms. You will receive cert files in /etc/letsencrypt/live/yourbox.example.org/ which you must tell webmin and shellinabox to use, since they each use their own HTTP server.

Don't forget to restart your web server and/or restore firewall rules once you're done with the letsencrypt-auto client in standalone mode.

Get the self-signed certs out of the way, keeping a copy if you need them later:

# cd /etc/ssl/private ; mv cert.key cert.key~ ; mv cert.pem cert.pem~

Now link in the Let's Encrypt certs. Note that we create one cert by concatenating three separate files - this puts a file in your /etc/sssl/certs directory that is NOT a symlink, so be aware.

# ln -s /etc/letsencrypt/live/yourbox.example.org/privkey.pem cert.key
# ln -s /etc/letsencrypt/live/yourbox.example.org/chain.pem cert_chain.pem
# cat /etc/letsencrypt/live/yourbox.example.org/cert.pem /etc/letsencrypt/live/yourbox.example.org/privkey.pem /etc/ssl/private/dhparams.pem | tee /etc/ssl/certs/cert_combined.pem  # 'cat > file' doesn't work here, so use tee
# ln -s cert_combined.pem /etc/ssl/private/cert.pem

Now deal with permissions:

# chmod 400 cert_combined.pem
### this appears unnecessary # chown root.ssl-cert /etc/ssl/private/cert_combined.pem
# chown root.ssl-cert /etc/letsencrypt/archive
# chown root.ssl-cert /etc/letsencrypt/live
# chmod g+rx /etc/letsencrypt/archive
# chmod g+rx /etc/letsencrypt/live

Now, restart lighttpd* and stunnel so that these services will use the new keys:

# service lighttpd restart
# service stunnel4 restart

You may wish to tail /var/log/syslog after each of the above to check for error messages. Use your browser to validate that the Let's Encrypt cert is in use for the TKL Appliance main page as well as Webmin and shellinabox, both of which are served through stunnel4.

Notes:
*- assuming "lighttpd" web server is used; substitute "apache2"/"nginx" as appropriate.

Thanks for sharing Gordon. FWIW though by default both Webmin & Shellinabox run behind stunnel. That's probably why the cert.pem symlink is incorrect. Webmin does include it's own server so having that available is probably not such an issue (although it doesn't then pick up our improved cipher suite that we include in stunnel).

Shellinabox OTOH is an issue. AFAIK it doesn't support TLS OOTB; hence why we put it behind stunnel. The version in Debian has been patched to work around that and we will probably rebase on the Debian version at some point in the future. The reason why we still use our own fork is that we have already extensively tested it and haven't tested the Debian version.

I realized that my pasted docs are written based on 13.0. I'm going to set up 14.1 and I'll edit my comment above.

Updated my docs after setting up Let's Encrypt certs on a 14.1 OpenVPN appliance. I hope they're useful.

@gordon-morehouse - Thanks heaps. I just edited your post a little to note that it explicitly relates to lighttpd webserver. We had some confusion from a user who followed your exact instructions on an appliance that didn't include lighttpd and he was wondering why it didn't work! 😄

Closing this as all v14.2 appliances include a confconsole plugin to get (and set auto renewal of) Let's Encrypt certificates.

Please see the confconsole docs - the Let's Encrypt stuff is explicitly detailed here.

Sorry to write on this closed thread but I have another scenario, I already have a centralized management for my SSL certificates (Let's Encrypt) and the centralized tool allow me to script the deployment to a remote machine... would be nice if TurnKey had an API or way to add and update the SSL certs from external centralized management

@mhermosi

@mhermosi - no problem, apologies on my slow response.

Could you please elaborate on what you have in mind? On face value it sounds like it could be cool, but I'm not completely clear on exactly what you are after.

Also, I appreciate you posting on an existing issue that already somewhat fits with your request. However, in this case I am not keen to reopen this one. So it might be best to open a new issue and clarify exactly what you are suggesting. I can't guarantee that we will implement it in a timely fashion (or at all even) but as a new issue then at least it won't get forgotten! 😄

Navigation Menu

Repository navigation

Easy way to add SSL certs to TurnKey appliances #382

Installing LetsEncrypt SSL certs for HTTPS-based services

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Easy way to add SSL certs to TurnKey appliances #382

Description

Activity

l-arnold commented on May 27, 2015

l-arnold commented on May 27, 2015

l-arnold commented on May 29, 2015

JedMeister commented on May 31, 2015

JedMeister commented on Jun 12, 2015

dashohoxha commented on Dec 17, 2015

JedMeister commented on Dec 17, 2015

Dude4Linux commented on Jan 21, 2016

JedMeister commented on Jan 22, 2016

deutrino commented on May 9, 2016

deutrino commented on May 9, 2016

Installing LetsEncrypt SSL certs for HTTPS-based services

JedMeister commented on May 9, 2016

deutrino commented on May 9, 2016

deutrino commented on May 10, 2016

JedMeister commented on Jul 20, 2016

JedMeister commented on Jul 27, 2017

mhermosi commented on Mar 8, 2019

JedMeister commented on Mar 12, 2019

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions