OpenBSD Lets Encrypt

Note: replace example.com with your own domain in any of the following settings.

Config

# crypto partition (optional)
mkdir -p /mnt/acme /mnt/ssl/private
chmod 750 /mnt/acme /mnt/ssl/private

Add this to your /etc/acme-client.conf:

authority letsencrypt {
        api url "https://acme-v02.api.letsencrypt.org/directory"
        account key "/etc/acme/letsencrypt-privkey.pem"
}
domain example.com {
        alternative names { www.example.com }
        domain key "/etc/ssl/private/example.com.key"
        domain certificate "/etc/ssl/example.com.pem"
        domain full chain certificate "/etc/ssl/example.com.fullchain.pem"
        sign with letsencrypt
}

Challenge httpd config

More info at: OpenBSD httpd

server "example.com" {
  listen on * port 80
  location "/.well-known/acme-challenge/*" {
    root "/acme"
    request strip 2
  }
}

Request Certificate

Delete your account-key if it exists: rm /etc/acme/letsencrypt-privkey.pem

Create a new account and domain-key: acme-client example.com

Daily Cron

cat <<'EOF' >/usr/local/sbin/cron-acme-update
#!/bin/sh
/usr/sbin/acme-client example.com
exc=$?
if [ $exc -eq 1 ]; then
  sleep 120
  /usr/sbin/acme-client example.com
  exc=$?
fi
if [ $exc -eq 0 ]; then
  # add more daemons which use acme
  #rcctl restart smtpd
  #rcctl restart spamd
  rcctl restart httpd
fi
EOF
chmod 0700 /usr/local/sbin/cron-acme-update
echo "0 3 * * * /usr/local/sbin/cron-acme-update >/dev/null 2>&1" >> /var/cron/tabs/root

Adding more subdomains

Revoke old domain: acme-client -r example.com

Add new subdomain to /etc/acme-client.conf:

domain example.com {
        alternative names { www.example.com, subdomain.example.com }
...

Request new certificate: acme-client example.com

Restart all services which use the certificate.