GoWiki | openbsd | Lets Encrypt

# OpenBSD Lets Encrypt

**Note:** replace `example.com` with your own domain in any of the following settings.

## Config

```
# crypto partition (optional)
mkdir -p /mnt/acme /mnt/ssl/private
chmod 750 /mnt/acme /mnt/ssl/private
```

Add this to your `/etc/acme-client.conf`:

```
authority letsencrypt {
        api url "https://acme-v02.api.letsencrypt.org/directory"
        account key "/etc/acme/letsencrypt-privkey.pem"
}
domain example.com {
        alternative names { www.example.com }
        domain key "/etc/ssl/private/example.com.key"
        domain certificate "/etc/ssl/example.com.pem"
        domain full chain certificate "/etc/ssl/example.com.fullchain.pem"
        sign with letsencrypt
}
```

## Challenge httpd config

More info at: [OpenBSD httpd](/wiki/OpenBSD+httpd)

```
server "example.com" {
  listen on * port 80
  location "/.well-known/acme-challenge/*" {
    root "/acme"
    request strip 2
  }
}
```

## Request Certificate

Delete your account-key if it exists: `rm /etc/acme/letsencrypt-privkey.pem`

Create a new account and domain-key: `acme-client example.com`

## Daily Cron

```
cat <<'EOF' >/usr/local/sbin/cron-acme-update
#!/bin/sh
/usr/sbin/acme-client example.com
exc=$?
if [ $exc -eq 1 ]; then
  sleep 120
  /usr/sbin/acme-client example.com
  exc=$?
fi
if [ $exc -eq 0 ]; then
  # add more daemons which use acme
  #rcctl restart smtpd
  #rcctl restart spamd
  rcctl restart httpd
fi
EOF
chmod 0700 /usr/local/sbin/cron-acme-update
echo "0 3 * * * /usr/local/sbin/cron-acme-update >/dev/null 2>&1" >> /var/cron/tabs/root
```

## Adding more subdomains

Revoke old domain: `acme-client -r example.com`

Add new subdomain to `/etc/acme-client.conf`:

```
domain example.com {
        alternative names { www.example.com, subdomain.example.com }
...
```

Request new certificate: `acme-client example.com`

Restart all services which use the certificate.