Using ACME v2 and possibility of generate wildcard certificates

janeczku / rancher-letsencrypt

:cow: Rancher service that obtains and manages free SSL certificates from the Let's Encrypt CA

Apache License 2.0

326 stars 114 forks source link

Using ACME v2 and possibility of generate wildcard certificates #114

Open asdek opened 6 years ago

asdek commented 6 years ago

Hello,

Major changes for this version are using ACME v2 and possibility of generate wildcard certificates
Bump version of lego to 1.0.1
Also, I took the liberty to change the version of the package to v1.0.0, similarly lego
Updated square/go-jose to v2
Updated aws/aws-sdk-go, Sirupsen/logrus, Azure/azure-sdk-for-go, Azure/go-autorest packages

marcbachmann commented 6 years ago

Awesome, thanks for the update. 👏 I already found one small issue which either could use a fix or just some additional documentation.

The configuration DOMAIN=*.subdomain.example.com,*.example.com fails with the following error:

urn:ietf:params:acme:error:malformed - Error creating new order :: DNS name had a malformed wildcard label

Changing the order to DOMAIN=*.example.com,*.subdomain.example.com works.

graemer957 commented 6 years ago

Nice work @asdek 👍🏻

I tried to use this morning, but ran into a problem:

03/07/2018 11:43:59time="2018-07-03T10:43:59Z" level=info msg="Starting Let's Encrypt Certificate Manager v1.0.0 eb89fad" 03/07/2018 11:44:01time="2018-07-03T10:44:01Z" level=info msg="Generating private key (2048) for email@address.com." 03/07/2018 11:44:02time="2018-07-03T10:44:02Z" level=fatal msg="LetsEncrypt client: Could not create client: directory missing new registration URL"

Looks like this is fixed https://github.com/xenolf/lego/issues/562, but I believe you are already using v1.0.1 of lego?

graemer957 commented 6 years ago

This only looks to be a problem if you set API_VERSION to Sandbox, which we do first to test the settings. A quick look around I couldn't find if this is supported or not for wildcard certificates.

livehybrid commented 6 years ago

👍 on this one

guatedude2 commented 6 years ago

bump

emilnygaard commented 6 years ago

Bump 👍

radeno commented 6 years ago

@asdek thanks fro great work. hope @janeczku will merge it and release new version soon. What about storing also chain.pem and cert.pem as separate files? Fullchain is nice, but is too large for OCSP stapling https://github.com/janeczku/rancher-letsencrypt/issues/105 to increase handshake and lowering time to first byte.

radeno commented 6 years ago

@asdek it is likely that @janeczku abandon this project. There is the way how to make your work to go public. Ask to https://github.com/rancher/community-catalog maintainers to use your fork or ask them to add new catalog. Don't know what is easier, but we should do that. I think there is hundreds if no thousands users of this software.

But there is second question. Do you wanna maintain it? (new PRs, new features, bugfixes etc)

annerajb commented 5 years ago

I doubt this will ever be merged considering Rancher has now moved to 2.0 and they don't seem to want to do any sort of development to 1.6 environments. best bet is to fork it and use a community catalog.

hajnalmt commented 5 years ago

This is quite sad, that this project is abandonned.

fridgerator commented 5 years ago

@asdek Is it possible to us this in Rancher 1.6 without the Rancher Catalog?

I noticed there is a vxcontrol/rancher-letsencrypt repo on docker hub. Can I just use this directly?

fridgerator commented 5 years ago

I guess I answered my own question, this seems to work :+1:

fridgerator commented 5 years ago

I've created instructions for creating new services with the forked version of this repo manually : https://gist.github.com/fridgerator/db607d268f1f99329c8f9449e89abb4f