search

krtab / agnos

Obtain (wildcard) certificates from let's encrypt using dns-01 without the need for API access to your DNS provider.
MIT License
304 stars 8 forks source link

Offer the possibility to re-use account information from other tools #24

Open krtab opened 1 year ago

krtab commented 1 year ago

Not sure how common my use case is, but:

I desperately wanted to use a LE wildcard, but my DNS provider does not have an API. I was so glad I found this tool! However, when realizing I had to provide an RSA key and, being a prior certbot user, could only find a weird json key file (/etc/letsencrypt/accounts/acme-v02.api.letsencrypt.org/directory/<uid>/private_key.json), I was a bit puzzled.

After a bit of googling, I found a thread with several code samples or links, dealing with how to convert that key into RSA. There's Java and Go, and I also found a Python script which I ended up using.

So now that there are three different implementations, I wonder if this could be adapted and added to agnos so it would accept either an RSA key or the JSON format that probably many users are going to already have if they're switching from certbot with non-wildcard certificates.

(btw, thank you so much, this tool is ingenious and awesome!)

Originally posted by @Jay2k1 in https://github.com/krtab/agnos/issues/19#issuecomment-1419705509

justinas commented 1 year ago

@Jay2k1 One ray of hope for you is: I don't think you need to keep the same account at all? From what I've read, the "account" is only used to associate your email with the cert, and you get email notifications if your certbot fails to renew in time. That's it. There is no validation against creating another "account" using the same email, or issuing the certificate using a different account than before.

I'm pretty sure I've migrated my domains between different ACME clients at least a couple times, creating a new "account" each time and had no problems (other than false positive email reminders).