Support for let's encrypt

[htgoebel]

Maybe this is more an issue for the pki-role?

Please add support for automatically generating keys and getting signed certificates using the EFF's Let’s Encrypt client. https://letsencrypt.org/

Let’s Encrypt allows getting officially signed certificates for free and within minutes.

If then this would automatically be combined it with HPKP (see #83), it'd be awesome :-)

[drybjed]

That would probably need to be its own separate role. I want to split debops.pki into smaller roles as well, but we will see.

As for Let's Encrypt support, I have one gripe with them - they want to ascertain that the client calling the service as control over port 443. This is one of the ports that require root privileged to be bound to, but not the only one since all ports < 1024 have this requirement. And I know that some of the ports available in this range are unused in the IANA registry. Right now Let's Encrypt conflicts with the webserver, and adding automated support for it is tricky. I hope that in the future LE team will support their own port, which would make things considerably easier.

Anyway, I've found out a blog entry which describes adding support of Let's Encrypt to pound, that might be a good first step to figuring out how to handle the process. Packages required by Let's Encrypt have just been packaged in Debian (python-acme, python-letsencrypt) so that will help move things along.

And Ansible roles are starting to appear as well: https://github.com/thefinn93/ansible-letsencrypt

[drybjed]

Just a heads up, first step to support Let's Encrypt in DebOps has been done - nginx is now configured to respond to or redirect ACME challenges: #91

[htgoebel]

Thanks. This looks very promising :-)

[ypid]

Issue is resolved by now. Anyone wants to close it 😉 ?