Simplify handling of custom Certificates renewal

[dpaessler]

Despite the fact, that I use Certificates provided by Let's Encrypt, I have to use them as custom Certificates in nginx-ignition, because my hosting provider is not supported. That's fine so far.
But to renew the Certificates, for every configured host I have to:

• add a standard binding for the host (HTTP)
• remove the configured binding (HTTPS)
• remove the Certificate
• upload the new Certificate
• add a standard binding for the host (HTTPS) with the new Certificate selected
• remove a standard binding for the host (HTTP)

So my ideas for simplifying this process are:

1. Automate the above steps when renewing a custom Certificate

2. Using a host volume in docker, which contains the actual Certificates.
   Let's Encrypt stores them in a directory structure like this:

   /etc/letsencrypt/live/
   ├── host1.server.com
   ├── host2.server.com
   ├── host3.server.com
   ├── host4.server.com
   ├── host5.server.com
   └── host6.server.com

   with each directory containing symlinks to the actual Certificates:

   /etc/letsencrypt/live/
   ├── hostX.server.com
      ├── cert.pem -> ../../archive/hostX.server.com/cert2.pem
      ├── chain.pem -> ../../archive/hostX.server.com/chain2.pem
      ├── fullchain.pem -> ../../archive/hostX.server.com/fullchain2.pem
      ├── privkey.pem -> ../../archive/hostX.server.com/privkey2.pem
      └── README

   So maybe by pointing nginx-ignition to the directory containing the actual Certificates instead of uploading them, nginx-ignition
   would always point to the actual Certificates (or import them periodically, if this is necessary).

3. Maybe other ways handling this?

Thanks again for this great project!

Daniel

[lucasdillmann]

Hi @dpaessler, I hope you're doing well.

Thanks for the feedback and suggestion. I agree with you that when a DNS provider isn't directly supported (which is something I don't control directly since Ignition uses go-acme under the hood), managing certificates manually is quite cumbersome, especially when using Certbot (and similar tools) where certificates expire every 3 months or less.

I started working on a better integration for those external tools along the lines of what you suggested. You will be able to specify the filesystem paths (the symlinks for cert.pem, chain.pem, and privkey.pem), and Ignition will automatically pick up the new certificates when they are changed by the external tool. This check and automatic Nginx reload will happen every 12 hours by default (which can be changed in the global settings) or can be triggered manually through the "Renew" button in the UI.

This extra step of periodically checking for file changes, instead of referencing them directly in Nginx, is necessary because Ignition is built in a way where the database is the only persistent state and everything else is ephemeral (which prevents a lot of issues when the Docker container is recreated, like in a version upgrade). Since certbot renews the certificate from 30 days down to 24 hours before its expiration, this shouldn't be a problem.

The main implementation is ready, I just need a couple of days to test it thoroughly. I'll come back here to update the thread when it's stable and available.

Again, thanks for the suggestion.

[dpaessler]

thanks, sounds good.

[lucasdillmann]

@dpaessler, version 2.37.0 is out with support for certificates managed by external tools (and more, like support for new DNS providers). If possible, could you give me some feedback on whether it's working as expected?

[dpaessler]

that was quick, thank you a lot.
I will test and give feedback as soon as possible.

[dpaessler]

First test looks good so far, thanks again.
If I run into any issues, I will get back and report.
Have a great day!

[lucasdillmann]

Thanks for the feedback, @dpaessler.
Have a great day too.