Git Product home page Git Product logo

cf-letsencrypt's Introduction

cf-letsencrypt

Let's Encrypt wrapper for Cloud-Foundry

Create certificates for your Cloud-Foundry-hosted apps and domains using Let's Encrypt.

Using the --path argument of the map-route command, you can specify just a path to be directed to a separate app. The benefit, in this situation, is that you can renew your certificates with zero downtime for your apps by running the letsencrypt code in a separate instance without disrupting your application.

NAME:
   map-route - Add a url route to an app

USAGE:
   cf map-route APP_NAME DOMAIN [--hostname HOSTNAME] [--path PATH]

EXAMPLES:
   cf map-route my-app example.com                              # example.com
   cf map-route my-app example.com --hostname myhost            # myhost.example.com
   cf map-route my-app example.com --hostname myhost --path foo # myhost.example.com/foo

OPTIONS:
   --hostname, -n   Hostname for the route (required for shared domains)
   --path           Path for the route

Firstly you must have your cf cli configured, domains created, and DNS configured to point to your CF provider.

Once you have that, just edit the domains.yml file checked out from this repo and run python setup-app.py.

This will push the app, map all the routes for the auto-check that LetsEncrypt needs to do to verify that you own the domain. It maps host.domain/.well-known/acme-challenge to this app for each domain/host that you want to generate a certificate for.

The LetsEncrypt client will sign the requests, go through the verification and fetch the signed certificates that you can then fetch with the cf files command.

Just watch the logs to see when the process has finished. cf logs letsencrypt

While you could leave the app running, it probably makes sense to stop it when you don't need it, and just start it up when you need to renew certificates or add another host/domain. By default it will keep running for 1 week, then kill itself. DEA will then try to restart it for you...

cf-letsencrypt's People

Contributors

bsyk avatar jlstack avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar

cf-letsencrypt's Issues

Cloud Foundry upload fullchain.pem

Hi Ben

I am stuck with the certificates after successfully generating them. I have four files from letsencrypt but I am unsure how to proceed next with those files.

  1. cert.pem
  2. chain.pem
  3. fullchain.pem
  4. privkey.pem

It should be possible to upload fullchain1.pem certificate to Cloud Foundry to a Custom Domain but I do not find the right commands in the CLI. Could you please clarify about the steps needed after the certificates are created with Let's Encrypt?

Best regards,
Ben

Problem with Certs Ready

Hi i got this error when execute the app following this tutorial : https://www.ibm.com/blogs/bluemix/2016/08/securing-custom-domains-lets-encrypt/

Certs not ready yet, retrying in 5 seconds.
Certs not ready yet, retrying in 5 seconds.
Certs not ready yet, retrying in 5 seconds.

It has been 1 minutes without seeing certificates issued in the log. Something probably went wrong. Please check the output of cf logs letsencrypt --recent for more information.

Any ideas> Thanks

letsencrypt cli module has no attribute 'main' - outdated?

I recently tried using this application and received the following output:

OUT Calling letsencrypt...
ERR Traceback (most recent call last):
ERR File "run.py", line 64, in
ERR cli.main(args)
ERR AttributeError: 'module' object has no attribute 'main'

It seems like this repository is referencing an older letsencrypt pacakage, is that right?

Also, I believe that letsencrypt dependency requires root access. Do you know of an approach to get around this stipulation?

code 501, message Unsupported method ('OPTIONS')

I'm using PCF on Pivotal Web Services, the SSL certs aren't getting served, the error in the logs is:

2018-04-24T23:21:23.015-07:00 [APP/PROC/WEB/0] [ERR] 10.255.149.244 - - [25/Apr/2018 06:21:23] code 501, message Unsupported method ('OPTIONS')
2018-04-24T23:21:23.015-07:00 [APP/PROC/WEB/0] [ERR] 10.255.149.244 - - [25/Apr/2018 06:21:23] "OPTIONS /.well-known/acme-challenge//cloudfoundryapplication HTTP/1.1" 501 -
2018-04-24T23:21:23.019-07:00 [RTR/11] [OUT] api-dev.event-local.com - [2018-04-25T06:21:23.011+0000] "OPTIONS /.well-known/acme-challenge//cloudfoundryapplication HTTP/1.1" 501 0 220 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Safari/537.36" "REDACTED" "REDACTED" x_forwarded_for:"REDACTED" x_forwarded_proto:"https" vcap_request_id:"7ac50568-3316-4b03-4639-ecea659db378" response_time:0.008216018 app_id:"a199ffad-bca2-4224-b784-8dbdd0c7ffde" app_index:"0" x_b3_traceid:"678ed5356fdd553e" x_b3_spanid:"678ed5356fdd553e" x_b3_parentspanid:"-"

Support CF Diego

Add support for Cloud Foundry Diego containers.
Would need to detect if app is diego enabled, then change approach for checking/reading files as Diego removes the cf files command and introduces cf ssh commands.

Option to create separate certificates for each domain

Currently a single certificate will be created for all domains and hosts listed in the configuration file. It may be desirable to get a separate certificate for each domain if separate load-balancers / SSL terminators are being configured for each domain.

Locations reported incorrectly for cf files commands

Mentioned by @jlstack in #1 (comment)

My domains.yml has the following:

"domains": [
  {
    "domain": "mydomain.com",
    "hosts": [
      "www"
    ]
  } 
]

The logs at the end say:

Fetch the certs and logs via cf files ...
You can get them with these commands:
cf files letsencrypt app/conf/live/mydomain.com/cert.pem
cf files letsencrypt app/conf/live/mydomain.com/chain.pem
cf files letsencrypt app/conf/live/mydomain.com/fullchain.pem
cf files letsencrypt app/conf/live/mydomain.com/privkey.pem

The files are actually located at the following locations:

cf files letsencrypt app/conf/live/www.mydomain.com/cert.pem
cf files letsencrypt app/conf/live/www.mydomain.com/chain.pem
cf files letsencrypt app/conf/live/www.mydomain.com/fullchain.pem
cf files letsencrypt app/conf/live/www.mydomain.com/privkey.pem

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    ๐Ÿ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. ๐Ÿ“Š๐Ÿ“ˆ๐ŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google โค๏ธ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.