Jamie/Joe,
It has come to my attention that the Let's Encrypt functionality built into Webmin and Virtualmin could use a much needed improvement.
Scenario #1 - Virtualmin installed with Apache - In this instance, everything works fine as intended since the Acme client can connect and do it's automatic validation without issue.
Scenario #2 - Webmin Installed with No Virtualmin and/or Apache - In this instance, we run into a problem. The only way to validate a certificate is to manually install the Acme client and setup the certificate via the command line.
To deal with this model, you could make use of the DNS validation model, where the Acme client will produce a DNS record that can be installed, then validated against the Acme server accordingly.
This addition would make it possible to install a Webmin Let's Encrypt certificate where the server is for instance running as a dedicated "DNS", "MySQL", or "Email" server.
I hope this suggestion helps in further developing the integration of Let's Encrypt which has been one of the best major additions to Webmin/Virtualmin since the introduction of the new Authentic Theme.
Cheers!
Comments
Submitted by JamieCameron on Fri, 01/13/2017 - 10:40 Comment #3
DNS validation is a good idea - even when Apache is installed, a lot of users have proxies or redirects setup in a way that breaks it. I will look into adding this in a future release ..
Submitted by JamieCameron on Sun, 02/05/2017 - 20:03 Comment #4
The next releases of Webmin / Virtualmin will support DNS-based validation for Let's Encrypt.
Submitted by JamieCameron on Sun, 02/05/2017 - 20:04 Comment #5
While on the topic of Let's Encrypt, I know that "generate-letsencrypt-cert" creates them, but what if I didn't specify an automatic renewal period, and don't want to use the renewal option from the control panel, is it possible?
Also, I noticed on the website, there's no documentation for the "generate-letsencrypt-cert" option as of yet. Perhaps a browse over the API command catalog might be an order to make sure all the current commands have been cataloged and/or updated.
-Peter
Submitted by JamieCameron on Thu, 02/09/2017 - 23:09 Comment #8
I don't quite follow what you are looking to do with the renewal here?
FYI, you can always get help on API commands by running
virtualmin generate-letsencrypt-cert --helpJamie,
Theoretically when you run the command "virtualmin generate-letsencrypt-cert --domain test.com" the certificate would be created with an expiry of 3 months.
In this example, there is NO auto-renewal date. Do you see my point now?
-Peter
Submitted by JamieCameron on Fri, 02/10/2017 - 17:29 Comment #10
Oh I see. In that case, you can add the flag
--renew 2to that command to also setup automatic renewal.