Thanks for pulling this together, set this up on my lab appliance and it's working well so far. the hook script needs tweaking to use the BASE_DIR variable instead of /root/certs, other than that it worked great out of the gate. (I think the fullchain.pem statement is obsolete now also btw)
Great, it's working ! I was already using this shell script extensivly on autonomus servers. I was even able to scp and ssh into a remote unit to update its certificate by modifying the hook script.
Thanks a lot for putting this together.
Does anyone know if there needs to be a tweak made to get this working for v11.2.1? When the script reaches the following tmsh modify command:
** tmsh modify ltm profile client-ssl ${profile} cert-key-chain replace-all-with { default { key $key cert $cert } } **
it gives me the error:
** Syntax Error: "default" unknown property **
Just tried this and am having a strange problem. On my dev F5 it works without any issues. However, on my prod F5 I get an error.
During the deploy_cert stage when it tries to install the key/cert it gives the error
01070712:3: file (/opt/letsencrypt/certs/somedomain/privkey.pem) expected to exist.
privkey.pem is a symlink to privkey-{timestamp}.key. Testing the install command in the cli with the real file works. Using the symlink gives the above error. Are there permissions settings somewhere I'm missing which would result in the above error?
curl -v https://acme-v01.api.letsencrypt.org
* About to connect() to acme-v01.api.letsencrypt.org port 443 (0)
* Trying 104.123.211.71... connected
* Connected to acme-v01.api.letsencrypt.org (104.123.211.71) port 443 (0)
* successfully set certificate verify locations:
* CAfile: /etc/pki/tls/certs/ca-bundle.crt
CApath: none
* SSLv3, TLS handshake, Client hello (1):
} [data not shown]
* SSLv3, TLS handshake, Server hello (2):
{ [data not shown]
* SSLv3, TLS handshake, CERT (11):
{ [data not shown]
* SSLv3, TLS alert, Server hello (2):
} [data not shown]
* SSL certificate problem, verify that the CA cert is OK. Details:
error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
* Closing connection 0
curl: (60) SSL certificate problem, verify that the CA cert is OK. Details:
error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
More details here: http://curl.haxx.se/docs/sslcerts.html
curl performs SSL certificate verification by default, using a "bundle"
of Certificate Authority (CA) public keys (CA certs). If the default
bundle file isn't adequate, you can specify an alternate file
using the --cacert option.
If this HTTPS server uses a certificate signed by a CA represented in
the bundle, the certificate verification probably failed due to a
problem with the certificate (it might be expired, or the name might
not match the domain name in the URL).
If you'd like to turn off curl's verification of the certificate, use
the -k (or --insecure) option.
Updated my BIGIP to 11.6.1. That seems to have resolved the SSL issue. I ran the script again and now it alerted me that the LICENSE pdf was outdated so I updated it to the lates version and tried to run the script again.
./letsencrypt.sh -c
: No such file or directory
Running ls lets me know the file is there.
letsencrypt ls -a -l
total 59
drwxr-xr-x 3 root root 1024 Feb 14 11:33 .
drwxr-xr-x 28 root root 1024 Feb 14 11:18 ..
drwxr-xr-x 2 root root 1024 Feb 14 11:24 .acme-challenges
-rwxr-xr-x 1 root root 3529 Feb 10 14:14 config
-rwxr-xr-x 1 root root 32 Feb 14 11:21 domains.txt
-rwxr-xr-x 1 root root 3429 Jan 11 16:10 hook.sh
-rwxr-xr-x 1 root root 37807 Feb 14 11:29 letsencrypt.sh
-rwxr-xr-x 1 root root 390 May 29 2016 wrapper.sh
I just tested the latest version of the script (which now is called dehydrated) from Lukas and it works nicely. Remember to update WELLKNOWN variable and update the hook.sh file which has some minor changes to it.
Could you update the installation instructions to include the use of dehydrated or is it just required to replace the letsencrypt.sh file with the new dehydrated file? Could you also please explain what needs to be updated with regards to WELLKNOWN and hook.sh?
I changed also to dehydrated.
My changes.
uncommented WELLKNOWN in the config file.
I also used the hook.sh from dehydrated and pasted the commands from the hook.sh of lnxgeek into the new hook.sh file.
It is very obvious with commands you will need.
(for some reasons i cannot add the hook.sh i made here)
beyond the article, do you have a step by step tutorial for implementing this within F5 BIG IP?
How the flow works? F5 is passing the challenge to one specific web server to do the challenge/response or F5 itself is the one that carry this out?
Does this script distribute the new certificate (request or renew) to all the web servers in my farm?
It has any support to automatically configure IIS/Apache or other webservers or it only gets the certificate and is up to the administrator to configure the certificate on each web server?
Has this script any limitations in terms of webserver´s platforms or is independent?
Create clientssl profile matching your domains (see blog)
Populate domain.txt with your domains
Make appropriate changes to the config file
Assign iRule to the VS which is assigned to your domains (basically this is where the challenge-response traffic is handled and where your DNS is pointed)
The certificates lives on the F5, this is the point with this script implementation. So there is no distribution of the certificates unless you put it into the hook script. The best way of using SSL/TLS is to have it handled in front of the web servers by the F5 and run cleartext against the servers.
The script is completely independent of any device, server, service type you put the F5 in front. The dependency is tight to the F5.
I have just updated the solution with OCSP stapling.
After too many hours digging around getting OCSP to work properly on the BigIP I've made a small change to the hook script making it possible to get OCSP stapling working. For now it is only v.13 compatible but it should be a minor hack to get it working on other versions.
I noticed this runs from a cron job. During firmware upgrades do cron jobs get retained? Or if we implemented this would we need to take care when upgrading our firmware to re-create the cron jobs? Anyone know?
You are right, it is "upgrade sensitive" 🙂 It wish I could manage at the time. What you can do is make the call through an iScript, then it will move with the upgrade.
if you frequently add subdomains you can save yourself a little effort by building your domains list dynamically (this assumes that your vips are named for the fqdn so , shop.example.com, etc):
Hoping someone might have come across this before or can point me in the right direction? I'm currently using VE of BIG-IP running 11.6.1 Build 0.0.317 Final. I have everything in place just like the article explains but I'm getting following messages.
01070712:3: file (/home/admin/dehydrated/shared/letsencrypt/certs/qa.pdaa.penton.com/privkey.pem) expected to exist.
01070712:3:file(/home/admin/dehydrated/shared/letsencrypt/certs/qa.pdaa.penton.com/fullchain.pem) expected to exist.
010717e3:3: Client SSL profile must have RSA certificate/key pair.
Vince,
you need to move the script out of "/home" as this filesystem is very small and not intended to be used like this. Use /shared instead and then make sure backup handles this as well.
I haven't seen your errors before but can you verify that the files are in order and exist?
Thanks for the quick response and for the work you put into this, great stuff. As for the privky and fullchain they do they do exist under the certs directory. I even went through the process of manually adding them to the f5 and re-running dehydrated as test but saw the same result. I’ll move the entire directory out of home as you suggest and try again.
