Request for advice on handling and use of Let´s Encrypt

[thorsten]

NethServer Version: 7
Module: let’s encrypt, virtual hosts

Hi all,

this is not a “problem support request”. It is more to get some idea of “best practice” and “possibilities” for let’s encrypt (I will call “LE” in the following). Therefor I think It is a good idea to summarize my experiences and derived questions.

Initially, I had just one LE certificate for two or three domain names:

This grew up to say 10 or 12 domain names for one certificate. I accept this as this as there was no doubt for me to create just one certificate for all. I shared arround the certificate by simple copy scipts as described here:

SSL certificates for Samba AD (NSDC host)

So, basically, all I need for this to work like I already expect it to work, would be for the letsencrypt routine to a) add the nsdc-hostname.domainname.tld to the list of requested CN’s, or ‘Domains’ as they are called in the Gui b) Next step is to simply copy the created certificate and key to the expected locations. Defaults are: cp /etc/pki/tls/certs/localhost.crt /var/lib/machines/nsdc/var/lib/samba/private/tls/cert.pem cp /etc/pki/tls/private/localhost.key /var/lib/machines/nsdc/var/l…

For some reson - honestly, I can not remember how I made it - i do have now three certifcates:

I am quite shure I managed this during set up of email autoconfig:

How to automatically configure email (Thunderbird, Outlook, and iOS/OSX Mail) with Nethserver

In an earlier thread, I discussed using static configuration files in a virtual host to automate configuration of your users’ email clients, with techniques that will work with Thunderbird, Outlook, and compatible email clients. One notable limitation of that method is that it does not work for iOS/OSX mail, so your Apple users will still need to configure their mail clients manually. This content has been moved to the wiki: https://wiki.nethserver.org/doku.php?id=email_autoconfig_module Web …

Q: Is this in generall possible within nethserver to create more than one LE Certificate?
Q: If so, how do I do that, e.g. by providing different e-mails?
Q: Will all of these certificates be updated after three month?

Currently, I do no only on module, virtualhosts, for which I can select the certificate to be used. This works very nice, e.g. I used the www certificate for the www vhost (2nd from bottom).

Q: Are there any other modules for which I can select a specific certificate (reverse proxy is vhost, isn’t it?)

Q: is it possible to use several / single certificates within nethserver

Additionally, I copied the certficate to the radius \etc\raddb\certificates\ directory and linked it to the experimentals nethserver-radius module, see here:

Nethserver-freeradius integration module

Hi, 1.: I like this module however It would be great to authentificate / authorisate against AD groups (one group per client, please) 2.: I am still stuck on how to use WPA2 enterprise with MAC. Any manuals, screenshots etc on the server as well as on the client side (Win 7, IOS preferred) are welcome 3.: Using the nethserver module to set paramters on my PC (Windows 7 / Firefox): I get an exit status (“error”) on saving any change of parameters - however it see…

The client (Windows 7) gets the certicate, but considers it as invalid.
Q: How can I share nethserver (and other) CAs to (windows, iphone) clients, is there any option to do this by AD policies?

TIA
Thorrsten

[danb35 (Dan)]

@thorsten

Q: Is this in generall possible within nethserver to create more than one LE Certificate?

Certainly possible to do it in Nethserver itself, but not certain if it’s possible through the server-manager.

@thorsten

Q: Will all of these certificates be updated after three month?

Unless the renewal script is very stupid, anything created by certbot should be renewed once it has less than 30 days’ validity remaining.

@thorsten

Q: How can I share nethserver (and other) CAs to (windows, iphone) clients, is there any option to do this by AD policies?

There shouldn’t be any need to do this with LE certs, as the root CA is trusted by default in all halfway-modern environments. Without knowing the actual error message, though, it’s hard to say what would have been happening there.