Overview of how phcl_acme works with acme_tiny

Four scripts

There are four scripts. These are written to be simple, which means that they are easy to audit

1. CreateSigningRequests from a family.cnf file generates a family.csr file
2. CheckSiteAccess examines a family.csr and checks that Apache is correctly configured so that Let's Encrypt will sign the certificate
3. GetSignedCertificate requests Let's Encrypt to sign a family.csr returning a family.cst
4. RenewCertificates keeps expiring certificates from expiring — run from cron

There is also InitialSetup, only run once (by root) to set up directory structure, create users.

Users & directory location

Two users are created:

• rsa. This user runs CreateSigningRequests & CheckSiteAccess
• acme. This user talks to Let's Encrypt runs GetSignedCertificate & RenewCertificates. These scripts run acme_tiny.py

The HOME directory for both of these users is /var/www/acme/

The user names & base directory can easily be changed.

What is in /var/www/acme/

Note also directory permissions. Some files are very sensitive and must be kept secure to keep the web server secure.

• /acme-challenge/ This is where acme_tiny.py puts the challenge files that Let's Encrypt asks it to. This has to be writable by acme and files in it readable by Apache to provide the response that Let's Encrypt needs. This will be mapped in each vhost in the family by an Apache configuration line like:

             Alias /.well-known/acme-challenge/ "/var/www/acme/acme-challenge/"
             

  This also contains an index.html that is used by CheckSiteAccess
• SSLConfigs/ This is where you will create family configuration files. EXAMPLE.cnf can be used as a starting point
• CertificateSigningRequests/ CSRs written here by script CreateSigningRequests using a family configuration file in SSLConfigs/
• RSAprivateKeys/ private keys written here by script CreateSigningRequests. These are precious and must be kept secret. Apache needs to read them. Ensure that these are not readable by any user than rsa and the group of the Apache process.
• SignedCertificates/ signed certificates written here by script GetSignedCertificate using CSRs in CertificateSigningRequests/
• LetsEncryptAccounts/ created by script GetSignedCertificate
• Renewals.list a list of certificate family names used by RenewCertificates
• Templates templates that expand to the files:
  • Renewal.crontab a crontab for the user acme that you should consider
  • httpd.conf.challenge to be put into vhost configuration during the first stage edit
• tmp temporary file space needed by GetSignedCertificate & RenewCertificates
• bin where all the scripts live
• ACMEUSER the username acme or your local choice
• RSAUSER the username rsa or your local choice
• DIST the contents of the unpacked tar file LetsEncryptManage-version.release-0.0.tar.gz
• .rnd where the OpenSSL program to store entropy (randomness)

Next page: Install of phcl_acme

Return to How to Configure Let's Encrypt with acme_tiny.py