Setting Let’s Encrypt in Lighttpd

https://letsencrypt.org/: Let's Encrypt is a free, automated, and open Certificate Authority.

Serving site via HTTP means that user interaction with server can be intercepted, studied, altered.

If you are prompted to enter password on HTTP page most probably it will be send in clear text through HTTP...

Browsers have ability to secure interaction with user. It is described by SSL/TSL standards.

Unfortunately during time of creation of these standards they dealt with another problem - how user can trust server. It is resolved with using certificates.

Certificated are ordered in chain of trust. Certificate issuers ask browser vendors to include their root certificates in browser distribution. Root certificates are trusted by default.

Certificate issuers sell signatures for site certificates and site owner embeds this certificate with signature into a web servers.

Browser gets site owner's certificate with issuer's signature along with HTML pages. Browser checks if issuer is known and included in trusted database and if all OK it decides to trust to site and to establish encrypted connection with a server.

While authentication of server is a good thing call for secured communication is more important nowadays.

It is possible to establish secure connection between server and browser without selling signatures but industry stuck with specific historical implementation and can't move further.

Let’s Encrypt project bring encryption to historical implementations by supplying site owners with free of cost SSL/TSL certificates.

Their root certificate is already included in all major browsers and software distributions certificate stores. Of cause this root certificate marked as weak and have only intention to establish encryption between points.

Let’s Encrypt organization performs basic checks before singing your certificate - do you own domain name and server behind that domain name.

They developed a protocol to automate issuing of certificate signatures.

certbot is client that implement that protocol.

https://certbot.eff.org/: Automatically enable HTTPS on your website with EFF's Certbot, deploying Let's Encrypt certificates.

It is available in Debian repositories:

$ sudo apt install python-certbot

certbot designed to be extensible via plug-ins but at this moment there is no plug-in for Lighttpd. Although there is generic method implemented in webroot plug-in that provide automatic updated of certificates.

webroot plug-in put special files into you site web root directory under /.well-known/ sub-directory and Let’s Encrypt service expect to find that file under HTTP /.well-known/ path to be shure that you are domain/site owner.

Cron job for lighttpd and certbot is:

#!/bin/sh

# -q  quiet
# -n  do not prompt
#  --webroot  plugin
certbot certonly -n --expand --webroot \
  -w /srv/www/base/ -d defun.work \
  -w /srv/www/blog/ -d blog.defun.work \
  -w /srv/www/resume/ -d resume.defun.work \
  -w /srv/hg/ -d hg.defun.work

cert=/etc/letsencrypt/live/defun.work/cert.pem
privkey=/etc/letsencrypt/live/defun.work/privkey.pem
chain=/etc/letsencrypt/live/defun.work/chain.pem
fullchain=/etc/letsencrypt/live/defun.work/fullchain.pem

server_pem=/etc/lighttpd/server.pem
chain_pem=/etc/lighttpd/chain.pem

cat $privkey $cert >$server_pem
cat $chain >$chain_pem

service lighttpd restart

Paths to certificates is defined in one of:

$ cat /etc/letsencrypt/renewal/defun.work.conf

# renew_before_expiry = 30 days
version = 0.9.3
cert = /etc/letsencrypt/live/defun.work/cert.pem
privkey = /etc/letsencrypt/live/defun.work/privkey.pem
chain = /etc/letsencrypt/live/defun.work/chain.pem
fullchain = /etc/letsencrypt/live/defun.work/fullchain.pem

# Options used in the renewal process
[renewalparams]
authenticator = webroot
installer = None
account = XXXXXX
webroot_path = /srv/www/base, /srv/www/blog, /srv/www/resume, /srv/hg
[[webroot_map]]
resume.defun.work = /srv/www/resume
defun.work = /srv/www/base
hg.defun.work = /srv/hg
blog.defun.work = /srv/www/blog

Configuration for static site hosting by lighttpd looks like:

$ cat /etc/lighttpd/conf-available/92-resume.conf

$HTTP["host"] == "resume.defun.work" {
  server.document-root = "/srv/www/resume"
}

Configuration for SSL:

$ cat /etc/lighttpd/conf-available/10-ssl.conf

$SERVER["socket"] == "0.0.0.0:443" {
  ssl.engine  = "enable"
  ssl.pemfile = "/etc/lighttpd/server.pem"
  ssl.ca-file = "/etc/lighttpd/chain.pem"

  ssl.cipher-list = "ECDHE-RSA-AES256-SHA384:AES256-SHA256:!RC4:HIGH:!MD5:!aNULL:!EDH:!AESGCM"
  ssl.honor-cipher-order = "enable"
}

The only problem I had was with GCI hosted Mercurial.

I added exception in activation of CGI, any request to /.well-known/ is hosted as file resource:

$ cat /etc/lighttpd/conf-available/92-hgweb.conf

$HTTP["host"] == "hg.defun.work" {
  server.document-root = "/srv/hg"
  url.rewrite-once = (
    "/static/avatar/(.*)" => "/$1",
    "/.well-known.*" => "$0",
    "^/?(.*)" => "/hgweb.cgi/$1",
  )
  $HTTP["url"] !~ "^/.well-known" {
    cgi.assign = ( "/hgweb.cgi" => "" )
  }
  setenv.add-environment = ( "HGWEB_CONFIG" => "/srv/hg/hgweb.config" )
  dir-listing.activate = "disable"
  index-file.names = ()
}

Let’s Encrypt issues single SAN (Subject Alternative Name) certificate and with modern browsers this allows serving virtual hosts via HTTPS even from single IP.

Feeds

Tags

Archive