I’ve been looking into migrating to Let’s Encrypt for a while now, but due to my server setup for some reason the webroot method just wasn’t working for me (and is ugly in general). For a very long time I’ve always validated my domains ownership via a DNS TXT record and I find that much more elegant (personal preference).

I didn’t realize Let’s Encrypt had a --preferred-challenges dns option, which as far as I know only works with the manual plugin. I tried it. It was ugly. The reason being it was, obviously, a manual process. Therefore every time you run the certbot command you need to manually edit your TXT record with the value that will be generated.

I usually tend to stay away from third-party solutions, but from the sparse documentation I’ve seen dehydrated seemed like the way to go. It seems pretty well vetted so I’ll go with that. Here’s how my setup ended up looking like.

git clone https://github.com/certbot/certbot.git /opt/certbot
git clone https://github.com/lukas2511/dehydrated.git /opt/dehydrated
# I lied, I first forked the above repo and cloned my fork because no real reasons
cd /opt/dehydrated
git clone https://github.com/NatsumiHoshino/letsencrypt-cloudflare-hook.git hooks/cloudflare
pip install -r hooks/cloudflare/requirements.txt

Next, I simply need to create a bash script for each domain I want to validate. It would look something like:

#!/usr/bin/env bash
export CF_EMAIL='<cloudflare email>'
export CF_KEY='<cloudflare key>'

/opt/dehydrated/dehydrated \
        --cron \
        --domain mydomain.example.com \
        --challenge dns-01 \
        --hook '/opt/dehydrated/hooks/cloudflare/hook.py'

Then this script can be run on as a service (my preferred method) or as a cron job.

However this is where it gets interesting. I have some devices on which it is not easy to install the Let’s Encrypt client, such as my router or printer (because why not?). However, with this approach, I can validate ANY domain I own. For my router, I append the following to the above script:

if [ /mnt/my-cifs-share/cert.pem -ot /opt/dehydrated/certs/router.example.com/fullchain.pem ]; then
        logger "[certbot] A new cert has been created, uploading"
        cp -f /opt/dehydrated/certs/router.example.com/fullchain.pem /mnt/my-cifs-share/cert.pem
        cp -f /opt/dehydrated/certs/router.example.com/privkey.pem /mnt/my-cifs-share/key.pem
else
        logger "[certbot] Cert still valid"
fi

What this does is copy the new certificate and private key to a mounted share if the file is newer, in other words if a certificate renewal has occurred. On the router side, I handle the remaining tasks:

#!/bin/sh
if [ /cifs1/cert.pem -nt /tmp/etc/cert.pem ]; then
        logger "[certbot] New cert found, updating"
        cp -f /cifs1/cert.pem /tmp/etc/cert.pem
        cp -f /cifs1/key.pem /tmp/etc/key.pem
        tar -C / -czf /tmp/cert.tgz /tmp/etc/cert.pem /tmp/etc/key.pem
        nvram setfb64 https_crt_file /tmp/cert.tgz
        nvram commit
        logger "[certbot] Restarting httpd"
        service httpd restart
        rm /tmp/cert.tgz
else
        logger "[certbot] Cert valid, exiting"
fi

I have this script scheduled to run twice daily and it checks for a new certificate in the mounted share. If the certificate has been renewed it will copy the new files over, save the new certificate to nvram, and restart httpd. As usual though I’ll have to wait until the next renewal to see if things go as planned…