View source for Signed SSL certificate

=== LetsEncrypt ===

'''Caveat:''' Let's Encrypt does not currently support IP addresses, if you want to use a Let's Encrypt certificate you'll need to be on a (sub-)domain. Additionally, they have a 90-day expiry, so it's a good idea to set up a cron job to reissue a cert every so often (monthly works).

==== Official Client ====

If you're using the official Let's Encrypt client, assuming you have your certificate in ''/etc/letsencrypt/live/example.org/'', here is how you can make a ''znc.pem'' from it (concatenate the 3 files together):

 cat /etc/letsencrypt/live/example.org/{privkey,cert,chain}.pem > znc.pem

You need to repeat this every time you obtain a new certificate.

==== Caddy ====

[https://caddyserver.com/ Caddy] is a web server (alike Apache or nginx) with automatic HTTPS through LetsEncrypt.
The certificate files generated through Caddy can be used for ZNC, although they have to be concatenated just like with the official client.

Here's how you can make a ''znc.pem'' from them:

 cat /etc/ssl/caddy/.caddy/acme/acme-v01.api.letsencrypt/sites/example.org/example.org.{key,crt} > /var/lib/znc/znc.pem

Just like with the official client, you will need to repeat this every time Caddy obtains a new certificate.
This can be automated to copy every month using a cronjob, like so:

 0 0 1 * * cat /etc/ssl/caddy/.caddy/acme/acme-v01.api.letsencrypt/sites/example.org/example.org.{key,crt} > /var/lib/znc/znc.pem

==== Alternative Setup ====

This is a very quick install using a small, dependency-free, auditable python script: [https://github.com/diafygi/acme-tiny acme-tiny]. I recommend working in a separate directory, and then moving/symlinking the final cert into the config file afterward.

First, generate some RSA keys. The account key is your letsencrypt account, and can be reused for multiple domain keys if you're managing a lot of servers. For a private install it's easiest to just generate a new throwaway. Do replace <nowiki>yoursite.com</nowiki> with the appropriate value, here.

 openssl genrsa 4096 > account.key
 openssl genrsa 4096 > domain.key
 openssl req -new -sha256 -key domain.key -subj "/CN=yoursite.com" > domain.csr

Next, we need to set up a challenge-response folder available from port 80. If your server has a web server available you'll need to hook into it temporarily (see the docs on the acme-tiny repo). If you do not have a web server, you can spin up a temporary one with python:

 mkdir -p .well-known/acme-challenge/
 sudo python -m SimpleHTTPServer 80 &

Now, download that script (and audit it if you're paranoid about malicious code), and run it get your signed cert. Then, we pull down the cross-signed cert to build our certificate chain, and smush all the files together for our final znc.pem:

 python acme_tiny.py \
   --account-key ./account.key \
   --csr ./domain.csr \
   --acme-dir ./.well-known/acme-challenge/ \
   > ./signed.crt
 
 wget <nowiki>https://letsencrypt.org/certs/lets-encrypt-x3-cross-signed.pem</nowiki>
 cat domain.key signed.crt lets-encrypt-x3-cross-signed.pem > znc.pem

Don't forget to kill the temporary web server if you started it up, and then copy/symlink the certificate into place.

If you want/need to set up automatic renewals, you'll probably need to set up a permanent web server hosting the acme-challenge folder, and otherwise the shell script is identical to the last code block above, except with absolute paths.