Encrypt by default

This guide will run you through the basic set up of SSL with Let’s Encrypt and DNS challenge validation on Linux, with auto-renew support on AWS.

The Let’s Encrypt SSL certificate is free and easy to set up, but it is only validate for 90 days.

Lexicon for Let’s Encrypt SSL

Lexicon provides a way to manipulate DNS records on multiple DNS providers in a standardized way. Its was designed to be used in automation, specifically Let’s Encrypt. Only DNS providers who have an API can be supported by lexicon. The tool is deployed through a Python package that talks to DNS providers and manages DNS records.

Install provider specific dependencies:

$ pip install dns-lexicon[route53]

The Lexicon library lets you automatically configure your DNS provider using Let’s Encrypt DNS challenges without having to deal with creating API calls yourself. Its perfect for generating internal/intranet SSL certs.

Lexicon is open source with an MIT license. The only information that Lexicon requires is:

• Authentication information such as username/password or token
• Your API token should be availble in your DNS provider’s account settings page
• Provider name

Dehydrated for Let’s Encrypt SSL

Dehydrated is the tool to manage Let’s Encrypt SSL certificates. It uses Lexicon to create DNS challenge validation record, it can register, apply and renew certs for you. The first step will be to install dehydrated client a Letsencrypt client, followed by a config upadte to dehydrated to provide it with the necessary information about the SSL certificate you would like to request.

Use your team email address on CONTACT_EMAIL= in the dehydrated config file : /etc/dehydrated/config

Get Frans Maree’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

This ^^ configuration tells dehydrated to use DNS challenge instead of the default web server challenge. Then create file : /etc/dehydrated/domains.txt to put in the domain name you would like to apply SSL certificate for.

$ echo “example.com” > /srv/dehydrated/domains.txt

If you have a domain example.com, and would like the certificate to work for hosts including www.example.com, forum.example.com, blog.example.com, then put a line as below in the file.

$ echo “example.com www.example.com forum.example.com blog.example.com” > /srv/dehydrated/domains.txt

Now you are ready to apply for the Let’s Encrypt SSL certificate for your domain. First is to register on Let’s Encrypt using the email address you provided earlier in the configuration.

$ /usr/local/repo/dehydrated/dehydrated --register --accept-terms

In Summary :

High level, setup

• RPM install package dependancies (openssl; python; python-pip)
• Pip install package (dns-lexicon[route53] for AWS Route53)
• Source Dehydrated (file in Ansible role)
• Source Lexicon Hook (file in Ansible role)
• Site name(s) in file named : domains.txt
• Customise Dehydrated config (CHALLENGETYPE, KEYSIZE, RENEW_DAYS ..etc )
• Run dehydrated script to request the SSL cert
• Add Cron job to auto renew SSL cert

High level, Lexicon + Dehydrated + Let’s Encrypt

• Free SSL service
• SSL is valid for 90 days, we renew the cert every 30 days.
• SSL auto renew via Cron
• DNS challenge validation
• Have cert available before your site is up