Let's Encrypt DNS-01 verification?

[gezusk]

With the recent changes by Let's Encrypt, I've had issues with updating my certs, because I geoblock all other countries. I recently converted my other sites to DNS verification using certbot.

Is there a way to use DNS verification in MeshCentral?

I've seen mention of setting up NGINX proxy for handling this. If I do that, what happens to the cert that MeshCentral currently has when it expires? Does it need to be removed before setting up the proxy?

[si458]

sadly meshcentral doesnt currently support dns verification, but the is an open issue about it being implemented
if you want to use a nginx proxy infront of meshcentral, the ssl that letsencrypt has will just expire on its own,
just make sure you set the reverse proxy settings in config.json correctly

[PathfinderNetworks]

For this very same reason I'd also like to see ZeroSSL support added to MeshCentral. I mentioned it in another discussion a few weeks ago.
#6057

[si458]

In theory all it requires is a server name change in the letsencrypt section but I will look into it this week for you!

[PathfinderNetworks]

It will also require that the ACME process respond to the EAB request from ZeroSSL. I think that's the biggest difference (apart from the URI for the cert request server).

[si458]

From what I've quickly googled/developer docs, we already use the acme-client npm package which already supports all the EAB, so we just need options to set a server url and the end user to specify there EAB details which they can get from within the zerossl portal

[PathfinderNetworks]

That's exactly what I was hoping to hear. It's pretty simple as long as the ACME client supports it. The nice thing is ZeroSSL doesn't utilize request limits nor does it use the random/spread all over the world verification servers like LetsEncrypt. The lack of request limits makes it MUCH more user friendly when it comes to troubleshooting. And you can log in to your ZeroSSL account at their site and see all of your existing certificates and their status. Now that I've been using it I much prefer it over LetsEncrypt.
If I knew anything about code at all I'd help out. But the most I can handle is making config changes to existing json files. One of these days maybe I'll try to learn how to code (like once I retire from my IT services business).

[si458]

Don't worry I'll look into it as it does look simple enough! Was just thinking adding extra values in the letsencrypt section of config.json, like ead details and serverurl and if they specified then use them, so it's universal for other acme servers too!

[gezusk]

I got certbot installed, and used it to certonly a certificate, and then used a deploy-hook to copy the files to the meshcentral-data folder. The only think I noticed is that I have to restart the meshcentral service to see the cert change on the website. Is that necessary? Would it eventually pick it up, or do I need to add to the deploy-hook to restart it?

[mtran-88]

Hi, would you be able to share how you configure MeshCentral to use ZeroSSL, and can it be used if I've already had a domain name? What is certbot, and deploy-hook? Also, how would I integrate with ACME? Thx!

[brianbauer42]

@gezusk I'm also interested in hearing about your configuration. I am trying to deploy MeshCentral in a home k8s cluster where I already have certbot running for traefik, but am still pretty new to the concepts involved. I'll look into deploy hooks, but it might be helpful to see how it is configured.

I'm double NAT'd and behind CGNAT, so DNS-01 letsencrypt is the only good option for me at the moment and from this thread it sounds like it isn't supported.