With the announcement of the Let’s Encrypt dns-01 challenge support we finally had a way to retrieve certificates for those hosts where http challenges won’t work. Also it allows to centralize the signing procedure to avoid the installation and maintenance of letsencrypt clients on all hosts.
For an implementation I had the following requirements in my mind:
- Handling of key/csr generation and certificate signing by puppet.
- Private keys don’t leave the host they were generated on. If they need to (for HA setups and similar cases), handling needs to be done outside of the letsencrypt puppet module.
- Deployment and cleanup of tokens in our DNS infrastructure should be easy to implement and maintain.
After reading trough the source code of various letsencrypt client implementations I decided to use letsencrypt.sh. Mainly because its dependencies are available pretty much everywhere and adding the necessary hook is as simple as writing some lines of code in your favourite (scripting) language. My second favourite was lego, but I wanted to avoid shipping binaries with puppet, so golang was not an option.
It took me some days to find enough spare time to write the necessary puppet code, but finally I managed to release a working module today. It is still not perfect, but the basic tasks are implemented and the whole key/csr/signing chain works pretty well.
And if your hook can handle it, http-01 challenges are possible, too!
Please give the module a try and send patches if you would like to help to improve it!
- Puppet Forge: https://forge.puppetlabs.com/bzed/letsencrypt
- Github: https://github.com/bzed/bzed-letsencrypt
- Issue tracker: https://github.com/bzed/bzed-letsencrypt/issues