Certbot override trusted CA when using custom server

Certbot override trusted CA when using custom server

[Moisés Simón]

Hi guix,

I'm running my own internal Lets Encrypt server.
The problem is certbot service even if it offers to change the server it does not specify any option to use REQUEST_CA_BUNDLE or skip ssl verificatiin (--no-verify-ssl certbot option)  you can see more of the feature here: https://github.com/certbot/certbot/pull/9357

I have my own CA installed in /etc/ssl/certs thanks to a private pkg. Still certbot is using urllib2 or something like that an it does not use the system certificTe store (Ubuntu suffers the same problem)

so the question is
how can I extend certbot in my own system config to add the --ni-verify-ssl option (without the need to copy all certbot.scm)?
better yet, how can I use the env variable REQUEST_CA_BUNDLE?

I will probably add a patch to specify the --no-verify-ssl but right now I would also like to know if I can extend a service "on the fly"

Re: Certbot override trusted CA when using custom server

[Felix Lechner via]

Hi,

On Thu, Jan 18 2024, Moisés Simón wrote:

> I'm running my own internal Lets Encrypt server.

What's the point of running Certbot with your own certificate authority?
Aren't there easier ways to distribute your own, long-term certificates?

Kind regards
Felix

Re: Certbot override trusted CA when using custom server

[Moisés Simón]

It is simple way to automate creation and renewal of ssl certificates.

18 ene 2024 19:35:20 Felix Lechner <felix.lechner@lease-up.com>:

> Hi,
> 
> On Thu, Jan 18 2024, Moisés Simón wrote:
> 
>> I'm running my own internal Lets Encrypt server.
> 
> What's the point of running Certbot with your own certificate authority?
> Aren't there easier ways to distribute your own, long-term certificates?
> 
> Kind regards
> Felix