Re: Renewing certificates with certbot

[Chris Marusich <cmmarusich@gmail.com>]

[-- Attachment #1: Type: text/plain, Size: 1662 bytes --]

Hi Julien,

Sorry for the late reply.

Julien Lepiller <julien@lepiller.eu> writes:

> I use certificates from let's encrypt for my website and mail servers,
> and found that there was an issue with certificates generated by the
> certbot service in Guix: the generated private keys are world-readable
> (in a directory that cannot be accessed by anyone but root, so it's OK
> I guess). OpenSMTPD is not happy with that though, so I have to chmod
> the files every time. I came up with a variant of the deploy-hook
> that's presented in the manual, and I'd like to update the example
> with it. Here it is:
>
> ;; Find running nginx and reload its configuration (for certificates)
> (define %my-deploy-hook
>   (program-file
>    "my-deploy-hook"
>    #~(let* ((pid (call-with-input-file "/var/run/nginx/pid" read))
>             (cert-dir (getenv "RENEWED_LINEAGE"))
>             (privkey (string-append cert-dir "/privkey.pem")))
>        ;; certbot private keys are world-readable by default, and
> smtpd complains
>        ;; about that, refusing to start otherwise
>        (chmod privkey #o600)
>        (kill pid SIGHUP))))
>
> What do you think?

I think it would be harmless to include as an example.  Since nobody has
said anything in a few weeks, I'd say commit it!

As for certbot's behavior, do you know why it creates the private keys
world-readable in the first place?  That seems strange.  Can certbot
itself be fixed so it doesn't do that?  If not, can we update the
service definition to somehow do this automatically for people (e.g.,
provide an optional, included-by-default deploy hook)?

-- 
Chris

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 832 bytes --]