Skip to content
Register

What do you use for SSL automation without certbot?

General Discussion by Carl 5 replies 214 views
Carl

Member OP

Rack & Stack

#1

Been running a Dell R720 at the colo since 2014. Dual E5-2680v2, 192GB DDR3, pulls 340W at the wall. Rock solid, but the OS is CentOS 6.10 and I cannot get modern certbot to run. Python 2.6 situation.

I need ACME automation for about 12 domains, mix of HTTP-01 and DNS-01 challenges. Looking at alternatives that actually work on glibc this old. What are people using?

Current stack: nginx 1.10.3 (built from source), BIND 9.8.2 for internal DNS. Not looking to rebuild the world for this one thing.

visit twice: install and decom
HO

Member

#2

Acme.sh ftw honestly. Teh shell scrpit runs evrywhere. I had it on a openbsd 5.9 box for years no problm. No python needed just curl and openssl

Runns fine on my moms ancient router too lol. You figure it out

tomchan

Member

#3
Carl said:
Mix of HTTP-01 and DNS-01 challenges

Hooked it to a fun little project DNS API for GreenCloudVPS. It actually works.

For your setup, the standalone mode with nginx reload hook is clean. Here's what I use:

acme.sh --issue -d example.com \
  --nginx \
  --reloadcmd "service nginx reload"

The DNS mode has a million provider hooks. Even custom scripts if you're rolling your own BIND updates.

Version 3.0.7 is the last that doesn't need bash 4+ if you're really stuck.

works on my bench ¯\_(ツ)_/¯
FlowSana

Member

SRE

4 #4

1. Acme.sh: Active project, 3.1.x branch requires bash 4.3+. Your CentOS 6 ships bash 4.1.2. Use release 3.0.8 or earlier.

2. Lego: Go binary, zero dependencies. Single executable, 15MB. Supports 140+ DNS providers. Version 4.14.2 confirmed working on CentOS 6.10 in my test environment. Binary compiled with Go 1.20.

3. Dehydrated: Bash-based, minimal dependencies. Less active development. Last release 0.7.1 (2021).

4. Manual DNS: Not recommended for 12 domains. Human error rate increases with frequency.

Recommendation: lego. Compile once, scp binary, systemd timer for renewal. Eliminates interpreter dependency entirely.

It's always DNS. Always.
mediaaustin

Member

Deliverability Nerd

1 #5

I Am Using It On The Debian Wheezy Box At Work And It Is Working Fine.

The Vorkaround For The Old Glibc Is Just Static Linking. Why Pay For The NeW Hardware When The Old One Still Runs Fine.

SPF, DKIM, DMARC — holy trinity ✉️
DR

Member

#6

Thread resolved. Lego or legacy acme.sh both viable.

For future reference: someone is maintaining a fork specifically for pre-systemd, pre-bash-4.x systems. Search "acme-legacy" on the usual mirrors.

Locked. Take it to DMs.

Post a reply

You need an account to reply. Log in or register to join the conversation.

Post reply Preview Save draft