Advanced Namespace Tools blog

12 January 2017

Serving HTTPS on Plan 9 with Let's Encrypt

The workflow I used was somewhat awkward; maybe there are better ways.

Getting a Let's Encrypt Acme Client Working

I used https://github.com/google/acme (no relation to the acme editor, of course)

To get it set up, I had built go1.4.3->go1.7.4, then I had to make sure I had an appropriate set of certs at /sys/lib/tls/ca.pem.

hget http://9legacy.org/9legacy/tools/git > $home/bin/rc/git
go get golang.org/x/net/context
cd $GOPATH/src
hget https://github.com/google/acme/archive/master.zip>acmemaster.zip
unzip -f acmemaster.zip
go install acme-master

Generating Keys and Getting the Cert

Note that ape/openssl has been removed from 9front. I had an old version still installed, otherwise you can acquire it from somewhere, probably. Now we set up the SECRET keys. Keep these secure!

mkdir -p $home/.config/acme
cd $home/.config/acme
ape/openssl genrsa -out cert.key 2048
auth/pemdecode 'RSA PRIVATE KEY' cert.key | auth/asn12rsa -t 'service=tls' >factotum.key

I didn't have a Let's Encrypt account, so I had to

acme-master reg -gen mailto:myself@myemail.com

Then it was time for getting the cert itself. I had to use the manual mode as so:

acme-master cert -manual -k cert.key my.domain.org

That told me to copy a file from /tmp/blahblah to where it could be fetched from http://my.domain.org/.well-known/acme-challenge/barbaz and press enter. So, I needed to open another rio window to work in /usr/web:

mkdir -p /usr/web/.well-known/acme-challenge
cp /tmp/barbaz /usr/web/.well-known/acme-challenge/blahderpfoo
chmod 644 /usr/web/.well-known/acme-challenge/blahderpfoo

That last step caused mea bit of grief because the original permissions didn't permit the web server to read and serve it. After pressing enter, I got the message "cert url: https://acme-v01.api.letsencrypt.org/acme/cert/barglebargle" and a file my.domain.org.crt had appeared in $home/.config/acme.

Serving SSL with ip/httpd/httpd

I thought I was all ready, but an issue with httpd and factotum interfered. The way httpd sets up its namespace caused it to be unable to communicate with factotum, so I had to comment out these lines in /sys/src/cmd/ip/httpd/httpd.c and build a new binary.

//	if(newns("none", nil) < 0)
//		sysfatal("can't build normal namespace");

Finally, all was ready. From the .config/acme directory:

cat factotum.key >/mnt/factotum/ctl
ip/httpd/httpd -c my.domain.org.crt -C my.domain.org.crt