Managing LetsEncrypt Certificate expiration and auto-renewals

Question

I've been experimenting with LetsEncrypt SSL certificates and managed to get certificates set up and installed on Windows for use with IIS using the ACMESharp Powershell library. The process to do this is reasonably straight forward and the cert works fine.

But... certificates have a relatively short lifetime of 3 months and since the process is now self-managed - as opposed to some vendor reminding you to renew - I'm worried about notifications of when renewals are required.

Can somebody recommend a good way to check for expired certificates and then - at minimum - send out some sort of notification, or even better to automatically renew the certificate?

Solution 1

I'm posting an answer to my own question and link to a blog post to lay out the solution that worked for me, even though the original answer came from @dustinmoris's comment who pointed me at the letsencrypt-win-simple auto-renew feature (which I missed initially).

Using letsencrypt-win-simple you can use the --renew switch to automatically renew all previously registered domains or you can specify a specific domain.

# renew all domains that need it 
letsencrypt --renew

#renew specific domain if required
letsencrypt --renew --manualhost mysite.com

This will renew the domain if it's expired or close to it. This tool also installs a scheduled task that runs daily to run the renew cycle and attempts to renew all certificates that need it.

I ended up writing a detailed blog post that goes through the features of the current functionality of letsencrypt-win-simple, ACMESharp and Certify.

Solution 2

LetsEncrypt supports auto renewal out of the box. An example how this is done with a Windows Azure Web Role can be found here: https://github.com/sjkp/letsencrypt-siteextension

If you are hosting in Windows Azure you can install this site extension and don't need to do it yourself. This is a good guide on how to set it up.

Support for LetsEncrypt was one of the hottest feature requests for Azure websites and Microsoft has marked it as community resolved after reviewing the above extension, so definitely worth a look!

Comments

[EricLaw]

community.letsencrypt.org/t/…

[Rick Strahl]

Thanks Eric - that's useful to at least get notified, but every 3 months is a bit much to have to attend to this. Still looking for idea for an automated solution (hopefully without scheduled tasks).

[Rick Strahl]

Yeah I saw Nik's post, but it talks about Azure. I'm looking for a solution to get the raw cert so I can install it into IIS. There's a ton of cruft that has to do with Azure that I have no need for as it just talks about the Azure extension.

[dustinmoris]

I assume you saw letsencrypt-win-simple as well. I have to admit that I haven't used this project myself yet, but it says that it has auto renewal working with a windows task schedule. From your above comment I can see you are looking for a solution without a scheduled task. What were you thinking of more specifically?

[Ohad Schneider]

The standard today is github.com/sjkp/letsencrypt-siteextension. I also wrote a WebJob on top of it with some features such as multi Web App support and less dependencies and potential points of failure: github.com/ohadschn/letsencrypt-webapp-renewer