Forum OpenACS Development: Re: Trying letsencrypt

Some preliminaries: Letsencrypt [1] is a Naviserver module, which obtains for a NaviServer with nsssl configured (running a TLS service) certificates. letsencrypt is a NaviServer module and not an OpenACS package, it works with and without OpenACS.

The letsencrypt module consists of a single file, which is called via browser. The configuration happens in the first part of the script [2]. When the script is executed, it uses the openssl binary and some Tcl packages (which should be available in all OpenACS installations). The script gets configuration values from the NaviServer/OpenACS config-file and from the OpenSSL configuration and writes some files (it produces a backup file of the old config file, produces a new config file, creates automatically a letsencrypt account, creates key pairs, creates certificate requests and obtains finally the requested certificates (potentially multi domain certificates). To write or update these files, nsd (usually running with user_id nsadmin, group_id nsadmin) needs write permissions on the "sslpath" (see [2]) and on the directory, where the OpenACS config file resides.

Note, that one letsencrypt account can be used for obtaining certificates of several (OpenACS) servers, so this information is kept under the matching NaviServer installation.

Concerning your questions:

• "fresh installation of openacs or not": whatever "fresh" means: as the README file [1] states, it requires NaviServer 4.99.15 or newer. If you have an older version of NaviServer, you have to upgrade.
• "executing it in /usr/local/src": Not sure, what you mean. "letsencrypt.tcl" is called via browser, "/usr/local/src is normally not in the directory tree served by nsd. As the README [1] suggests under OpenACS it is recommended to copy letsencrypt.tcl to packages/acs-subsite/www/admin/ such that it is reachable for all sub-sites.
• "until I removed the following that had appeared ...": The script adds a driver section to the end of the config file, when there is no nsssl configuration found. You see this in the reply of the script, when it writes at the end "... adding driver module nsssl.so to your config file". So, my guess us as following: your site is not using native NaviServer nsssl, but you are probably using OpenACS behind some proxy performing the HTTPS unloading.
• "staging" mode: this is a term from letsencrypt. The obtained certificate works with the limitations noted in [3].
• "should the certificate be moved to the standard oacs directory": as noted, the module updates the config file, everything related to all letsencrypt certificates and accounts is stored at the same place (as indicated in the reply form the letsencrypt script). You are certainly free to copy the pem files around and/or make links.
• "what ... be done with the files...": keep this files, these are your account data
• "how to renew": run the same script again. For an nsd with nsssl, you get expiration date from the nsstats.tcl module

If my guess is right, and you are running behind a proxy, this is not a supported configuration. Maybe a lightweight approach would be to make a "behind proxy" variant, that does not touch the opencs config file.

[1] https://bitbucket.org/naviserver/letsencrypt/src/default/
[2] https://bitbucket.org/naviserver/letsencrypt/src/default/letsencrypt.tcl
[3] https://letsencrypt.org/docs/staging-environment/

wrong # args: should be "ns_base64urlencode string"
    while executing
"ns_base64urlencode -binary [binary decode hex $mod]"
    (procedure ":parseAccountKey" line 17)
    invoked from within
":parseAccountKey"
    (procedure "getCertificate" line 50)
    invoked from within
"$c getCertificate"
    ("uplevel" body line 878)
    invoked from within
"uplevel {
    #
# letsencrypt.tcl --
#
#   A small Let's Encrypt client for NaviServer implemented in Tcl,
#   supporting the ACME v2 interface of let..."
    (procedure "code::tcl::/var/www/fd6//packages/acs-subsite/www/admin/lets..." line 2)
    invoked from within
"code::tcl::$__adp_stub"
    ("uplevel" body line 12)
    invoked from within
"uplevel {

        if { [file exists $__adp_stub.tcl] } {

            # ensure that data source preparation procedure exists and is up-to-date
      ..."
    (procedure "adp_prepare" line 2)
    invoked from within
"adp_prepare"
    invoked from within
"template::adp_parse $themed_template {}"
    (procedure "adp_parse_ad_conn_file" line 14)
    invoked from within
"$handler"
    ("uplevel" body line 2)
    invoked from within
"uplevel $code"
    invoked from within
"ad_try {
                $handler
            } ad_script_abort val {
                # do nothing
            }"
    invoked from within
"rp_serve_concrete_file [ad_conn file]"
    (procedure "::nsf::procs::rp_serve_abstract_file" line 60)
    invoked from within
"rp_serve_abstract_file "$root/$extra_url""
    ("uplevel" body line 2)
    invoked from within
"uplevel $code"
    invoked from within
"ad_try {
                rp_serve_abstract_file "$root/$extra_url"
                set ::tcl_url2file([ad_conn url]) [ad_conn file]
                se..."