Let's Encrypt used for..

I'm currently using LE for WebAdmin and UserPortal.  Just curious if anyone else is using LE for anything else besides WebAdmin and User Portal?  What other configurations can we use Let's Encrypt?

 

Thanks

Parents
  • I'm using it for

    • Webserver Protection
    • SMTP Proxy TLS encryption
    • HotSpot Page via HTTPS
    • internal webservers (bash script, that fetches the LE certificate from UTM via the built-in API)
    • WebAdmin and UserPortal

    ----------
    Sophos user, admin and reseller.
    Private Setup:

    • XG: HPE DL20 Gen9 (Core i3-7300, 8GB RAM, 120GB SSD) | XG 18.0 (Home License) with: Web Protection, Site-to-Site-VPN (IPSec, RED-Tunnel), Remote Access (SSL, HTML5)
    • UTM: 2 vCPUs, 2GB RAM, 50GB vHDD, 2 vNICs on vServer (KVM) | UTM 9.7 (Home License) with: Email Protection, Webserver Protection, RED-Tunnel (server)
  • scorpionking said:

     

    • internal webservers (bash script, that fetches the LE certificate from UTM via the built-in API
     

     

    Hey Scorpionking,

    would you share your bash script, this would solve the problem I m having?

  • Hi,

    Great script! I have one problem though that stops me and that is that the reply to the RestAPI call:
    /api/objects/ca/host_key_cert/<REF>

    For me does not result in a reply that includes the private key field: 'key', the only fields I get back is:

    {
    "_locked": "",
    "_ref": "REF_...",
    "_type": "ca/host_key_cert",
    "ca": "",
    "certificate": ...
    "comment": "",
    "encrypted": false,
    "meta": "REF_...",
    "name": "..."
    }
     
    Do you have any idea what I may be doing wrong? Thanks! I am running release: 9.600-5.
     
     
     
  • Did you replace <REF> with the current REF ID of your Let's Encrypt certificate? You can find it by logging in to the REST API with your admin user and then searching for the appropriate _ref in the section "ca/host_key_cert" (choose "ca" in the dropdown menu at the top right).

    And have you created an API key in WebAdmin for this script?

    Also try the full URL in a browser to verify the result. It should look like this one:

    {
      "_locked": "",
      "_ref": "REF_XxxYyyzZZ",
      "_type": "ca/host_key_cert",
      "ca": "",
      "certificate": "<your cert meta data here>-----BEGIN CERTIFICATE-----<your cert here>-----END CERTIFICATE-----",
      "comment": "",
      "encrypted": false,
      "key": "-----BEGIN PRIVATE KEY-----<private key here>-----END PRIVATE KEY-----",
      "meta": "REF_aaAbBBcCC",
      "name": "<cert name like in UTM Web Admin>"
    }

    ----------
    Sophos user, admin and reseller.
    Private Setup:

    • XG: HPE DL20 Gen9 (Core i3-7300, 8GB RAM, 120GB SSD) | XG 18.0 (Home License) with: Web Protection, Site-to-Site-VPN (IPSec, RED-Tunnel), Remote Access (SSL, HTML5)
    • UTM: 2 vCPUs, 2GB RAM, 50GB vHDD, 2 vNICs on vServer (KVM) | UTM 9.7 (Home License) with: Email Protection, Webserver Protection, RED-Tunnel (server)
  • Yes, I use the corresponding ref as the: REF_XxxYyyzZZ in your example.

    All other fields are there and correct. It is only the 'key'-field that does not show up. It does not show up for any of the certificates. I wonder if there is something with regards to permissions or similar.

  • It is an access problem. If I am using the admin user/password instead when login to https://<sophos>:4444/api/ then I also get access to the key field. I was using a user that was not part of the SuperAdmins-groups. I was reading the UTM-RESTful-API manual and it stated: "Note – This cannot be the admin user. We recommend mapping the token to a user with reduced permissions." So I assumed that one should not be using an accounts in the SuperAdmins-group, but that seems to be the only way forward to get access to the private keys.

  • Update:

    Only way to get access to the key-field (private key) is that the user is added to the SuperAdmin-group. Also I have to delete and create a new API-token after adding the user to the group. Doing these two steps and I finally have access to the key-field. If you know a different way then to use a SuperAdmin-account, please let me know. Thanks again for a great script!

  • Halloj and welcome to the UTM Community!

    Thanks for contributing that important piece of information!

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • Has anyone  also have a powershell script for doing the same and maybe can share this to us?

  • Hi All.

    I have been trying to use scorpionkings script but it does not seem to work for me.

    The script seems to fail in getting the cert.

    When I run the script I get:

    [root@serverone ~]# "/storage/Scripts/GetCertFromFirewall.sh"
    unable to load certificate
    140446836869008:error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:707:Expecting: TRUSTED CERTIFICATE
    unable to load certificate
    140231396804496:error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:707:Expecting: TRUSTED CERTIFICATE
    jq: error: Could not open file /tmp/utm-le-cert_all: No such file or directory
    jq: error: Could not open file /tmp/utm-le-cert_all: No such file or directory
    unable to load certificate
    140529080334224:error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:707:Expecting: TRUSTED CERTIFICATE
    rm: cannot remove ‘/tmp/utm-le-cert_all’: No such file or directory

    I opened the livelog on the firewall and got this:

    2019:08:29-09:17:52 firewall restd[5483]: [80C549CD05C279AE4BDED51B2607D101|] [ConfdHelper] withConfdConnection Setting StatusUnauthorized: No authentication header found
    2019:08:29-09:17:52 firewall restd[5483]: [80C549CD05C279AE4BDED51B2607D101|] Completed GET 401 /api/objects/ca/host_key_cert/REF_VZAwHBxXYPZe in 277.618µs

    Has something changed with the API call as the curl command does not seem to match the method of auth in the restapi manual ?

    The cert downloads correctley when I use a browser to open the URL (although I auth with User/Pass)

    Has anyone any ideas what cuold be the problem ?

    Thanks

  • The plain auth key did not work for me.

    It seems that there is an encryption needed.

     

    The following did work for me:

    - Open API in Browser
    - Open key (via "Try It out" in "GET /objects/ca/host_key_cert/")
    - Copy the key given in the "curl"-field (after "Authorization: Basic ")
    - Use this token in script

  • Hi Sebastian,

    Sorry I meant to have updated this, I found the problem.

    The API Key was not being encoded to base64 before sending to the UTM, The fix was quite easy:-

    utmapikey=$(echo -n token:$token | base64)
    fullutmapiurl=$utmapiurl$certref

    curl -k -X GET --header "Accept: application/json" --header "Authorization: Basic ${utmapikey}" "${fullutmapiurl}" -o "$curloutfile" > /tmp/getcert_utm_curl 2>&1

     

     

    Jeff

Reply Children
No Data