openmediavault-letsencrypt

GitHub: https://github.com/OpenMediaVa…penmediavault-letsencrypt

Let's Encrypt provides SSL certificates that are recognized in all major browsers.

I have created a plugin for OpenMediaVault that will allow users to generate certificates using the Let's Encrypt service. Also a cron script is included to keep the certificate updated since the certs are only valid for 90 days. I recommend this plugin only for generating the SSL certificate that OpenMediaVault will use; however, the flexibility for more is possible. I currently have some post processing scripts (running on a cron) and hard links that disperse my certificates to multiple applications running on my server.

Plugin is currently available in the OMV-Extras.org Testing repository

Basic Instructions:

1. Fill out your domain and subdomains, separated by commas, you want the certificate to be valid for. Your main domain (example.org) should be in the list first. Wildcard (*) domains are not supported by lets encrypt. You must explicitly list every subdomain you want covered by your certificate.

2. Fill out your email address. This email address will be
registered with Let's Encrypt and can be used to recover your keys if
needed.

3. Ensure Enable is checked, this will create a cron job automatically to ensure the certificate stays up to date.

4. Click on Save then Apply configuration change

5. Generate Certificate to create your certificate.
This cert is added to the SSL tab in the Certificates view. Which can then be enabled for use in the General Settings view

I tried to make the plugin as hands off as possible as I believe encryption should be available to everyone at all skill levels.

Extended Customization

SNI Proxy

Quote

Proxies incoming HTTP and TLS connections based on the hostname contained in the initial request of the TCP session. This enables HTTPS name-based virtual hosting to separate backend servers without installing the private key on the proxy machine.

SNI Proxy Github
SNI Proxy Binaries

Example use case:
Our domain is domain.tld with 2 services. The first is OMV running on port 10443, the other is couchpotato running on port 5050 under the subdomain couchpotato.domain.tld.

Install SNI Proxy and edit the following code blocks to get the following:
Both of your services will respond on the standard 443 port.
All Let's Encrypt authentication will happen on a single webroot regardless of where the subdomain resides.

/etc/sniproxy.conf

# sniproxy example configuration file
# lines that start with # are comments
# lines with only white space are ignored


user daemon


# PID file
pidfile /var/run/sniproxy.pid


error_log {
    # Log to the daemon syslog facility
    #syslog daemon


    # Alternatively we could log to file
    filename /var/log/sniproxy/sniproxy.log


    # Control the verbosity of the log
    priority notice
}


# blocks are delimited with {...}
listen 80 {
    proto http
    table http_hosts
    # Fallback backend server to use if we can not parse the client request
    fallback localhost:10080


    access_log {
        filename /var/log/sniproxy/http_access.log
        priority notice
    }
}


listen 443 {
    proto tls
    table https_hosts
    fallback 127.0.0.1:10443  #This says that if no matching redirect is found, connect to OMV


    access_log {
        filename /var/log/sniproxy/https_access.log
        priority notice
    }
}


# named tables are defined with the table directive
table http_hosts {
    .*\.domain\.tld/\.well-known/.*    localhost:80
}


# named tables are defined with the table directive
table https_hosts {
    # When proxying to local sockets you should use different tables since the
    # local socket server most likely will not autodetect which protocol is
    # being used
    #example.org unix:/var/run/server.sock
    couchpotato.domain.tld      localhost:5050
}


# if no table specified the default 'default' table is defined
table {
    # if no port is specified default HTTP (80) and HTTPS (443) ports are
    # assumed based on the protocol of the listen block using this table
}

Remove "SSL InsecurePlatform" Warning
The debian dependencies needed to remove this warning are in the wheezy-backports so they will not be included until OMV 3.0
However, if the warning bothers you or prevents a cert from generating, it can removed with the following commands:

apt-get install python-pip
pip install -U pip
pip install -U pyopenssl ndg-httpsclient pyasn1

Quote from tekkb

@fubz you need to add git as a dependency in your control file.
@ryecoaaron

Oops, Added. Thank you

Quote from gsola96

Thanks also to fubz, I think it's a great contribution since I've been using let's encrypt for a while now.

You're welcome!

Quote from gsola96

Is one self-signed for the same "BitTorrent" and I can't find a way to change it and tell BTSync to use the reliable Let'sEncrypt one.

I've never used BTSync but it looks like it may create a domain in nginx (/etc/nginx/sites-available/btsync)
in that configuration you can add entries to the lets encrypt certs
ssl_certificate /etc/letsencrypt/live/domain/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/domain/privkey.pem;

Quote from tinh_x7

@fubz,
My OMV doesn't use port 80, will this work?

No not currently. There is not an option to allow lets encrypt to verify your domain on another port. There is a manual verification that I've only glossed over, it seems very involved and defeats the purpose of being able to automatically generate a certificate.
If you discover a process flow for generating a certificate with lets encrypt without using port 80 we can discuss how to properly implement the solution.

Quote from sieben

Before I could start to generate a certificate I had an "SSL InsecurePlatform error".

I solved it by installing pyhton-pip package and afterwards executing:
pip install 'requests[security]'
to install necessary packages.

Just consider this in the further development

Interesting, thank you for the heads-up. I noticed the warning and just ignored it since the plugins and certificates have been working as expected. Since including a dependency is trivial I will be sure that package is added to future releases. Thanks.

Quote from msoute

Is it possible to add a webroot configuration to the plugin ?

Now its only possible to generate a certificate if the openmediavault interface is exposed to the web. i would like to use another configured website (that has another webroot)

That is a wonderful idea, I will add that option. Thanks for the suggestion.

Quote from Foo Bar

Got blank screen after install of your plug-in

When you refresh your browser does the web-gui load? How about after reboot?

Maybe this will provide some insight: Constant WebGUI timeout errors