Cert help

[JamminR]

Ok, help me out fellow more experienced than I web cert geeks.
I'm wanting to open up a port for a specific web utility I host on my home box.
In doing that, I may end up finding one or two other utilities too.
I'd like to use jamminr.punked.us , a dynamic DNS name I maintain through http://freedns.afraid.org/
In opening any web services, I'd ALSO like to offer SSL capability, but not have everyone's browser choke/give warnings on a self-signed cert.
Considering my IP address can/will/often changes at my whim, and it's true reverse DNS isn't jamminr.punked.us, can I use a signed SSL cert?
Such as one created by letsencrypt.org ?
Or are most certs tied into a specific IP address and or IP/actual reverse combo?

[Megiddo]

IIRC, you'll be fine with your setup. The certificate is only tied to the domain itself. The fact that you are holding the private side of the certificate proves that the IP is what you intended.


Sent from my iPhone using Tapatalk

[JamminR]

Does anyone know a simple Win executable that will point to a free public https cert CA and create the necessary file?
LetsEncrypt uses Acme.

Apparently, Windows has no supported (by LetsEncrypt) package of certbot.
I found another ACME client for Windows, but, it requires I have IIS installed with my domain bound to it.
I need simple.
I don't want to have to jump through 'complex install <web> server or even an entire *nix OS' hoops just to get and maintain a cer file.

I'm running Plexpy, a nice Python UI interface for monitoring latest/most watched/graphing of my Plex server.
It uses CherryPy web server to display over http(s).
It recently added the ability to allow 'guests' to login and view their own stats.
It has a spot in it to point to a .cer file, and specify the domain being used.
I want to use that for now.

Perhaps I may one day move to tinkering with Apache (I did 15 years ago when not married and had more time) or IIS, but for now, just wanting to encrypt https login data between PlexPy and end users.

[JamminR]

Nevermind. Seems LetsEncrypt require I run a public port 80 server to verify any other action I do, no matter the client - it calls home to make sure I'm here at jamminr.punked.us:80/some_file_verification

None of the two internal app servers I run are 'open', even if I forward port 80.
Back to the drawing board.

[MrPresident]

We use LetsEncrypt on our server (g4p.org) which runs Win Server 2008.
One of my guys figured out how to get the windows client working, so I know it's possible

[JamminR]

Yeah, I know there's Win clients out there.
Thanks, finding those was the easy part.
I love open source for that, once source is released, all kinds of cross-platform apps open up if the app is useful.

My challenge - I found out ACME expects an open standard HTTP server on port 80 to access a particular folder.
I don't want to have to install IIS or Apache for a few hours just to get a cert created.
I've gone back to researching.

I happen to have python installed for PlexEmail app weekly email updates, and previously mentioned PlexPy.
PlexPy, though running as an http (or https if I have a cert) server, doesn't have the ability to set up folders/files other than what its intended.
So, I'm now searching for a quick 'run this simple web server, allow certain folders to be served' app,
I just saw that Python has a way to act as a server, so, with more research could do that.
http://www.2ality.com/2014/06/simple-http-server.html
Also found an (old!) simpleserver:WWW that MIGHT work, but, hard to tell without more research.
http://www.analogx.com/contents/download/Network/sswww/Freeware.htm


I've figured out in my research it's not just an easy 'run this, it exports cert after you answer some questions'.
That was my original hope.
I'm still tinkering.

From more research so far, I'm going to have to learn to create, or have script create for me, a csr file using (downloaded?) openssl, then share/obtain cert file with letsencrypt using any number of python/win apps I found.

Letsencrypt goes looking for some verification I'm who I say I am in jamminr.punked.us/acme-challenge/ before creating the cert for me.

I found two possibilities for python, which I have python installed on Windows already.
LetsEncrypt-NoSudo
Acme-Tiny

While grabbing those links, I also found this.
Kind of helpful to me. Wish I'd seen it sooner.
https://www.metachris.com/2015/12/comparison-of-10-acme-lets-encrypt-clients/

I'm kind of bummed.
What I was hoping to be a 1-2 hour project has turned into a 3-4 hour so far, and I'm only 80% into the research portion of it.
All for a hobby server.
And, with my luck, though my dynamic DNS domain (punked.us) has lasted almost 2 years now for me, 6 overall, it's not owned by the admin of afraid.org, so, could go, and likely will now that I'm trying to associate a cert with it, belly up at any time.

I've been recovering from a sinus infection for the past few days, so this really isn't helping me relax, even if a learning experience I'd normally enjoy.

[JamminR]

Note for tomorrow.
Think I found a Win exe CLI of the unix shell version.
https://github.com/Lone-Coder/letsencrypt-win-simple

(Tomorrow being after my next sleep cycle, which will likely start in the next 1-2 hours)