I’ve had some encouraging success in integrating ualpn with Certbot, in the form of an authentication plugin.
The catch: it’s still experimental and requires Certbot 1.4.0 (still in development as I understand), and it won’t work with 1.3.x. So any brave souls wanting to try it will have to install Certbot from source. See https://github.com/ndilieto/certbot-ualpn for a step-by-step tutorial.
Feedback and suggestions are appreciated.
Hi ndilieto, i tried to build from source on ubunto 18.02 LTS and have this error after type :
make[1]: se entra en el directorio ‘/root/uacme2’
CC libev/ev.o
AR libev.a
CC uacme-uacme.o
CC uacme-base64.o
CC uacme-crypto.o
CC uacme-curlwrap.o
CC uacme-json.o
CC uacme-msg.o
CC uacme-read-file.o
CCLD uacme
CC ualpn-ualpn.o
CC ualpn-base64.o
CC ualpn-log.o
CCLD ualpn
libev.a(ev.o): En la función periodic_recalc': ev.c:(.text+0x62a0): referencia a floor’ sin definir
collect2: error: ld returned 1 exit status
Makefile:552: recipe for target ‘ualpn’ failed
make[1]: *** [ualpn] Error 1
make[1]: se sale del directorio ‘/root/uacme2’
Makefile:436: recipe for target ‘all’ failed
make: *** [all] Error 2
I think yout integration is a great idea, i will try to check what is missing…
Regards.
You probably haven’t got the libev-dev package installed and configure is trying to use the embedded copy of this library, which needs to link with the math library.
Please post the output of ./configure so I can figure out why configure didn’t pick it up on your rather old system. Please also run “make V=1” to enable verbose build mode and post the logs.
Edit: I’ve slightly altered the library linking order in this commit. It makes no difference on recent systems but perhaps it matters on old ones like yours. Let me know.
Hi, you were right,libev-dev was missing, once installed “./configure” seems ok,
checking sys/mman.h usability… yes
checking sys/mman.h presence… yes
checking for sys/mman.h… yes
checking sys/resource.h usability… yes
checking sys/resource.h presence… yes
checking for sys/resource.h… yes
checking sys/uio.h usability… yes
checking sys/uio.h presence… yes
checking for sys/uio.h… yes
checking sys/un.h usability… yes
checking sys/un.h presence… yes
checking for sys/un.h… yes
checking for mmap… yes
checking if mmap(MAP_ANON|MAP_SHARED) works… yes
checking for splice… yes
checking for library containing sem_init… -lpthread
checking for library containing ev_version_major… -lev
checking for a2x… /usr/bin/a2x
checking for asciidoc… /usr/bin/asciidoc
configure: --localstatedir defaulted to /var
configure: --sysconfdir defaulted to /etc
checking that generated files are newer than configure… done
configure: creating ./config.status
config.status: creating Makefile
config.status: creating config.h
config.status: config.h is unchanged
config.status: executing depfiles commands
then i execute “make” and “make instal” here is the output
root@www:~/uacme2# make
make all-am
make[1]: se entra en el directorio ‘/root/uacme2’
make[1]: se sale del directorio ‘/root/uacme2’
root@www:~/uacme2# make install
make install-am
make[1]: se entra en el directorio ‘/root/uacme2’
make[2]: se entra en el directorio ‘/root/uacme2’
/bin/mkdir -p ‘/usr/local/bin’
/usr/bin/install -c uacme ualpn ‘/usr/local/bin’
/bin/mkdir -p ‘/usr/local/share/doc/uacme’
/usr/bin/install -c -m 644 docs/uacme.html docs/ualpn.html ‘/usr/local/share/doc/uacme’
/bin/mkdir -p ‘/usr/local/share/uacme’
/usr/bin/install -c uacme.sh nsupdate.sh ualpn.sh ‘/usr/local/share/uacme’
/bin/mkdir -p ‘/usr/local/share/man/man1’
/usr/bin/install -c -m 644 uacme.1 ualpn.1 ‘/usr/local/share/man/man1’
make[2]: se sale del directorio ‘/root/uacme2’
make[1]: se sale del directorio ‘/root/uacme2’
u have to remove certbot from ubuntu distribution,and installed certbot-auto,
root@www:~/uacme2# certbot-auto --version
certbot 1.4.0
Then to test i have executed this:
certbot-auto certonly --standalone --preferred-challenges tls-alpn-01 -d agileleader.linkpc.net
The output is
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator standalone, Installer None
Cert is due for renewal, auto-renewing…
Renewing an existing certificate
Performing the following challenges:
None of the preferred challenges are supported by the selected plugin
is the cli command right or i do missing something else?
Greetings
Oh sorry, i wasn’t checked all the github intructions on Readme.md, let me try to complete the test…
i ran ualpn in daemond mode but i can not open 4443 externally, is there a way ualpn work on localhost on 4443 an the reverse proxing be made by haproxy?
Regards
Hi,
Here is my feedback, it works on Ubuntu 18.02LTS, the Github Readme its a very good guide, the only thing i will like to suggest is not to ask external ports like 4443 on the ualpn service, becuase in my case i can not open external ports and guess many other people won’t also,it will be nice that ualpn works on a local port and the reverseproxy was made by ngix, apache or haproxy, the good news is that i could renew three letsencrypt certificates thanks to your software even i have to stop the haproxy server , but also i understand this is an iterative work going on, so i want to thank you by the support and i certainly can validate that your software works ok, at least in my environment that like you said its a little older x86 server, but useful like a charm for the tasks needed til now…
I think you have misunderstood how ualpn works. It’s a transparent proxy, with the exception that it carries out tls-alpn-01 challenges. To do so ualpn has to listen on port 443, in front of anything else. You don’t need to open 4443 externally, and it doesn’t need to be port 4443, it can be any port. You just need to make your webserver, or even haproxy, listen to this new port and ualpn will redirect to it any connection from outside to 443 which is not a tls-alpn-01 challenge.
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.