I run a CMS site similar to reddit (but where karma = bitcoin). One of the key differentiators that puts it more into tumblr’s and WordPress’s space is that users can create their own communities and tie them to custom domains (so it can be used as a blog or forum platform). I also allow them to provide an SSL certificate for the custom domain so users can login directly into their domain.
In my use case, the user will either provide their own cert or will ask support to generate a free one for them using Let’s Encrypt. At this point, I expect we will generate the Let’s Encrypt (LE) cert manually (e.g., through gethttpsforfree.com/). However, for renewals, I want to build a renewal cron job into the CMS. Conceptually, the way I envision it working is:
The app will check if the requested URL matches LE_URL and, if it does, it will return LE_response and end (this is instead of having a file with the LE content in mydomain.com/.well-known/acme-challenge/filename)
The cron will, on a schedule, check the cert_expiration_date for each custom_domain and, if the cert will expire within 2 weeks, send a post to the LE API to renew with the appropriate arguments (e.g., domain name, private key)
LE requests LE_URL and verifies LE_response (which the app returned based on the table)
If the correct LE_response is received, LE responds with the updated cert and new expiration date
The app replaces the cert file and updates cert_expiration_date in the table
I would not recommend to use a third-party for this. Just use an LE/ACME client on your own server to do this.
Introducing more participants and connections (your server --> gethttpsforfree.com ---> LE server) is not really a good idea. Additionally according to the repo gethttpsforfree makes AJAX requests so it uses JS, which you certainly cannot execute on your server - unless you also deliver this to the end user in their browser, so you have the three-connections again.
In any way is very cumbersome, so the easy solution is: Use the LE client - maybe adapt it for your needs, but just use it and run it on your server.
As for the general question: You may have a look at the API docs. They describe how you have to make the requests. How you store and deliver the stuff on your site is your job, but possibly someone can recommend you some "best practises".
FYI it may also be worth looking into acme-triny.
I’m very hesitant to install any LE/ACME clients at this point because my CMS is a production app and I don’t yet have the time or familiarity with how LE works to go through the client’s code and understand all that it’s doing. So I don’t mind having to spend a few minutes manually creating a cert through something like gethttpsforfree.com and then manually installing it. My current userbase isn’t tech-savvy enough to go and get their own certs so I want to be able to provide those for them. Just to be clear: valME.io support will be manually going to gethttpsforfree.com to get the cert. This will not be automated.
I did look at the API docs but, admittedly, I had a hard time understanding them (examples would have been helpful). I also did look at acme-tiny before posting here but, in addition to my comment above about not yet wanting to install a client, I don’t have any background using Python and don’t have it installed on my server.
Thus, if I can manually create the cert and then add some PHP code to my app to do the renewal, I can help my users get the SSL certs for their domains that they wouldn’t get otherwise.