How to generate a wildcard cert with Let's Encrypt, if I don't have sudo access on my server?

freessltools.com · August 5, 2020, 12:05am

Just a curiosity, but why would symlinks be created instead of putting the actual files there?

cagross:

Congratulations! Your certificate and chain have been saved at:
   C:\Certbot\live\everlooksolutions.com\fullchain.pem
   Your key file has been saved at:
   C:\Certbot\live\everlooksolutions.com\privkey.pem

This seems like a really misleading output if that's the case.

schoen · August 5, 2020, 12:17am

This is based on the design we use on Unix platforms, where you can then specify the path to the live file in your web server configuration, and it will continue pointing to the updated files after every subsequent renewal.

freessltools.com · August 5, 2020, 12:24am

Ah. I feel like my later comment still holds though. Really confusing to the user. Windows symlinks are notoriously awful.

schoen · August 5, 2020, 4:09am

It works well on Unix because you commonly type paths into configuration files (or Certbot will do that for you!), and the OS will always follow the link. Maybe it’s more confusing on Windows? Can you think of a better way for it to work so that the Windows applications configured with the certificates will successfully get the new file versions after a renewal?

freessltools.com · August 5, 2020, 6:10am

My initial leaning would probably be to use an environment variable that hooks into the path. This would ensure a universal authority for locating the certificates and such that could be nullified or switched as necessary. It also has the added benefit of being accessible and modifiable in batch scripts. Honestly, given the right libraries or standalone executables, one could probably write an entire “universal” acme client in windows using nothing but batch scripting. Makes the process totally transparent, easily maintainable, and far easier to distribute. No need to compile. Could even be self-upgrading.

rg305 · August 5, 2020, 6:31am

And I use notepad to do website development.
[true story]

9peppe · August 5, 2020, 7:03am

I use a makefile automate a directory listing on a static website with

echo "<!doctype html>" > $@

and then a series of

echo "something" >> $@

I’d say that’s a lot more raw than notepad.exe

cagross · August 5, 2020, 7:27am

@schoen @freessltools.com

Short Answer

Success! I was able to find the files, add them to GoDaddy, and confirmed my site now has a valid SSL cert until 28 October, 2020. Thanks very much for your help. Let’s maybe keep this thread handy for other users of GoDaddy/Windows.

Long Answer

I want to say that when I originally ran certbot to create the files in the live/everlooksolutions.com folder, (~6 days ago), I opened at least one of them, and was able to confirm it contained keys, as expected. In fact, it looks like I must have done that for at least fullchain.pem, since I somehow knew that it contained two separate keys.

Here’s what I did. I opened a Git Bash client, navigated to the /live/everlooksolutions.com folder, and ran an ls -l. It seemed to indicate the actual files were in ../../archive/everlooksolutions.com/ (screenshot). I then opened that file location in Windows Explorer and could see those files.

If I double click a file (e.g. fullchain1.pem), my text editor opens, but displays no content–completely blank. If I open the text editor by itself, then try click File–>Open and select fullchain2.pem, the text editor indicates I do not have the permissions to view this file (screenshot). This occurs with text editors Notepad and VSCode.

If I open my BASH command line application (Git Bash for Windows), navigate to the archive/everlooksolutions.com folder, and execute vi fullchain2.pem then Vim opens and I can see all the text inside.

To resolve this, I first had to open a text editor (Notepad, VSCode), as administrator. Once I did that, I was then able to click File–>Open and open fullchain2.pem.

I then added my cert and private key to my GoDaddy GUI, as instructed. FYI GoDaddy autofilled the CABUNDLE after I added my cert. GoDaddy accepted that certificate, then seemed to apply it to my domain and all subdomains. I confirmed that by loading my website in a browser, as well as sending some test emails.

So I guess we can consider this resolved. Thanks so much for your time and patience. I am in the process of moving web/email hosting away from GoDaddy, so hopefully this is the only time I have to do this.

freessltools.com · August 5, 2020, 7:41am

Glad you got it all working. That’s quite a trip to view the files. Honestly, glad you got the experience using the client. Had I have known what you’d go through, you probably could have saved a world of time and headache just using the client on my site then copying and pasting the cert into GoDaddy.

freessltools.com · August 5, 2020, 7:44am

I've coded six websites in raw PHP including the entire acme client on my site using only QuickEdit on my android phone.

9peppe · August 5, 2020, 7:45am

That's pure masochism.

@cagross: if you only want to see the files, you should use head or less, maybe cat. Don't use vi if you don't plan on editing them.

freessltools.com · August 5, 2020, 7:49am

Who needs those newfangled silverware things when we got fingers and twigs.

9peppe · August 5, 2020, 7:51am

Small screens I’m ok with, small keyboards, I’m not: I could not write on my phone without predictive keyboards, and good luck coding with that.

In your situation I’d probably end up using emacs inside termux, though. (because I’m used to it and termux means I can install stuff like git, curl… in alternative, I can always use emacs inside tmux on a remote vps )

freessltools.com · August 5, 2020, 7:56am

Guess I’ve taken the whole “develop for mobile first” a bit further than necessary. When I look at code on a monitor it looks huge now. QuickEdit does OK until it forgets the language I’m using and stops color-coding. The funny part is that the predictive keyboard on my S10 actually scans the entire source file I’m working on and suggests pieces of code based on similar patterns.

freessltools.com · August 5, 2020, 7:58am

Half the time I end up having multiple tabs open in my browser and use the Terminal in cPanel to just copy and paste quick commands when I need to. Occasionally I forget which site I’m actually logged into. Uploading index files to the wrong site makes for an amusing experience.

9peppe · August 5, 2020, 8:03am

Another makefile of mine has a deploy target that builds a jekyll website and then uploads the result via ftp, using lftp. Solves this problem.

Yeah, I really don’t like control panels.

freessltools.com · August 5, 2020, 8:06am

Living on the command line. No GUI for you.

JimPas · August 6, 2020, 5:26am

You two sound like you both have too much free time on your hands.
I’m still trying to figure out how to squeeze 40 hours into a 24-hour day. Maybe make the earth slow its spin some? Will that add hours or just make the existing hours longer?

freessltools.com · August 6, 2020, 5:30am

Exactly. Time in a bottle. Just makes you age sooner.

JimPas · August 6, 2020, 5:31am

Oh no… I’ve already got bags under my eyes - enough to go on vacation/holiday for 2 weeks.