(What’s a “holiday”?) And what is DANE? DNSSEC at your registrar makes sure you get the correct IP address when you want to connect, while a DANE TLSA record (signed by DNSSEC) will give information about the SSL/TLS certificate you can expect at the specific service you are connecting to. So per…

The most recent LE+DANE thread I could find is here . But there’s also this more recent post which describes several certbot options I’ve never seen, which I suspicion are new. I think it’s likely that certbot is under heavy development and may have some useful new options WRT DANE (and other funct…

[image] Quantum: So far, so good. Now I have my LE certs in place, but how to renew? I needed certonly, to get my initial certs with a custom --csr, so I doubt that certbot will be happy with a simple run. (although it does work with --dryrun) My understanding is that certs fetched with certo…

[image] AfroThundr: you might try mine It's complex. And clearly not for RHEL. It'll take me a while to check every command for translation. There are so many things that can go wrong, and I have to make sure I'm aware of it if they do. Why ECDSA? That was promulgated with input from one…

Modifying the script for RHEL/CentOS variants should mostly be a matter of changing the paths to the certificates and keys. But of course, reviewing foreign code before using it is best practice. As for why I use ECDSA, simply for the smaller, more efficient key sizes. I’d gladly exchange the NIST …

So nothing. No input from devs?

This was the thread I was trying to point you to: Please avoid “3 0 1” and “3 0 2” DANE TLSA records with LE certificates . It seems like the missing piece for you is easy automated renewal without rotating keys. There’s a Certbot issue open for that.

[image] Quantum: I can just update with a regular run and --csr to specify the same cert over and over so DANE doesn’t get upset. This is correct. To renew the certificate just return the same certbot command you ran with --csr in the first place. There is no need to regenerate the CSR every …

Hm, I'm using a systemd timer. (They're encouraging us to move to that over cron) So my letsencrypt.service would look like: [Unit] Description=Service for SSL cert renewals [Service] #EnvironmentFile=/etc/sysconfig/certbot Type=oneshot ExecStart=/usr/bin/certbot certonly --csr /etc/letsencrypt/c…

You shouldn’t need to pass -d at all, as certbot should ignore it and use what’s in the CSR. You need --apache in the first ExecStart line as well, or --webroot -w /var/www/html, or whichever authentication method you are using. You also want to set WorkingDirectory to the directory you want your …

LetsEncrypt + DANE

Help

jsha November 24, 2017, 3:13am 2

There’s a thread in this forum by a DNSSEC/DANE expert, a couple years back, explaining best practices here. Search for “3 1 1 Dane”, I think.

Topic		Replies	Views
Understanding SMTP DANE implementation options Issuance Tech	13	6428	October 14, 2022
Help us test renewal with "letsencrypt renew" Client dev	36	52619	April 9, 2016
Unable to Renew Three Sites Help	16	1887	March 24, 2018
Please avoid "3 0 1" and "3 0 2" DANE TLSA records with LE certificates Server	18	36640	October 14, 2018
DANE+TLSA record generation Issuance Tech	26	2457	June 6, 2024

LetsEncrypt + DANE

Related topics