My web server is (include version): Debian 13 server, Brother Printer web UI
I can login to a root shell on my machine (yes or no, or I don't know): Server, yes. Printer, no.
+++
I have Let's Encrypt set up on my home web server (running Debian) to pull a wildcard cert, and it's working wonderfully. Once it's deployed to my websites, I have a script that then deploys the renewed cert to various infrastructure devices in my home (several Raspberry Pis, my UPS management cards, etc.) so everything can use https with my domain. Up to this point, everything works like a charm.
I recently got a new Brother Laser Printer, and found a utility that will convert the LE cert to the preferred format and push it to the printer. The challenge is that the printer needs to be set up with https first to enable the push, and there is an issue with the server running LE authenticating to the printer's UI, even with a cert manually installed on the printer. I opened a bug report with the developer of the utility, and he noted that there is a limitation on the printer itself whereby it's not storing the YR cert, breaking the chain of trust:
I can browse to the UI from my Mac & Windows laptops running Chrome without issue since my browser has the YR cert, but my Debian server does not have it in its store. I'm still new to LE and Debian, and tried manually adding the YR cert to my Debian server's store, but I can't quite figure out the exact commands needed to do this.
Is anyone able to guide me, step by step, through the commands needed to manually install the YR cert on my Debian server, so that it will talk to the printer?
You should be able to add .crt file to /usr/local/share/ca-certificates/ and run the update-ca-certificates program to make your system trust additional roots.
Right. Where I’m running into trouble is I don’t know how to do that - how to download the YR cert, specifically. I can’t find it in my local server, or any links to it online. Lots of guidance, no specifics.
Just tried the following on my server and this works:
sudo sh -c 'curl -o /usr/local/share/ca-certificates/le-yr.crt https://letsencrypt.org/certs/gen-y/root-yr.pem && update-ca-certificates'
This command fails at first: curl https://valid.yr.test-certs.letsencrypt.org/ but after running the command above, it works fine; confirming that the cert was successfully added to the trust store.
The correct answer is that you shouldn't have to manually manage your trust store at all. YR (and YE) will eventually land in Debian's trust store (through Mozilla's Root Program), but in the meantime - and likely for several years longer - Let's Encrypt's default chain will include the YR-by-X1 cross-sig as an intermediate.
The real problem to solve here is why your printer can't serve the full certificate chain as provided by LE.
Edit: if size of the chain (in bytes) is the issue, rather than the number of certs in the chain, you could consider switching to ECC certs, which are much smaller...
Another alternative, if it's just for internal use, is to create a self-signed cert (or a private CA).
I think the only key type they support is RSA 2048. Additionally, I suspect its a chain count as opposed to byte limit. There are no errors if there are more intermediates. It just silently only saves the end cert and first intermediate.
Probably not much can be down outside adding the new root manually.