it would be great if, as part of the SSL integration, ikiwiki-hosting would call up on the letsencrypt.org gods to install proper certs.

so far I have done this by hand:

  1. install the letsencrypt client software:

    • if you are on Debian sid, stretch (or when letsencrypt enters backports):

         apt install letsencrypt
      
    • otherwise, run the magic commands:

         git clone https://github.com/letsencrypt/letsencrypt
         cd letsencrypt
         ./letsencrypt-auto --server https://acme-v01.api.letsencrypt.org/directory --help
      
  2. request a certificate:

     sudo -s
     source venv/bin/activate
     letsencrypt certonly --webroot \
       --server https://acme-v01.api.letsencrypt.org/directory \
       --agree-dev-preview --agree-tos \
       --webroot-path=/home/w-example/public_html/ \
       --domains example.com --email nobody@example.com
    

    ... notice how you need to change the two last lines for your environment.

  3. this will create a certificate in /etc/letsencrypt/live/example.com. install it where ikiwiki expects it:

     ln -s /etc/letsencrypt/live/example.com/cert.pem /etc/ikiwiki-hosting/config/w-example/ssl.crt
     ln -s /etc/letsencrypt/live/example.com/fullchain.pem /etc/ikiwiki-hosting/config/w-example/ssl.chain
     ln -s /etc/letsencrypt/live/example.com/privkey.pem /etc/ikiwiki-hosting/config/w-example/ssl.key
    
  4. regenerate the apache configs and restart apache:

     ikisite enable example.com
     service apache2 reload # or restart?
    

Ikiwiki hosting would need to perform steps 3 to 5, and probably have a Recommends on letsencrypt. -- anarcat

Oh, and this could be a plugin, not sure if that would make sense, but it's the way it works on that side of the world.

Finally, note that there is now a fairly large set of Let's Encrypt clients. For example, there is a bash-only client that could work in Wheezy and a much simpler implementation in Python. Those have not been reviewed or tested for compatiblity with ikiwiki-hosting however.

Also, renewals need to be processed in some way.

I would much rather use something small enough to be reviewable, particularly if we're going to have to run it unattended as root; the official Let's Encrypt client is huge. We don't have to worry about portability to non-Debian environments or non-Apache web servers, which takes away a lot of the reason to use something so big. --smcv