Trellis: Using CloudFlare compatible way method for Let's Encrypt

[partounian]

Submit a feature request or bug report

• [x] I've read the guidelines for Contributing to Roots Projects
• [x] This is a feature request
• [ ] This is a bug report
• [x] This request isn't a duplicate of an existing issue
• [x] I've read the docs and followed them (if applicable)
• [x] This is not a personal support request that should be posted on the Roots Discourse forums

---

I'm sure I've seen this before but can't find it now, can we support using certonly and webroot method to allow setting up SSL on CloudFlare sites? We also should consider sites that use a Let's Encrypt cert then added CloudFlare, some way to set authenticator = webroot .

https://support.cloudflare.com/hc/en-us/articles/214820528-How-to-Validate-a-Let-s-Encrypt-Certificate-on-a-Site-Already-Active-on-Cloudflare

[swalkinshaw]

I'm a little rusty on LE stuff, but I'm pretty sure this is exactly what Trellis is already doing.

If you’re running a local webserver for which you have the ability to modify the content being served, and you’d prefer not to stop the webserver during the certificate issuance process, you can use the webroot plugin to obtain a certificate by including certonly and --webroot on the command line.

The webroot plugin works by creating a temporary file for each of your requested domains in ${webroot-path}/.well-known/acme-challenge. Then the Let’s Encrypt validation server makes HTTP requests to validate that the DNS for each requested domain resolves to the server running certbot.

Confirmed, this is what Trellis does :)

edit: we don't use certbot, but the process is the same.

[partounian]

I don't think so as I've trouble with Cloudflare and Trellis unless it
changed recently?

[swalkinshaw]

I really can't speak to Cloudflare itself. All I know is that's the challenge method we use with LE and the general process. If you find out more specifics feel free to re-open the issue.

[mikaelwedemeyer]

@partounian I'm not sure if this is helpful, and it probably isn't the appropriate forum for a discussion as opposed to on the Trellis discourse, but we have the same issue, so use self-signed certificates for Cloudflare sites on trellis, which is fine as long as you don't have strict SSL checking enabled in Cloudflare.

I know I investigated the alternative Letsencrypt verification methods and considered making this modification ourselves, but the self-signed solution works.

Also, I saw Letencrypt has wildcard certificates and TXT based domain verification, so a change to support that in Trellis in the future as an alternate SSL provider from the current Letsencrypt approach is a way to do.

[partounian]

@mikaelwedemeyer I currently use the self-signed solution also, but an LE cert would with Full (Strict) on CloudFlare would warm my heart. I am currently looking into how things are/how a fix would be implemented and one thing I noticed so far is the repo we copied has changed from using acme-tiny to using dehydrated which supposedly has more features, is strongly recommended and can remove(?) python as a dependency.

https://github.com/andreaswolf/ansible-role-letsencrypt
https://github.com/andreaswolf/ansible-role-letsencrypt/commit/83d9710043ef54727ab5495d4355469dd40cbf08

Edit: I think it is appropriate as this isn't personal support but rather fixing LE for all CloudFlare users.
Edit 2: This might be why CF doesn't work 🙃 https://github.com/diafygi/acme-tiny/pull/68 and https://github.com/diafygi/acme-tiny/issues/11

In short, problem is because acme-tiny doesn't send a User Agent and CF blocks that, you can disable that security feature, it is called Browser Integrity Check. We can also selectively disable it by using a Page Rule, I will test this on the URL /.well-known/acme-challenge which _should_ fix it. Would love if others can test this also.

[adleviton]

I found using Let's Encrypt with CloudFlare to be troublesome. Especially when it comes to the renewal process. I found it much easier to download CloudFlare's free SSL certificates, and set the Trellis SSL Provider to "manual", and it worked great.

[TangRufus]

I found it much easier to download CloudFlare's free SSL certificates, and set the Trellis SSL Provider to "manual"

Why not https://github.com/TypistTech/trellis-cloudflare-origin-ca ?

[partounian]

I think self-signed is better because it doesn't involve going to CloudFlare and you can't Origin CA enforcement is per domain right? So if there is a subdomain that doesn't want to use origin CA you can't do origin ca verification.

Though I do plan on looking into a solution for support CloudFlare with Trellis & LE.

[TangRufus]

I think self-signed is better because it doesn't involve going to CloudFlare and you can't Origin CA enforcement is per domain right?

Not to confuse with Authenticated Origin Pulls.

---

trellis-cloudflare-origin-ca and @adleviton's "manual" way are the same thing. They install a self-signed certificate trusted by cloudflare (self refers to cloudflare here).

The letsencrpyt + cloudflare way install a "real" valid certificate.

All of the above allow you setting cloudflare's ssl level to "Full (strict)".
Assuming you are not using the USD$200 plan, all of the above show cloudflare's cert to end users(web browsers).

Using a self-signed certificate (not trusted by cloudflare), you need to lower cloudflare's ssl level to "Full" which is a bad thing (self refers to you here).

You could lower subdomain/path ssl level by page rules. However, I don't think of any legitimate use case. You should always use "Full (strict)".

Question: Why do you prefer using letsencrpyt rather than cloudflare origin ca?

[partounian]

Question: Why do you prefer using letsencrpyt rather than cloudflare origin ca?

@TangRufus
On a high level if LE worked with CF then it would be easier to use than adding the origin-ca module, and it would be a "real" cert.

[danielroe]

I can confirm with @partounian that adding a Page Rule matching *example.com/.well-known/acme-challenge* for which the Browser Integrity Check is set to Off makes LetsEncrypt certificate issuance work.

[partounian]

Just an update for others, I have been using CF Origin CA for some time now thanks to @tangrufus's trellis package.

[Demonax]

I've been following along this discussion for a few years now, having had the same issues getting LE to play along with CloudFlare.

I've been using the origin-ca ansible role to get around this, and it works, but there's a problem:

https://github.com/TypistTech/trellis-cloudflare-origin-ca/issues/40

This solution doesn't auto-renew the certificates as LE or Certbot will, it won't warn you of impending expirations, and to correct it involves manually deleting the old certs from the server followed by re-provisioning.

Which is the reason I'm here, because three of my sites went offline this morning thanks to an expired SSL cert.

Fortunately I was in a position to fix it in a hurry, but I about gave myself indigestion thinking what would have happened if I'd been out of town for the weekend.

Which brings me back to this issue... is there really no good solution to automate the SSL certificates while also using Cloudflare?

I've tried the page rule suggestion mentioned by @danielroe in his comment but that didn't get me anywhere but the same errors you get without the rule.

Before I used Trellis, Certbot with the Nginx module worked like a charm even with Cloudfllare switched on. I really like the Trellis approach, but after going around in circles with SSL for 18 months, or having to turn off CF, this is getting awfully close to deal-breaker for me.

[partounian]

15 year certs :joy_cat: