Nginx and acme-client on OpenBSD

Author: Solène

Date: 04 July 2019

Tags: openbsd nginx automation

NILI write this blog post as I spent too much time setting up nginx and

SSL on OpenBSD with acme-client, due to nginx being chrooted and not

stripping path and not doing it easily.

First, you need to set up **/etc/acme-client.conf** correctly. Here is

mine for the domain ports.perso.pw:

authority letsencrypt {

api url "https://acme-v02.api.letsencrypt.org/directory"

account key "/etc/acme/letsencrypt-privkey.pem"

}

domain ports.perso.pw {

domain key "/etc/ssl/private/ports.key"

domain full chain certificate "/etc/ssl/ports.fullchain.pem"

sign with letsencrypt

}

**This example is for OpenBSD 6.6 (which is current when I write this)

because of Let's encrypt API URL. If you are running 6.5 or 6.4,

replace v02 by v01 in the api url**

Then, you have to configure nginx this way, the most important part in

the following configuration file is the location block handling

acme-challenge request. Remember that nginx is in chroot /var/www so

the path to acme directory is `acme`.

http {

include mime.types;

default_type application/octet-stream;

index index.html index.htm;

keepalive_timeout 65;

server_tokens off;

upstream backendurl {

server unix:tmp/plackup.sock;

}

server {

listen 80;

server_name ports.perso.pw;

access_log logs/access.log;

error_log logs/error.log info;

root /htdocs/;

location /.well-known/acme-challenge/ {

rewrite ^/.well-known/acme-challenge/(.*) /$1 break;

root /acme;

}

location / {

return 301 https://$server_name$request_uri;

}

}

server {

listen 443 ssl;

server_name ports.perso.pw;

access_log logs/access.log;

error_log logs_error.log info;

root /htdocs/;

ssl_certificate /etc/ssl/ports.fullchain.pem;

ssl_certificate_key /etc/ssl/private/ports.key;

ssl_protocols TLSv1.1 TLSv1.2;

ssl_prefer_server_ciphers on;

ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH";

[... stuff removed ...]

}

}

That's all! I wish I could have find that on the Internet so I share

it here.