{"id":152,"date":"2023-06-20T03:55:17","date_gmt":"2023-06-20T03:55:17","guid":{"rendered":"https:\/\/lance.conryclan.com\/home\/?p=152"},"modified":"2023-06-20T04:11:44","modified_gmt":"2023-06-20T04:11:44","slug":"updating-lan-ssl-certificates","status":"publish","type":"post","link":"http:\/\/lance.conryclan.com\/home\/updating-lan-ssl-certificates\/","title":{"rendered":"Updating LAN SSL certificates"},"content":{"rendered":"\n

Renewing LAN based SSL certificates and installing them to a Synology NAS and RouterOS device was a bit of a hullabaloo, so want it documented for when it breaks in three years, by which time I will have forgotten how it was configured.<\/p>\n\n\n\n\n\n\n\n

This approach was inspired by Renew Let’s Encrypt certificates on Synology using acme.sh – Christos Georgiadis<\/a>.<\/p>\n\n\n\n

The updating is via a monthly CRON script which runs on my Synology NAS device (SINO).<\/p>\n\n\n\n

acme.sh<\/a> is used to do the updating, but rather than install it directly on SINO, it will be run from within the neilpang\/acme.sh docker image<\/a>. For context, I used to have it installed directly on SINO, but with a host of permission issues, it needed to run as root, and was never entirely stable. Using Docker will allow me to keep things simple, with the least setup should it need to be moved to a different host. the image is based on Alpine Linux, so only about 5MB.<\/p>\n\n\n\n

SINO Setup<\/strong><\/p>\n\n\n\n

    \n
  1. Install the Docker app onto Synology.<\/li>\n\n\n\n
  2. From Docker, download the neilpang\/acme.sh docker image.<\/li>\n\n\n\n
  3. SSH into SINO and create the following folder: \/volume1\/docker\/acme<\/code><\/li>\n\n\n\n
  4. From the Synology control panel, create a user with the following permissions:\n
      \n
    • Disallow user to change password<\/li>\n\n\n\n
    • Groups: Administrators, Users<\/li>\n\n\n\n
    • Share Permissions: docker<\/li>\n\n\n\n
    • Applications: DSM<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n\n\n\n

      Mikrotik Setup<\/strong><\/p>\n\n\n\n

        \n
      1. Create a new user group with the following permissions:\n
          \n
        • ssh, ftp, read, write, password, sensitive<\/li>\n<\/ul>\n<\/li>\n\n\n\n
        • Create a new user, and assign to the newly created group<\/li>\n<\/ol>\n\n\n\n

          SSH Configuration<\/strong><\/p>\n\n\n\n

          In order to update the Mikrotik RouterOS, we will need to be able to connect via SSH. For this to work, we need to setup several things.<\/p>\n\n\n\n

            \n
          1. Create a pair of SSH keys with ssh-keygen<\/code>.<\/li>\n\n\n\n
          2. Copy the keys to \/volume1\/docker\/acme<\/code> on Redbeard.<\/li>\n\n\n\n
          3. Copy the public key (probably id_rsa.pub) to the Mikrotik router, and assign it to the user we created under System -> Users -> SSH Keys<\/li>\n<\/ol>\n\n\n\n

            Renewal Script<\/strong><\/p>\n\n\n\n

            Create a bash script to run the renewal steps and save it to \/volume1\/docker\/acme<\/code><\/p>\n\n\n\n

            <code class="language-bash"># DNS verification variables\nexport DH_API_KEY='ZZZ-ZZZ'\n# Synology deployment variables\nexport SYNO_Server='192.16.1.1'\nexport SYNO_Username='sinoUser'\nexport SYNO_Password='xxxx-xxxx'\n# RouterOS deployment variables\nexport ROUTER_OS_USERNAME=mikUser\nexport ROUTER_OS_PASSWORD='yyyy-yyyy'\nexport ROUTER_OS_HOST=192.168.2.2\nexport ROUTER_OS_PORT=22\n# setup acme\nacme.sh --upgrade\nacme.sh --set-default-ca  --server  letsencrypt\n# get certificates\nacme.sh --issue --dns dns_dreamhost -d &lt;gaul's domain name> --dnssleep 300\nacme.sh --issue --dns dns_dreamhost -d &lt;sino's domain name> --dnssleep 300\n#deploy to Synology NAS\nacme.sh --deploy -d &lt;sino's domain name> --deploy-hook synology_dsm\n# deploy to RouterOS\n# Setup SSH before we can deploy to RouterOS.\nmkdir \/root\/.ssh\ncp \/acmeConf\/id_rsa \/root\/.ssh\/\nchmod 600 \/root\/.ssh\/id_rsa\nssh-keyscan -H $SOUTER_OS_HOST >> \/root\/.ssh\/known_hosts\necho "Host *\nHostKeyAlgorithms +ssh-rsa\nPubkeyAcceptedKeyTypes +ssh-rsa" >> \/root\/.ssh\/config\nacme.sh --deploy -d &lt;gaul's domain name> --deploy-hook routeros<\/code><\/pre>\n\n\n\n
            Wiring it all up<\/strong><\/p>\n\n\n\n
            The final step is to create a cron job on SINO to renew the certs every two months.<\/p>\n\n\n\n
              \n
            1. SSH into SINO, and elivate the terminal with sudo -i.<\/li>\n\n\n\n
            2. Add the following line to the crontab file (note, tabs, not spaces):<\/li>\n<\/ol>\n\n\n\n
              <code class="language-bash">0\t0\t1\t*\/2\t*\troot\tbin\/su -c 'docker run --rm --mount type=bind,source=\/volume1\/docker\/acme,target=\/acmeConf neilpang\/acme.sh .\/acmeConf\/dockerRenew.sh >> \/volume1\/docker\/acme\/certInstall.log' sslUpdator <\/code><\/pre>\n\n\n\n
              Some blurb to remind me of what’s going on.<\/strong><\/p>\n\n\n\n
                \n
              • The docker image is raw; no changes are made to it, so we can grab a new image with a new version of acme.sh, and no additional changes will be required to the image.<\/li>\n\n\n\n
              • All config is found on SINO at \/volume1\/docker\/acme.<\/li>\n\n\n\n
              • When docker starts the container, it binds the config folder to the container, making it available within the running docker container.<\/li>\n\n\n\n
              • The docker container is not long running.  The bash script starts the container up, causes it to execute our script, then shuts down the container.  The log file is saved to the config folder.<\/li>\n\n\n\n
              • Oh, and Lance, remember that the scripts are in your GitHub repository.<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"
                Renewing LAN based SSL certificates and installing them to a Synology NAS and RouterOS device was a bit of a hullabaloo, so want it documented for when it breaks in three years, by which time I will have forgotten how it was configured.<\/p>\n","protected":false},"author":1,"featured_media":154,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-152","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized"],"_links":{"self":[{"href":"http:\/\/lance.conryclan.com\/home\/wp-json\/wp\/v2\/posts\/152","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/lance.conryclan.com\/home\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/lance.conryclan.com\/home\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/lance.conryclan.com\/home\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/lance.conryclan.com\/home\/wp-json\/wp\/v2\/comments?post=152"}],"version-history":[{"count":3,"href":"http:\/\/lance.conryclan.com\/home\/wp-json\/wp\/v2\/posts\/152\/revisions"}],"predecessor-version":[{"id":156,"href":"http:\/\/lance.conryclan.com\/home\/wp-json\/wp\/v2\/posts\/152\/revisions\/156"}],"wp:featuredmedia":[{"embeddable":true,"href":"http:\/\/lance.conryclan.com\/home\/wp-json\/wp\/v2\/media\/154"}],"wp:attachment":[{"href":"http:\/\/lance.conryclan.com\/home\/wp-json\/wp\/v2\/media?parent=152"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/lance.conryclan.com\/home\/wp-json\/wp\/v2\/categories?post=152"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/lance.conryclan.com\/home\/wp-json\/wp\/v2\/tags?post=152"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}