Renew Let's Encrypt Certificate on OpenWRT Router without Opening HTTP Server on WAN Side using ACME.sh

Renew Let's Encrypt Certificate on OpenWRT Router without Opening HTTP Server on WAN Side using ACME.sh

In this article, we will discuss the process of renewing Let's Encrypt certificates on OpenWRT routers without opening the HTTP server on the WAN side. Instead, we will use the ACME.sh client to automate the certificate renewal process. This method is safer and more secure, as it doesn't expose any open ports on the WAN side.

Prerequisites

Before starting the process, make sure you have the following:

• An OpenWRT router with uHTTPd providing a UI on the internal LAN.
• Ports 80 and 443 are blocked on the WAN side for safety.
• An existing Let's Encrypt certificate issued through the ACME.sh client.

Overview of the Process

The process involves the following steps:

1. Configuring the uHTTPd server on OpenWRT to listen on the LAN side.
2. Setting up a challenge to verify domain ownership through the ACME.sh client.
3. Renewing the Let's Encrypt certificate.
4. Updating the uHTTPd configuration and reloading the server.

Step 1: Configuring uHTTPd Server on OpenWRT

To configure the uHTTPd server, follow these steps:

1. Log in to the OpenWRT router via SSH or the web UI.
2. Open the uHTTPd configuration file using your preferred text editor, such as nano or vi.

nano /etc/uhttpd.conf
 

3. Add the following lines to configure the server to listen on the LAN side:

listening_http_port = 80
 listening_interface = lan
 

4. Save and exit the file.
5. Restart the uHTTPd server to apply the changes.

/etc/init.d/uhttpd restart
 

Step 2: Setting up a Challenge with ACME.sh

To set up a challenge using the ACME.sh client, follow these steps:

1. Install the ACME.sh client if you haven't already done so.

opkg install acme.sh
 

2. Generate a new account key for the ACME.sh client.
   Execute the following command:

acme.sh --register-account -m [email protected]
 

3. Set up a challenge for your domain using the DNS-01 challenge type.

acme.sh --issue --dns dns_cloudflare -d example.com
 

4. Follow the instructions provided by the ACME.sh client to setup DNS records for the DNS-01 challenge.
5. Once the DNS-01 challenge is completed successfully, the Let's Encrypt certificate will be generated.

Step 3: Renewing the Let's Encrypt Certificate

To renew the Let's Encrypt certificate using the ACME.sh client, follow these steps:

1. Execute the following command:

acme.sh --renew -d example.com
 

2. Confirm the renewal by typing 'y' when prompted.
3. Once the renewal is completed successfully, the new certificate will be stored in the designated directory.

Step 4: Updating uHTTPd Configuration and Reloading the Server

To update the uHTTPd configuration and reload the server, follow these steps:

1. Open the uHTTPd configuration file.

nano /etc/uhttpd.conf
 

2. Update the SSL certificate and key paths to the renewed ones.

ssl_cerficate = /path/to/new/certificate.crt
 ssl_key = /path/to/new/private.key
 

3. Save and exit the file.
4. Reload the uHTTPd server to apply the changes.

/etc/init.d/uhttpd reload
 

We have discussed the process of renewing Let's Encrypt certificates on OpenWRT routers without opening the HTTP server on the WAN side using the ACME.sh client. This process ensures the safety and security of your network by not exposing any open ports on the WAN side. The process involves configuring the uHTTPd server to listen on the LAN side, setting up a challenge using the ACME.sh client, renewing the Let's Encrypt certificate, and updating the uHTTPd configuration.

References

• uHTTPd on OpenWRT
• ACME.sh
• Let's Encrypt