apacheĬert-puller uses sudo to copy files around. SERVICES – The list of services to be restarted.

MYCERTS – A space separated list of the domains to be downloaded and installed.

The certificates will be available from this directory.

CERT_SERVER – This is the URL to the webserver.

They are closely connected to the default values for the acme.sh port. The cert-puller configuration file is /usr/local/etc/anvil/nf. The cert-puller script supplied by the anvil package will run as that user. The anvil package installs the anvil user: $ grep anvil /etc/passwdĪnvil:*:217:217:anvil certificate dropper:/var/empty:/usr/sbin/nologin I installed anvil from a FreeBSD package: pkg install anvil This will need to be done on every host which you want to install the certificates. In this post, I will describe how I configured cert-puller to download & install certificates, and then restart services.

anvil – copying the certificates to the website.

cert-shifter: copying certificates from acme.sh to a fresh directory.

Introducing anvil – Tools for distributing ssl certificates.

acme.sh: getting free SSL certificates – installation configuration on FreeBSD.

Configuring my BIND/named DNS servers to operate from a hidden master via VPN for Let’s Encrypt.

Creating a TXT only nsupdate connection for Let’s Encrypt.

In previous blog posts, I’ve described various steps leading up to this:

In my quest for a centralized Let’s Encrypt solution, I’ve created the FreeBSD port for acme.sh (an ACME client for Let’s Encrypt) and anvil, a tool for distributing and installing those certificates. Now that I have configured my webserver to pull down any new certificates, now it’s time to configure my clients to pull certificates from the webserver.

ANVIL instal the new