LetsEncrypt plugin#

• • • 
      

About : DST Root CA X3 Expiration (September 2021) See oficial description : https://letsencrypt.org/docs/dst-root-ca-x3-expiration-september-2021/
If you have a certificate issued by CrushFTP Let's Encrypt plugin and the root cert is still DST Root CA => Make sure that flags "Delete account key pair" and " Delete domain key pair" are checked and renew your certificate. After the renew the new root certificate will be: ISRG Root X1.

• • • 
      

About Let's Encrypt: It is a certificate authority that provides certificates (only domain-validated certificates) for free. (for more info : https://letsencrypt.org/how-it-works/)


LetsEncrypt plugin allows you to create a java key store file (the .JKS file) authorized by the Let's Encrypt certificate authority. You do not need to install, configure, or do anything with certbot if using this plugin.



Server Instance : To generate certificate for DMZ just specify the DMZ server instance name. The Let's encrypt server will test the given server instance. Leave it empty for normal case.

Challenge type : Only available on V02.
http-01-> It is an http based challenge it requires the CrushFTP to have an HTTP server item available from outside on port 80. Make you sure the https redirect is turned off. V01 can only do http based challenge.
tls_alpn-> (!!! Only works with Java 11+) It is a tls based challenge it requires the CrushFTP to have an HTTPS server item available from outside on port 443.

Domains : Multiple domains should be separated with a comma.

Keystore: Set the location of the jks file, and the name.

Staging flag: It is for test mode. If the is true it will only generate a dummy jks, not a valid one.

If the all fields are ready hit the submit, and the jks will be created in the specified key store location.

Once done, and full success, there is another step. On Preferences_>Encryption_>SSL page, will need to supply the same full path to the key store (.jks) file and the passwords you entered on the Letsencrypt plugin. The plugin only generates the key store, but doesn't apply it. Once done, test, if successful, save, then restart the HTTPS port or the CrushFTP service, to actually load the cert. Then can test with a browser.

Will need to click Submit and restart every 60-90 days , because the Let's encrypt cert is valid only for this long.

Update the certificate automatically: It updates the certificate automatically and restarts the https server item ports. Let's encrypt server allows 5-6 tries weekly, we suggest to set the check certificate weekly.
Alert: To get notification about failed updates create Plugin Message alert (Preferences -> Alerts).

Troubleshooting
#

0. Download replace plugin. Let's Encrypt often has change on the API. 1. Check that your server is reachable through the given domain with http protocol on the default port (80) or on https on the default port (443).
2. Check Staging flag, it is a test mode. Always try first in test mode. Check the Delete account key pair and Delete domain key pair flags and test again.
3. Rewrite the Keystore Password and Key Password, test it again.