Let's Encrypt certificates

Tools gives you access to the latest certificate bundles assigned to your account.

View your certificates

Open:

/letsencrypt

The page shows information such as:

the certificate's main name,
all included domains,
expiry date,
expected renewal date,
latest upload,
current status.

If a certificate is missing, an administrator needs to confirm that it has been imported and assigned to the correct owner.

Download the latest certificate

Use the download button for the certificate.

The ZIP bundle can contain:

cert.pem
chain.pem
fullchain.pem
privkey.pem
metadata.json

The bundle contains private key material. Store it securely and never place it in a public directory or public Git repository.

Automated download

For automated downloads you need:

the certificate UUID,
a fetch token,
the Tools base URL.

Create or rotate the token from the certificate view. The plaintext token is displayed only when it is created, so save it immediately in a secure location.

The endpoint format is:

https://tools.tornevall.net/api/letsencrypt/certificates/CERTIFICATE_UUID/latest

Send the token as a Bearer token.

curl --fail --location \
  --header "Authorization: Bearer CERTIFICATE_TOKEN" \
  "https://tools.tornevall.net/api/letsencrypt/certificates/CERTIFICATE_UUID/latest" \
  --output certificate-latest.zip

Shell sample

A ready-to-use sample is available at:

bin/letsencrypt/examples/fetch-latest-certificate.sh

Run it with:

chmod 750 bin/letsencrypt/examples/fetch-latest-certificate.sh

bin/letsencrypt/examples/fetch-latest-certificate.sh \
  "https://tools.tornevall.net" \
  "CERTIFICATE_UUID" \
  "CERTIFICATE_TOKEN" \
  "/etc/ssl/private/example-latest.zip"

Windows batch sample

The Windows sample is available at:

bin/letsencrypt/examples/fetch-latest-certificate.bat

Run it from Command Prompt:

bin\letsencrypt\examples\fetch-latest-certificate.bat ^
  "https://tools.tornevall.net" ^
  "CERTIFICATE_UUID" ^
  "CERTIFICATE_TOKEN" ^
  "C:\certificates\example-latest.zip"

The sample uses curl.exe, which is normally included with current Windows versions.

When the certificate is renewed

After a new certificate is published, it becomes the latest version in Tools. The same UUID and fetch token can continue to be used to retrieve the current certificate bundle.

If the download fails

Check that:

the certificate is still enabled,
the UUID is correct,
the token has not been rotated,
the token is sent as a Bearer token,
the destination directory is writable,
the Tools site is reachable from the downloading machine.

An HTTP 401 normally means that the token is missing or incorrect. A 404 normally means that the certificate does not exist, is disabled, or the UUID is incorrect.

For administrators

Administrators use:

/admin/letsencrypt

There they can assign owners, enable or disable certificates, and create new fetch tokens.

Tornevall Networks