Use PHP library, instead of Python

[Wouter0100]

This plugin is fully writen in PHP, as I see. Isn't it better to use a PHP library, like this one? On this way you should be able to better implement it in the plugin.

I'd love to help, so I'll contribute some code in the next few days when I have time. Maybe, If you guys agree, with this PHP library (or any other).

[Wouter0100]

I saw your message, but I think you removed it? This library was just an example, which was linked in a wiki of Let's Encrypted. If you'd like, we could chat oustside Github, so I would be able to contribute even better? This plugin could become so awesome. 😄

As your name suggests, it seems like your from The Netherlands? 👍

[Wouter0100]

And with Python, I mean this line, which executes a command in there Python client. Oh, and the last 3 lines of that file.

[zenire]

That's right, made a mistake in my comment ;). I already messaged you on the DirectAdmin forums.

I am from the Netherlands, indeed!

[Wouter0100]

Yeah, I saw. Awesome.

Some other libraries we could use, instead of the one given above:
https://github.com/kelunik/acme (downsite, it requires PHP 7, but it's a fairly easy library)
https://github.com/octopuce/acmephpc

[zenire]

I agree with you to use a library. Which one shall we choose?

I do not think we should start with https://github.com/kelunik/acme because of PHP 7 requirement. A lot of servers are not ready for PHP 7 or hosters need time to announce the PHP 7 upgrade.

[Wouter0100]

The only option should be that one of octopuce, which is compatible with PHP 5.3.9 and up (according to his composer.json). Also, the examples seems really straight-forward.

[Wouter0100]

When you agree, I'll start implementing it in the current available action tomorrow, and start working on some new ones 👍

[zenire]

That's fine, I agree! Thank you for your help with this project.

[Wouter0100]

Hmm, I've been trying to implement the library so we're able to use it, but I'm don't think thats gonna work. The client seems far from finished yet and contains a lot, and I mean a lot, of bugs. I didn't get it to work..

Tomorrow I will write a small library which can handle the requests (and creation of CSR and so on) we need to make to Lets Encrypt.

[zenire]

That's fine. It is better to write our own library/another one instead of using a buggy one. Thank you for your time.

[AramVK]

Progress is made very fast guys, looking good. The backport to 5.5 seems logical as that's the oldest supported version. They drop support very fast these days I must say.

I saw at the commit from just now 78801af that the API is being used to store the certificate, are API keys or login configuration needed for that?

I suppose it's a solid method instead of putting the certificates in the files themselves; as you might don't want to mess around with DA generated files. On the other hand if you need extra configuration that's a downside as well.

[Wouter0100]

I've backported that library because it was the best one available yet, with all features we need available.

See these lines of code for that, this class is created by DirectAdmin itself. Works great without custom configuration 👍.

Hmm, after some looking at the code I don't think this will work when you're signed in as the user itself, I was signed in through admin. Let me check and fix 😄

[Wouter0100]

Hmm, not sure why that works, but it does. When I directly login to a user (so no admin user is available/set or anything) the request with username "admin" works properly. I think DirectAdmin completely ignores that.. When I pass the username of the logged in user to the request, it won't work. Whut DirectAdmin.

[sjerdo]

@Wouter0100 The highlighted code you linked to just checks if any username is set without a password. If so, it uses the current DA session to authenticate. This method will work fine if the user has access to /CMD_API_SSL

[Wouter0100]

@sjerdo Ah, okay. That will be anough for that action. We need to display an error when the user doesn't have access to SSL certificates when he opens the index.html, and maybe hide the link in DirectAdmin's index, maybe?

[AramVK]

That's nice. I've installed the plugin and after submitting the form under a user it gives me a blank page. Is there some error log I can check? Or is that simply not working yet. I'd like to help test it.

[Wouter0100]

Hmm, requesting SSL certificates should work to the staging server of Let's Encrypt. I've added some error catchers to the code in a207a36. Could you try again? It shouldn't be white.. (white normally means a PHP exception or something)

Also added a logs directory where PHP should log errors.

[AramVK]

Yes I think it's a PHP error, but I'm not sure if they are logged; I've looked in /var/log/directadmin but didn't find anything.

I've updated and tried again but the blank page still shows up.

[Wouter0100]

It isn't logged there, can you take a look in /usr/local/directadmin/plugins/da-letsencrypt/logs?

[AramVK]

I just reinstalled it to be sure, a few things for installation:

• PLUGINPATH needs to be da-letsencrypt if you install it with git clone, since it's with a dash - not underscore.
• chmod / chown is not really going well for all directories, also if you want to install it in DA interface, I think the composer output makes it think it failed

But, we do have an error now in the log dir

[09-Dec-2015 16:40:17 Europe/Amsterdam] PHP Parse error: syntax error, unexpected 'function' (T_FUNCTION), expecting identifier (T_STRING) or \ (T_NS_SEPARATOR) in /usr/local/directadmin/plugins/da-letsencrypt/vendor/wouter0100/acme/lib/AcmeService.php on line 8

[Wouter0100]

Which PHP version do you run? It has to do with the use function, which isn't recognized.

[AramVK]

/usr/local/bin/php -v
PHP 5.5.30 (cli) (built: Oct 17 2015 22:16:42)
Copyright (c) 1997-2015 The PHP Group
Zend Engine v2.5.0, Copyright (c) 1998-2015 Zend Technologies
with the ionCube PHP Loader (enabled) + Intrusion Protection from ioncube24.com (unconfigured) v5.0.17, Copyright (c) 2002-2015, by ionCube Ltd.
with Zend Guard Loader v3.3, Copyright (c) 1998-2014, by Zend Technologies

I think that might be a 5.6 feature.

[Wouter0100]

Yeah, I guess so. I'll fix that.

[Wouter0100]

@AramVK could you please try now? It should be fixed.

[AramVK]

Now it works. But the next error shows up:

Couldn't use private key

I think it's because is gets private.txt public.txt but the files are .key if I understand correctly.

Also the .key files show up in /home/user/.letsencrypt/ instead of /home/user/domains/domain.tld/.letsencrypt/

[Wouter0100]

That's correct, every user does also have keys. Let's Encrypt requires you to "register" your public key with an e-mailadres. Under this user you're able to create "certificates". Let me take a look whats going on.

[Wouter0100]

Ah, I didn't create the script yet to create a public/private key for domains, only for users. I've implemented this in c0973d4.

[AramVK]

Alright now it works, however it's a certificate from 'happy hacker fake CA'. You need to specify a server I read about that.

[Wouter0100]

Correct, it's currently on the staging server. You should be able to update the server in user/actions/request.html on line 48 and 66 to https://acme-v01.api.letsencrypt.org/directory. I'll add a configurable option for this soon.

[AramVK]

Yep that works fine! Had to delete the user keys I think as thats separated.

Also I think it should probably remove the .well-known dir.

Good that the basics are really working now.

[Wouter0100]

I've create issues for the found problems. I think the final conclusion of this issue is: we're gonna use a PHP library, instead of a Python one 👍

[barryvdh]

There is also a .sh script, not sure if that's easier then Python?
https://github.com/lukas2511/letsencrypt.sh

[Wouter0100]

It's not because Python is hard, but PHP just implements better with PHP, instead of Shell, Bash or Python. And I've already successfully implemented the PHP library.

[barryvdh]

Okay, sorry I thought it was because of Python and other dependencies. But if it's already fully working, that's great :)

[zenire]

I agree with @Wouter0100 . It is a good suggestion and an easy solution to use the .sh script, but what Wouter says, it is better to use a standard and one language.

Thank you for your suggestion and don't say sorry! We love suggestions :). With an open mind and suggestions we can make the right choice.