ACMEv2 beta (v0.2.1) now available

[hlandau]

ACMEv2 support has now been merged into master and a beta is available as release v0.2.1. You will need to build this yourself as release automation is being renovated.

This removes and replaces support for ACMEv1. Support for in-place upgrades using existing state directories (/var/lib/acme) is experimental; if you want to try this, just install the new binary and run it. Please make a backup of /var/lib/acme first. Or of course you can start with a fresh state directory.

The repository has moved to hlandau/acmetool from hlandau/acme. This should redirect automatically.

Please report issues on the issue tracker.

[holdenger]

@hlandau Hello, and a big thank you for this. When do you expect release of binaries?

[ewenmcneill]

For anyone else trying to build this from source to test it out, it looks like it'll require golang version 1.9 or higher for the math/bits dependency. So, eg, go version go1.7.4 linux/amd64 in Debian Stretch (9) is too old to build the package (at least automatically). Debian Buster (10) seems to have a new enough go version (go version go1.11.6 linux/amd64) , and that's been backported to Debian Stretch so that's what I ended up using to build (I still have some Debian Stretch systems I need acmetool to run on, and at least by default go builds dynamically linked binaries).

I think the resulting binary is correctly built to be acmetool with ACME API v2, but I've not yet been able to confirm that definitively (it does look like, eg, the right Go dependencies were downloaded; this is building from master which appears to be the latest branch; it looks like acmev2 and dev are behind master at this point, and that the v2 beta support has been merged into master.)

Ewen

vagrant@acmetool-stretch:~$ sudo /bin/sh -c 'echo deb http://deb.debian.org/debian stretch-backports main >/etc/apt/sources.list.d/debian-backports.list'
vagrant@acmetool-stretch:~$ sudo apt-get update
[...]
vagrant@acmetool-stretch:~$ LANG=C sudo apt-get -t stretch-backports install golang-1.11
[...]
vagrant@acmetool-stretch:~$ PATH="/usr/lib/go-1.11/bin:$PATH"
vagrant@acmetool-stretch:~$ go version
go version go1.11.5 linux/amd64
vagrant@acmetool-stretch:~$ echo $GOPATH
/home/vagrant/go
vagrant@acmetool-stretch:~$ cat /etc/debian_version 
9.11
vagrant@acmetool-stretch:~$ git clone https://github.com/hlandau/acmetool.git
Cloning into 'acmetool'...
remote: Enumerating objects: 2797, done.
remote: Total 2797 (delta 0), reused 0 (delta 0), pack-reused 2797
Receiving objects: 100% (2797/2797), 1.07 MiB | 326.00 KiB/s, done.
Resolving deltas: 100% (1736/1736), done.
vagrant@acmetool-stretch:~$ cd acmetool/
vagrant@acmetool-stretch:~/acmetool$ make
	[RELOCATE]	  
	[GO-GET]	  git.devever.net/hlandau/acmetool
	[DIRS]	  
	[DIRS]	  
	[GO-INSTALL]	  git.devever.net/hlandau/acmetool
vagrant@acmetool-stretch:~/acmetool$ sudo env "PATH=$PATH" make install
	[RELOCATE]	  
	[DIRS]	  
	[GO-INSTALL]	  git.devever.net/hlandau/acmetool
	[INSTALL]	  git.devever.net/hlandau/acmetool
vagrant@acmetool-stretch:~/acmetool$ which acmetool
/usr/local/bin/acmetool
vagrant@acmetool-stretch:~/acmetool$ acmetool --version
go version go1.11.5 linux/amd64 gc cgo=true
build unknown
vagrant@acmetool-stretch:~/acmetool$ file `which acmetool`
/usr/local/bin/acmetool: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 2.6.32, BuildID[sha1]=cc11c0004457975445ab3cc366b2bfc42d448229, not stripped
vagrant@acmetool-stretch:~/acmetool$ ldd `which acmetool`
	linux-vdso.so.1 (0x00007ffc6e7ee000)
	libcap.so.2 => /lib/x86_64-linux-gnu/libcap.so.2 (0x00007f3eda0a7000)
	libpthread.so.0 => /lib/x86_64-linux-gnu/libpthread.so.0 (0x00007f3ed9e8a000)
	libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f3ed9aeb000)
	/lib64/ld-linux-x86-64.so.2 (0x00007f3eda2ad000)
vagrant@acmetool-stretch:~/acmetool$ 

[SinOJosWeb]

What might the status be of v2. In June of 2020 we will stop allowing new domains to validate via ACMEv1 https://community.letsencrypt.org/t/end-of-life-plan-for-acmev1/88430

I have been using ACMEv1 and have had no problems. I like being able to use the redirector. I see that v1 is available via Centos 7 package manager, though I compiled my self. Is there any intentions of providing a v2 binary for Centos 7. Even though there is some time until June 2020. Every time a certificate is added or renewed LetsEncrypt sends me an email reminding me that v1 on June 1 2020 will no longer be allowed.

There has been no activity for a month now. Has the project been put on hold. Should I start looking for something else. There is a long list of v2 releases on the LetsEncrypt website. Everyone else has already moved on to v2. https://letsencrypt.org/docs/client-options/

[mnalis]

@SinOJosWeb ACMEv2 in acmetool seems to be working just fine. I recently compiled latest master branch on Debian Buster (by instructions above for Stretch, just simpler as no backports needed at all), and replaced acmetool binary provided by standard debian package with that. It works just fine.
I've also requested ACMEv2-only wildcard certs using DNS hook (homemade for our custom setup for tinydns) and it also works just fine.

So I would say what remains is @hlandau make a release (or at least a release candidate!) soon, so we can go ask package maintainters to make new package (it all takes time!)

[defanator]

Was anyone able to build v0.2.1 on Ubuntu 16.04? Solution from @ewenmcneill does not work unfortunately, libpcap-dev (libpcap0.8-dev actually) on Ubuntu 16.04 does not contain required header (sys/capability.h).

[mnalis]

@defanator Don't know about Ubuntu, but on Debian package is libcap-dev (that is one relating to POSIX 1003.1e capabilities) and not libpcap-dev (which is one about packet capturing for tcpdump and friends).

[defanator]

@mnalis oh sorry, my bad! libcap-dev is the right one there as well. Thank you!

[defanator]

@hlandau v0.2.1 seems to work fine. Hope to expect binaries soon!

[pipiche38]

Any plan to provide a rpm based version for Fedora users ?
like what we have for the acmetool on https://copr.fedorainfracloud.org/coprs/hlandau/acmetool/

[SinOJosWeb]

I had no trouble compiling on Amazon AWS Linux 2 AMI.
I already had v1 installed via the package manager yum and enabled via systemd running in redirector mode.

Installed:
yum install golang libcap-devel

cloned git repository:
git clone https://github.com/hlandau/acmetool.git

enter ~/acmetool directory run "make" wait for it to finish:
systemctl stop acmetool-redirector.service
mv /var/lib/acme ~/acme-v1
mv /bin/acmetool ~/acmetool-v1
cd ~/acmetool/bin
cp acmetool /bin
systemctl start acmetool-redirector.service
acmetool quickstart
acmetool want domainname.com

I run haproxy did not have to change any settings. Rebooted and it works. Now simply wait to renew time, and hopefully it will renew without any errors.

[tomwaldnz]

On Amazon Linux 1 I get this error when trying to build. I'll just wait for the binary.

git config --global http.followRedirects true
git clone https://github.com/hlandau/acme
make
        [RELOCATE]
        [GO-GET]          git.devever.net/hlandau/acmetool
# gopkg.in/hlandau/svcutils.v1/caps
src/gopkg.in/hlandau/svcutils.v1/caps/caps-linuxc.go:9:10: fatal error: sys/capability.h: No such file or directory
 #include <sys/capability.h>
          ^~~~~~~~~~~~~~~~~~
compilation terminated.
make: *** [.gotten] Error 2

[pipiche38]

seems same as hlandau/acme.t#1

[pipiche38]

I'm newbie on GO so probably I'm missing something:

Fedora 31
go version
go version go1.13.6 linux/amd64

 make
	[RELOCATE]
	[GO-GET]	  git.devever.net/hlandau/acmetool
# git.devever.net/hlandau/acmetool/storageops
src/git.devever.net/hlandau/acmetool/storageops/reconcile.go:76:49: cannot use cl (type *"github.com/hlandau/acmeapi".RealmClient) as type *"gopkg.in/hlandau/acmeapi.v2".RealmClient in argument to solver.AssistedRegistration
src/git.devever.net/hlandau/acmetool/storageops/reconcile.go:437:48: cannot use cl (type *"github.com/hlandau/acmeapi".RealmClient) as type *"gopkg.in/hlandau/acmeapi.v2".RealmClient in argument to solver.AssistedRegistration
src/git.devever.net/hlandau/acmetool/storageops/reconcile.go:456:41: cannot use cl (type *"github.com/hlandau/acmeapi".RealmClient) as type *"gopkg.in/hlandau/acmeapi.v2".RealmClient in argument to solver.Order
src/git.devever.net/hlandau/acmetool/storageops/reconcile.go:456:58: cannot use &orderTpl (type *"github.com/hlandau/acmeapi".Order) as type *"gopkg.in/hlandau/acmeapi.v2".Order in argument to solver.Order
src/git.devever.net/hlandau/acmetool/storageops/reconcile.go:461:37: not enough arguments in call to r.store.ImportCertificate
	have (string)
	want (*storage.Account, string)
make: *** [Makefile:76: .gotten] Error 2