security/acme-client: Issue with /var RAM disk option

[daemongloom]

Current acme-client domain configuration folder (/var/etc/acme-client/home/) recreates after each reboot if /var RAM disk option is enabled at "System: Settings: Miscellaneous" thus making renewing letsencrypt certificate impossible.
Either location of acme-client folder should be changed or warning in letsencrypt plugin settings should be added.

[fichtner]

There's a third option: setting xxx_var_mfs="/var/etc/acme-client" in the rc.conf.d template

[labor4]

Thanks for finding this. I was lost.

[labor4]

How is this working:
This seems to be under the 19.1d tag.
Will this be available via patch earlier? Or will you include it in the maint updates?
thanks!

[fabianfrz]

The opnsense-patch utility can download any patch from GitHub so yes it can.

opnsense-patch -c plugins cd14eff 

[fichtner]

It'll be in 18.7.5 tomorrow.

[EugenMayer]

Actually having the same issue in 18.7.7

Mon Nov 19 12:29:41 CET 2018] ACME_DIRECTORY='https://acme-v01.api.letsencrypt.org/directory'
[Mon Nov 19 12:29:41 CET 2018] Use length 4096
[Mon Nov 19 12:29:41 CET 2018] Using RSA: 4096
[Mon Nov 19 12:29:54 CET 2018] The domain key is here: /var/etc/acme-client/home/XXXXXXX.key
[Mon Nov 19 12:29:54 CET 2018] Create domain key error.
[Mon Nov 19 12:29:54 CET 2018] pid
[Mon Nov 19 12:29:54 CET 2018] No need to restore nginx, skip.
[Mon Nov 19 12:29:54 CET 2018] _clearupdns
[Mon Nov 19 12:29:54 CET 2018] skip dns.
[Mon Nov 19 12:29:55 CET 2018] _on_issue_err
[Mon Nov 19 12:29:55 CET 2018] Please check log file for more details: /var/log/acme.sh.log
root@gateway:~ # tail -f /var/log/acme.sh.log
[Mon Nov 19 12:31:53 CET 2018] Use length 2048
[Mon Nov 19 12:31:53 CET 2018] Using RSA: 2048
[Mon Nov 19 12:31:54 CET 2018] The domain key is here: /var/etc/acme-client/home/XXXXXXX.key
[Mon Nov 19 12:31:54 CET 2018] Create domain key error.
[Mon Nov 19 12:31:54 CET 2018] pid
[Mon Nov 19 12:31:54 CET 2018] No need to restore nginx, skip.

[EugenMayer]

It might be somehow related to something we do in opnsense, maybe a different issue.
i had foo.mydomain.tld as CN and www.foo.mydomain.tld as a SAN .. and creating the key failed as seen above.

Removing the SAN 'fixed it'. Since this is for sure not LE / acme.sh limitation (this works on my other platforms without any issues) it might be some wrapper in opnsense.

If of interest, its Cloudflare + DNS-01, 18.7.7, acme.sh on 2.7.9