02.08 – TLS Certificates (Let’s Encrypt + Cloudflare)

Since I want to use MQTT on my mesh, I needed a way to expose MQTT to the outside world, but in a secure way, so this is what I came up with. I'm sure there is a much more secure way to do this, but for now, its working. Something else I needed to do was move certs from one place to another so they could be used. I generated a hook script to copy the certs automagically for me. 

Install Certbot

apt install certbot python3-certbot-dns-cloudflare

Cloudflare Credentials

/root/.secrets/cloudflare.ini

dns_cloudflare_api_token=TOKEN_HERE

chmod 600 /root/.secrets/cloudflare.ini

Obtain Certificate

certbot certonly \
  --dns-cloudflare \
  --dns-cloudflare-credentials /root/.secrets/cloudflare.ini \
  -d mqtt.example.net

Cert Copy Hook

/etc/letsencrypt/renewal-hooks/deploy/mosquitto-copy.sh

#!/bin/bash
cp /etc/letsencrypt/live/mqtt.example.net/fullchain.pem /etc/mosquitto/certs/server.crt
cp /etc/letsencrypt/live/mqtt.example.net/privkey.pem /etc/mosquitto/certs/server.key
chown mosquitto:mosquitto /etc/mosquitto/certs/*
chmod 640 /etc/mosquitto/certs/server.key
systemctl restart mosquitto

chmod +x /etc/letsencrypt/renewal-hooks/deploy/mosquitto-copy.sh

Test MQTT

mosquitto_pub -h mqtt.example.net -p 8883 \
  --capath /etc/ssl/certs \
  -u skynet2mqtt -P password \
  -t test -m hello