I don't want a tool that I have to run as root and that is going to touch anything in /etc/nginx/.
I do want a tool using which I can do something like:
$ letsencrypt 'foo.bar.example.com'
which would spit out foo.bar.example.com.key, foo.bar.example.com.cert, and foo.bar.example.com.csr.
I'd also like to have:
$ letsencrypt --renew foo.bar.example.com
Which would re-generate all these certs. The main problem for me, just like for you, is that domain validation certs are not free (or at least somehow included in the price of the domain registration). This type of tool solves that.
If, on top of this tool, we also get something that lets a person new to ops autogenerate or even autodeploy an nginx vhost with TLS/SPDY support, awesome! But the ability to generate and renew certs from the command line, for free, is what I want and probably what you want too.
I totally agree. You would however need to somehow authenticate that you own foo.bar.example.com (code in email, host something under foo.bar.example.com, a TXT record, etc.).
The tool doesn't care about your ownership of the domain, it cares about whether the host it's running on is trusted by the owner of the domain. The simplest way to verify that is for the CA to tell the tool "serve up this nonce value at this randomly-generated URL", and then to request that URL and see if it gets the right value.
Depending on exactly what proof the CA wants, that will probably require some kind of tinkering with the webserver's config, or at least inspecting it to figure out how to fulfil the CA's request.
Hopefully there'll be a fallback mechanism that tells the sysad what to configure, if only because not every webserver in the world is Apache or nginx.
They were never going to for free - the ones that do sell certs make huge amounts of money off them. That's why LetsEncrypt exists - to push the market value of a trusted X.509 certificate close to 0.
I do want a tool using which I can do something like:
which would spit out foo.bar.example.com.key, foo.bar.example.com.cert, and foo.bar.example.com.csr.I'd also like to have:
Which would re-generate all these certs. The main problem for me, just like for you, is that domain validation certs are not free (or at least somehow included in the price of the domain registration). This type of tool solves that.If, on top of this tool, we also get something that lets a person new to ops autogenerate or even autodeploy an nginx vhost with TLS/SPDY support, awesome! But the ability to generate and renew certs from the command line, for free, is what I want and probably what you want too.