Greenlock introduced a privacy-violating requirement for obtaining a Let’s Encrypt TLS certificate that goes above and beyond what is mandated by Let’s Encrypt. When you register for a Let’s Encrypt TLS certificate, you do not need to provide your email address. This is A Good Thing™. Greenlock makes the email address required. This fork removes this artificial requirement.

Usage

If you want a simple-to-use Small Tech personal web server that automatically provisions both locally-trusted TLS certificates using nodecert and globally-trusted ones using this module, see HTTPS Server

See the relevant method in HTTPS Server for an example of real-world usage.

Example

Here is an example based on HTTPS Server that sets up an Express server. The first time you hit it, TLS certificates will be automatically provisioned for you.

Prerequisites:

mkdir example && cd example
npm init --yes
npm i express redirect-https @ind.ie/acme-tls
touch index.js && $EDITOR index.js

If you’re on Linux, you will need to also run this (or the equivalent for your distribution if you don’t have the apt package manager) to bind to port 443 for TLS as we’re still engaged in mainframe-era privileged port security theatre on that platform:

sudo apt install libcap2-bin
setcap 'cap_net_bind_service=+ep' $(which node)

Code:

const os = require('os')
const Express = require('express')
const AcmeTLS = require('@ind.ie/acme-tls')
const redirectHTTPS = require('redirect-https')

// Obtain TLS certificates for the current host.
const hostname = os.hostname()

const acmeTLS = AcmeTLS.create({
  // Note: while testing, you might want to use the staging server at:
  // ===== https://acme-staging-v02.api.letsencrypt.org/directory
  server: 'https://acme-v02.api.letsencrypt.org/directory',

  version: 'draft-11',
  configDir: `~/.nodecert/${hostname}/`,
  approvedDomains: [hostname, `www.${hostname}`],
  agreeTos: true,
  telemetry: false,           // This will be removed shortly.
  communityMember: false      // This will be removed shortly.
})

// Create an HTTP server to handle redirects for the Let’s Encrypt
// ACME HTTP-01 challenge method.
const httpsRedirectionMiddleware = redirectHTTPS()

const httpServer = http.createServer(acmeTLS.middleware(httpsRedirectionMiddleware))
httpServer.listen(80, () => {
  console.log(' 👉 HTTP → HTTPS redirection active.')
})

// You can pass additional options to the server.
// (We don’t in this example.)
const options = {}

// Add the TLS options from ACME TLS Certificate to any existing
// options that might have been passed in.
Object.assign(options, acmeTLS.tlsOptions)

// Create an Express app.
const app = Express()

// Create a very simple index route.
app.get('/', (request, response) => {
  response.writeHeader(200, {'Content-Type': 'text/html'})
  response.end('<!doctype html><html lang=\'en\'><head><meta charset=\'utf-8\'/><title>Hello, world!</title><style>body{background-color: white; font-family: sans-serif;}</style></head><body><h1>Hello, world!</h1></body></html>')
})

// Create and return the HTTPS server.
const server = https.createServer(options, app)

// Serve the site on port 443.
server.listen(443, () => {
  console.log(' 🎉 Server running on port 443.')
})

License

All commits later than and including fccf48b are licensed under AGPLv3 or later. All commits before and including ff000c4 licensed under MPL 2.0.

Keywords

FAQs

What is @ind.ie/acme-tls?

Is @ind.ie/acme-tls popular?

Is @ind.ie/acme-tls well maintained?

Package last updated on 12 Mar 2019

Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Install