On upgrading custom domain certificates (from Let's Encrypt) with Bluemix.

Blog.md

What?

Renewing HTTPS/SSL certificates, for a custom domain, on IBM Bluemix.

Case: edm00.se

Why?

90 day certificate lifecycle.

How?

asdf

Making It Easier

Being a forward-thinking developer, I recognized when I first implemented my HTTPS cert that when the renewal came around, I would need to fiddle around with the route and response value that Let's Encrypt is looking for; which seems to be generated at runtime of the letsencrypt/certbot script. Instead of hard coding the route and response values as strings, I instead opted to pull them from environment variables. This makes great sense, as Node works great with environment variables and Bluemix does a great job of making the user-defined environment variables easily maintaned through its web console.

Here's what my route definition for the Let's Encrypt query/response looks like:

app.get('/.well-known/acme-challenge/'+process.env.LETS_ENCRYPT_ROUTE,
        function(req, res){
      res.send(process.env.LETS_ENCRYPT_VERIFICATION);
    });

Refs

• https://xomino.com/2016/02/09/using-lets-encrypt-to-create-an-ssl-certificate-for-my-bluemix-hosted-web-site/

bluemix-wild-card-https-cert.png

Bluemix_All_Is_Good.png

certbot-script.sh

# lines broken apart for readability
./certbot-auto certonly \
  --manual \
  --email <my.email@some.com> \
  -d <my-domain-name> --agree-tos

CertBot_Challenge_and_Response.png

Chrome All Is Good.png

lets-encrypt-endpoint.js

app.get('/.well-known/acme-challenge/'+process.env.LETS_ENCRYPT_ROUTE,
    function(req, res){
  res.send(process.env.LETS_ENCRYPT_VERIFICATION);
});

Replacing_the_Certs.png

Timeout.png

User_Def_Env_Vars.png