diff --git a/How-to-run-on-OpenWRT.md b/How-to-run-on-OpenWRT.md index 2fb766e..264c89d 100644 --- a/How-to-run-on-OpenWRT.md +++ b/How-to-run-on-OpenWRT.md @@ -2,7 +2,11 @@ Setup and run acme.sh on your OpenWRT router and have https secured management. ### Step 1: Install packages -`opkg install luci-ssl-openssl curl ca-bundle` +`opkg install luci-ssl-openssl acme luci-app-acme` + +If you want to use DNS-based certificate verificiation, also install the DNS providers: + +`opkg install acme-dnsapi` ### Step 2: Configure Web Server Here we'll tell uhttpd redirect to https @@ -18,41 +22,7 @@ uci commit ### Step 3: Configure acme.sh and get your certificate On your router: -``` -curl https://raw.githubusercontent.com/Neilpang/acme.sh/master/acme.sh > acme.sh -chmod a+x "acme.sh" -./acme.sh --install -cd /root/.acme.sh -DOMAIN=my.router.net ## this domain must actually point to your router -iptables -I input_rule -p tcp --dport 443 -j ACCEPT -m comment --comment ACME -./acme.sh --issue -d $DOMAIN -w /www -iptables -D input_rule -p tcp --dport 443 -j ACCEPT -m comment --comment ACME -``` +Navigate to `Services -> ACME certs` in LUCI and configure your certificate details. Make sure to select 'Use for uhttpd', and 'Enabled' for your configured certificate. If you prefer to use the command line, simply edit `/etc/config/acme`, and run `/etc/init.d/acme start` afterwards. -Now if the certificate issue was successful we'll tell the web server to use our new certificate: - -``` -uci set uhttpd.main.key="$(pwd)/$DOMAIN/$DOMAIN.key" -uci set uhttpd.main.cert="$(pwd)/$DOMAIN/$DOMAIN.cer" -uci commit uhttpd -/etc/init.d/uhttpd restart -``` - - -~~### Step 4: Modify crontab (automatic renew)~~ - -~~Run `crontab -e` to edit your crontab (use something like `export EDITOR="/usr/bin/nano"` if vim isn't your style). Edit to:~~ - -~~`0 0 * * * "/root/.acme.sh"/acme.sh --cron --home "/root/.acme.sh" --pre-hook "iptables -I input_rule -p tcp --dport 443 -j ACCEPT -m comment --comment ACME" --post-hook "iptables -D input_rule -p tcp --dport 443 -j ACCEPT -m comment --comment ACME" --reloadcmd "/etc/init.d/uhttpd restart" >> /root/.acme.sh/log.txt 2>&1`~~ - - -### Step 5: Configure Firewall +### Step 4: Configure Firewall Open or Forward LUCI Port for external access. (use Webinterface) - - - -## Other stuff which may help you: -https://forum.openwrt.org/viewtopic.php?id=65090 - -https://gist.github.com/t413/3e616611299b22b17b08baa517d2d02c -