Title: Nginx and acme-client on OpenBSD
Author: Solène
Date: 04 July 2019
Tags: openbsd nginx automation
Description: 

I write this blog post as I spent too much time setting up nginx and
SSL on OpenBSD with acme-client, due to nginx being chrooted and not
stripping path and not doing it easily.

First, you need to set up **/etc/acme-client.conf** correctly. Here is
mine for the domain ports.perso.pw:

    authority letsencrypt {
            api url "https://acme-v02.api.letsencrypt.org/directory"
            account key "/etc/acme/letsencrypt-privkey.pem"
    }

            domain key "/etc/ssl/private/ports.key"
            domain full chain certificate
"/etc/ssl/ports.fullchain.pem"
            sign with letsencrypt
    }

**This example is for OpenBSD 6.6 (which is current when I write this)
because of Let's encrypt API URL. If you are running 6.5 or 6.4,
replace v02 by v01 in the api url**

Then, you have to configure nginx this way, the most important part in
the following configuration file is the location block handling
acme-challenge request. Remember that nginx is in chroot /var/www so
the path to acme directory is `acme`.


    http {
        include       mime.types;
        default_type  application/octet-stream;
        index         index.html index.htm;
        keepalive_timeout  65;
        server_tokens off;

            server unix:tmp/plackup.sock;
        }

          listen       80;
          server_name ports.perso.pw;

          error_log  logs/error.log info;


              rewrite ^/.well-known/acme-challenge/(.*) /$1 break;
              root /acme;
          } 

              return 301 https://$server_name$request_uri;
          }
        }

          listen 443 ssl;
          server_name ports.perso.pw;
          access_log logs/access.log;
          error_log logs_error.log info;
          root /htdocs/;

          ssl_certificate_key /etc/ssl/private/ports.key;
          ssl_protocols TLSv1.1 TLSv1.2;
          ssl_prefer_server_ciphers on;
          ssl_ciphers
"EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH";

          [... stuff removed ...]
        }



That's all! I wish I could have find that on the Internet so I share
it here.