I am trying to attach let's encrypt certificate to my softether vpn server, But didn't found a way for it. Can we use CA signed certificate like let's encrypt in vpn server ? If yes, then please provide the process.
The main challenge in using Let's Encrypt certificates with a VPN server is that their validity period is really short, only 3 months. This means there are some prerequisites:
- You must be able to automate loading of the certificate and the private key once the Certbot has renewed them. Luckily, Softether has a Command Line Management Utility. You should be familiar at least with 6.2 General Usage of
vpncmdin order to understand the steps 1 and 3 in this answer.
- The VPN server needs to be publicly accessible on HTTP port 80 for the HTTP-01 challenge. Also, the Softether VPN server hasn't builtin HTTP-01 challenge, so it requires an external Certbot.
You should add Let's Encrypt as trusted CA for the VPN clients.
Install and configure Certbot: instructions based on your web server and system.
Create a script / task / cronjob that periodically updates the certificate and the key.
Certbot renews all certificates that will expire in a month. Therefore, there's up to month before a the old certificate expires, but you in order to minimize the chances for this to fail, I'd recommend running this script at least once a week.
The command, from 6.3.20 "ServerCertSet": Set SSL Certificate and Private Key of VPN Server, is:
ServerCertSet [/LOADCERT:cert] [/LOADKEY:key]
/LOADCERTSpecify the X.509 format certificate file to use.
/LOADKEYSpecify the Base 64 encoded private key file for the certificate to use.
For example with Debian Linux, the command might be:
vpncmd /server localhost /password:password /adminhub:DEFAULT /cmd ServerCertSet \ /LOADCERT:/etc/letsencrypt/live/vpn.example.com/cert.pem \ /LOADKEY:/etc/letsencrypt/live/vpn.example.com/privkey.pem