# \[ANNOUNCE\] node-red-contrib-letsencrypt : beta version **URL:** \ **Category:** Share Your Nodes\ **Created:** [23 April 2020 22:41 UTC](https://discourse.nodered.org/t/announce-node-red-contrib-letsencrypt-beta-version/25386 "2020-04-23T22:41:24Z")\ **Posts on this page:** 20\ **Page:** 2

**Author:** ![afelix](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/afelix/32/9743_2.png) [@afelix](https://discourse.nodered.org/u/afelix)\ **Post date:** [5 May 2020 14:54 UTC](https://discourse.nodered.org/t/announce-node-red-contrib-letsencrypt-beta-version/25386/21 "2020-05-05T14:54:02Z")

I'm definitely pro generating the hash, but still think it has to be added to the file manually. I think Nick described the no-to-editing the settings file as the file is a javascript file, and has to properly validate. Since every user can make changes to that file themselves it's hard to properly add something in, especially when doing so from a node. Because a bracket in a wrong place can already mean it stops working, because it's now a syntax error. Same for a missing comma. > [@](#): > > The settings.js file is not well structured and any attempt to edit it programmatically could just as easily break it. > > This is because it's arbitrary JavaScript code, not a structured format like json. > > Plus nodes have no idea where the runtime settings have come from so wouldn't know what to edit. > > So whilst I'm very aware of the underlying issue (making it easier to edit settings), doing that as a node in a flow is not the right approach. The above was written by Nick in a lounge topic on the subject. ---

**Author:** ![BartButenaers](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/bartbutenaers/32/10476_2.png) [@BartButenaers](https://discourse.nodered.org/u/BartButenaers)\ **Post date:** [5 May 2020 14:58 UTC](https://discourse.nodered.org/t/announce-node-red-contrib-letsencrypt-beta-version/25386/22 "2020-05-05T14:58:05Z")

> [@afelix](#): > > Generating the hash sounds good, but having the node edit the settings file doesn't. Yes absolutely! Nick explained some time ago that some users put _ **custom startup Javascript** _ code in their files, so I'm not going to change or execute that. ---

**Author:** ![BartButenaers](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/bartbutenaers/32/10476_2.png) [@BartButenaers](https://discourse.nodered.org/u/BartButenaers)\ **Post date:** [5 May 2020 22:27 UTC](https://discourse.nodered.org/t/announce-node-red-contrib-letsencrypt-beta-version/25386/23 "2020-05-05T22:27:16Z")

Had not much time today, so the readme page is not updated yet. But I have added a _ **password field** _ on the config screen (in new version on Github). 1. Enter a password e.g. _my\_password_ 2. Hit the 'arrow' button and then the password hash will be calculated, and also the password strength (which will show a different color depending on Weak, Medium or Strong): 3. You need to copy manually this hash in your settings.js file: 4. Restart Node-RED 5. When navigating to Node-RED you will get a login screen. Pass your username (e.g. _"admin"_) and your password (e.g. _"my\_password"_): 6. Normally you should now be granted access to your Node-RED editor 🍾 🍸 🥳 Any thoughts? P.S. I'm not trying to push people to use port forwarding instead of a VPN, for those who might wonder! ---

**Author:** ![Jean-Luc](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/jean-luc/32/89996_2.png) [@Jean-Luc](https://discourse.nodered.org/u/Jean-Luc)\ **Post date:** [8 May 2020 08:44 UTC](https://discourse.nodered.org/t/announce-node-red-contrib-letsencrypt-beta-version/25386/24 "2020-05-08T08:44:54Z")

Hello, Bart. I'm going back to the access from outside your house. Now it's okay, https, certificates it's okay. But now i have to add a password request on the dashboard too, just like on the publisher. But it's good from the outside as much as it's annoying when I'm at home. There to have the Dashboard, I don't want NR to ask me for a password. Would it be possible to have the best of both worlds? Outside = password Inside = no password Is there a setting in NR that would say, if internal network (example 192.168.x.y) does not ask for the password. I don't want to talk about Trafeak, or Juniper, or Netscaler which is not for a "normal" user. Thanks for the ideas or solutions ---

**Author:** ![BartButenaers](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/bartbutenaers/32/10476_2.png) [@BartButenaers](https://discourse.nodered.org/u/BartButenaers)\ **Post date:** [8 May 2020 11:28 UTC](https://discourse.nodered.org/t/announce-node-red-contrib-letsencrypt-beta-version/25386/25 "2020-05-08T11:28:29Z")

> [@Jean-Luc](#): > > Would it be possible to have the best of both worlds? Jean-Luc, I'm not sure whether Node-RED supports that. Think it might be better to create a new discussion about that, to increase your chances to get a response... ---

**Author:** ![BartButenaers](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/bartbutenaers/32/10476_2.png) [@BartButenaers](https://discourse.nodered.org/u/BartButenaers)\ **Post date:** [17 May 2020 08:20 UTC](https://discourse.nodered.org/t/announce-node-red-contrib-letsencrypt-beta-version/25386/26 "2020-05-17T08:20:24Z")

Some changes on Github: - I have added a new [section](https://github.com/bartbutenaers/node-red-contrib-acme-client/blob/master/README.md#basic-authentication) on the readme page about how to generate a password hash with this node. - To renew a certificate you now need to inject a `msg.payload="request_certificate"` instead of a random message. - It is now also possible to inject a `msg.payload="get_certificate_info"` (as described in this [section](https://github.com/bartbutenaers/node-red-contrib-acme-client/blob/master/README.md#flow-certificate-information)) to _ **get information about the current certificate** _: So this node is becoming more a security toolbox (renewing certificates, inspect certificates, generate password hashes) 🍾 🍸 🥳 _ **But not sure anymore whether node-red-contrib-acme-client is the best name for this node, since it does more than acme ???** _ ---

**Author:** ![Jean-Luc](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/jean-luc/32/89996_2.png) [@Jean-Luc](https://discourse.nodered.org/u/Jean-Luc)\ **Post date:** [18 May 2020 09:07 UTC](https://discourse.nodered.org/t/announce-node-red-contrib-letsencrypt-beta-version/25386/27 "2020-05-18T09:07:41Z")

I didn't dare to say it, but indeed when we talked about HTTPS & Certificates it still spoke to me, but not the ACME protocol. I didn't know it at all. This node handles Certificates & Letsencrypt. So a name around that ? Like node-red-contrib-certificate-ask-renew-Letsencrypt? Well, maybe it's a little long for a name 🤔 The idea of tracking the dates of application and revocation **is great**. Indeed, with this information, we can send each other an email in a preventive and automatic way. Mmhhh, you still need to be able to code it 🙂 Sending emails is easy, subtracting 2 dates and scheduling the email is another story for me. To be continued... Bravo and thank you for these 2 Nodes (web-push) I use them now in "production". ---

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\ **Post date:** [18 May 2020 16:14 UTC](https://discourse.nodered.org/t/announce-node-red-contrib-letsencrypt-beta-version/25386/28 "2020-05-18T16:14:33Z")

> [@krambriw](#): > > Also, what ports should I open up and forward in my firewall? Is it enough with port 1880? > > If I have several NR's running on different computers, I assume I have to open & forward the port for each of them provided I set different ports for each (like 1880, 1881, 1882 etc)? Personally, I would recommend to use port forwarding to expose node-RED - I wouldn't use the default port on the Internet. I also recommend that for SSH as well. That's because automated bots check for common ports then try to attack them. Using a non-standard port greatly reduces those attempts. If you are looking to expose multiple instances, I would recommend the use of a reverse proxy instead. that way, you can assign port-based instances to virtual folders in your web site and you only need to expose port 443 (or choose something more obscure if you like). Of course, if your purpose is to expose Node-RED to the Internet using a Let's Encrypt certificate, I would strongly recommend using Caddy instead which has LE support built in. Then you don't need to put HTTPS onto Node-RED at all. Simples. ---

**Author:** ![BartButenaers](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/bartbutenaers/32/10476_2.png) [@BartButenaers](https://discourse.nodered.org/u/BartButenaers)\ **Post date:** [18 May 2020 20:58 UTC](https://discourse.nodered.org/t/announce-node-red-contrib-letsencrypt-beta-version/25386/29 "2020-05-18T20:58:31Z")

> [@Jean-Luc](#): > > Like node-red-contrib-certificate-ask-renew-Letsencrypt? Or _ **node-red-contrib-certificate** _ or _ **node-red-contrib-certificate-renewal** _??? > [@Jean-Luc](#): > > subtracting 2 dates and scheduling the email is another story for me. To be continued... There is now a new version on Github. The output message now contains a calculated field `expiresInDays` (which is negative when the certificate already has expired): ![image](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/3X/7/4/74826c5643a43c90d3a408ff08d270761dde8506.png) The following flow uses this field to renew the certificate two days before it expires, and triggers an alarm as soon as the certificate has expired: ![image](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/3X/d/0/d0422b6f03cdc3529e5dc87c177e84e14dedd110.png) ```auto [{"id":"70a6d890.f393b8","type":"inject","z":"11289790.c89848","name":"Get certificate info daily at 22:00","topic":"","payload":"get_certificate_info","payloadType":"str","repeat":"","crontab":"00 22 * * *","once":false,"onceDelay":0.1,"x":340,"y":480,"wires":[["92f9265b.fc36d8"]]},{"id":"92f9265b.fc36d8","type":"acme-client","z":"11289790.c89848","name":"Acme client","authority":"letsencrypt","dnsProvider":"duckdns","dnsToken":"your_duckdns_token","dnsUserName":"","dnsEmail":"","dnsApiUser":"","dnsKeyId":"","dnsKey":"","dnsSecret":"","domains":"[\"your_subdomain.duckdns.org\"]","domainsType":"json","certFilePath":"/home/pi/.node-red/cert.pem","keyFilePath":"/home/pi/.node-red/privkey.pem","privateKey":"existing","maintainerEmail":"your_email_address","subscriberEmail":"your_email_address","useTestUrl":false,"x":610,"y":480,"wires":[["d09e255e.fce988","f4ff75c9.781488"],["61a48ed.3a5637"]]},{"id":"d09e255e.fce988","type":"debug","z":"11289790.c89848","name":"Certificate info","active":true,"tosidebar":true,"console":false,"tostatus":false,"complete":"true","targetType":"full","x":820,"y":440,"wires":[]},{"id":"f4ff75c9.781488","type":"switch","z":"11289790.c89848","name":"Check expiresInDays","property":"payload.expiresInDays","propertyType":"msg","rules":[{"t":"lt","v":"0","vt":"num"},{"t":"eq","v":"2","vt":"num"}],"checkall":"true","repair":false,"outputs":2,"x":840,"y":480,"wires":[["d44416f6.d6b008"],["4f263587.3f983c"]],"outputLabels":["Expired!","Two days before"]},{"id":"d44416f6.d6b008","type":"debug","z":"11289790.c89848","name":"Alarm: Certificated is expired !!!","active":true,"tosidebar":true,"console":false,"tostatus":false,"complete":"true","targetType":"full","x":1110,"y":460,"wires":[]},{"id":"5241e044.c402e","type":"change","z":"11289790.c89848","name":"","rules":[{"t":"set","p":"payload","pt":"msg","to":"request_certificate","tot":"str"}],"action":"","property":"","from":"","to":"","reg":false,"x":400,"y":520,"wires":[["92f9265b.fc36d8"]]},{"id":"4bde2da9.5ad0f4","type":"link in","z":"11289790.c89848","name":"Renew certificate","links":["4f263587.3f983c"],"x":200,"y":520,"wires":[["5241e044.c402e"]],"l":true},{"id":"4f263587.3f983c","type":"link out","z":"11289790.c89848","name":"Two days before expiration","links":["4bde2da9.5ad0f4"],"x":1100,"y":520,"wires":[],"l":true},{"id":"61a48ed.3a5637","type":"debug","z":"11289790.c89848","name":"Problem detected","active":true,"tosidebar":true,"console":false,"tostatus":false,"complete":"true","targetType":"full","x":830,"y":520,"wires":[]}] ``` I quickly created this flow. Suggestions for improvement are welcome. ---

**Author:** ![Paul-Reed](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/paul-reed/32/66906_2.png) [@Paul-Reed](https://discourse.nodered.org/u/Paul-Reed)\ **Post date:** [18 May 2020 22:47 UTC](https://discourse.nodered.org/t/announce-node-red-contrib-letsencrypt-beta-version/25386/30 "2020-05-18T22:47:47Z")

> [@krambriw](#): > > Also, what ports should I open up and forward in my firewall? Is it enough with port 1880? I was going to ask the same question as @krambriw I don't know how you are validating the domain, but for example, one of Certbot's validation options is to spin up a webserver on Port 80, so Port 80 would need to be open to enable validation. Apart from the Port serving the service, are any other Ports required to be open? > [@BartButenaers](#): > > But not sure anymore whether node-red-contrib-acme-client is the best name for this node, since it does more than acme ??? `node-red-contrib-ssl` would mean much more to me than `node-red-contrib-acme-client`. Until your post, I've never heard of `acme-client`, so I certainly would not have searched for it. Just my opinion 😉 ---

**Author:** ![BartButenaers](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/bartbutenaers/32/10476_2.png) [@BartButenaers](https://discourse.nodered.org/u/BartButenaers)\ **Post date:** [19 May 2020 05:41 UTC](https://discourse.nodered.org/t/announce-node-red-contrib-letsencrypt-beta-version/25386/31 "2020-05-19T05:41:03Z")

> [@Paul-Reed](#): > > spin up a webserver on Port 80, so Port 80 would need to be open to enable validation. That is how I did it in my first version of this node. It is called a _ **http01 challenge** _: you get a little file from Letsencrypt, and you have to make that file avalaible on a specified path on a webserver. It needs to be on port 80 because you can only listen to port 80 as root user. Letsencrypt tries to read the file and compares it with its original file (that they have send to you). When it is ok they know you are the owner of the domain (specified in the certificate request), because they know you can logon as root user. However now I use the _ **dns01-challenge** _: you need to send a request to your dns provider (e.g. duckdns) to add an informational TXT record, containing some info you received from Letsencrypt. Letsencrypt calls your domzin and checks whether yor TXT record contains the required info. When it matches, they know you own the domain because you can logon to the dns provider to store the TXT record. So _ **NO** _ (temporary) webserver on port 80 required. You can even use this for internal servers that are not online accessible... > [@Paul-Reed](#): > > I certainly would not have searched for it. Yes I'm afraid users don't even have a look at this node. P.S. Is ssl as node name not a bit too wide? ---

**Author:** ![dceejay](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/dceejay/32/38_2.png) [@dceejay](https://discourse.nodered.org/u/dceejay)\ **Post date:** [19 May 2020 08:42 UTC](https://discourse.nodered.org/t/announce-node-red-contrib-letsencrypt-beta-version/25386/32 "2020-05-19T08:42:43Z")

> [@BartButenaers](#): > > P.S. Is ssl as node name not a bit too wide? Yes... unless you are willing to pick up the mantle of chief security officer. 🙂 ---

**Author:** ![Paul-Reed](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/paul-reed/32/66906_2.png) [@Paul-Reed](https://discourse.nodered.org/u/Paul-Reed)\ **Post date:** [19 May 2020 09:23 UTC](https://discourse.nodered.org/t/announce-node-red-contrib-letsencrypt-beta-version/25386/33 "2020-05-19T09:23:27Z")

> [@BartButenaers](#): > > Is ssl as node name not a bit too wide? Well it's only a matter of time before someone else creates an obscure contrib node with some weak remote relationship to 'ssl' and names it 'node-red-contrib-ssl' . I'd rather the 'top level' node name go to something worthy 😃 Just my opinion. ---

**Author:** ![BartButenaers](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/bartbutenaers/32/10476_2.png) [@BartButenaers](https://discourse.nodered.org/u/BartButenaers)\ **Post date:** [19 May 2020 10:07 UTC](https://discourse.nodered.org/t/announce-node-red-contrib-letsencrypt-beta-version/25386/34 "2020-05-19T10:07:00Z")

> [@dceejay](#): > > unless you are willing to pick up the mantle of chief security officer I tried to change my username to @TotallyInformation, but seems some guy named Julian already has reserved it. So unfortunately I cannot become the chief security officer... My apologies 😉 > [@Paul-Reed](#): > > Well it's only a matter of time Yes that is true. But perhaps something like _ **node-red-contrib-certificate-renewal** _ or _ **node-red-contrib-certificate** _ or something alike is better. But surely the acme-client name is not good for my download statistics ... P.S. I also regret that I hadn't called my node-red-contrib-xterm node instead node-red-contrib-terminal, because it is very unpopular (and I have spend LOTs of time in it ...) ---

**Author:** ![Steve-Mcl](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/steve-mcl/32/4826_2.png) [@Steve-Mcl](https://discourse.nodered.org/u/Steve-Mcl)\ **Post date:** [19 May 2020 10:16 UTC](https://discourse.nodered.org/t/announce-node-red-contrib-letsencrypt-beta-version/25386/35 "2020-05-19T10:16:23Z")

> [@BartButenaers](#): > > P.S. I also regret that I hadn't called my node-red-contrib-xterm node instead node-red-contrib-terminal, because it is very unpopular Oops ![image](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/3X/8/8/88cc9fb25103601ff44b5b8d8d494a8e4ecc06d9.png) So rename it & mark old one as depreciated, redirecting user to install the new node. (for both acme and xterm) they deserve to be more popular IMO 👍 ---

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\ **Post date:** [19 May 2020 13:18 UTC](https://discourse.nodered.org/t/announce-node-red-contrib-letsencrypt-beta-version/25386/36 "2020-05-19T13:18:40Z")

> [@BartButenaers](#): > > I tried to change my username to @TotallyInformation, but seems some guy named Julian already has reserved it. So unfortunately I cannot become the chief security officer... My apologies 🤣 🤣 🤣 > [@BartButenaers](#): > > But perhaps something like _ **node-red-contrib-certificate-renewal** _ or _ **node-red-contrib-certificate** _ or something alike is better How about `node-red-contrib-lets-encrypt` since that is the accurate name 😉 Certificate would also be too broad surely as someone else might well come up with a more generic process for managing certs. ---

**Author:** ![BartButenaers](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/bartbutenaers/32/10476_2.png) [@BartButenaers](https://discourse.nodered.org/u/BartButenaers)\ **Post date:** [19 May 2020 15:52 UTC](https://discourse.nodered.org/t/announce-node-red-contrib-letsencrypt-beta-version/25386/37 "2020-05-19T15:52:32Z")

> [@TotallyInformation](#): > > How about `node-red-contrib-lets-encrypt` since that is the accurate name That was the original name of the repositort. But I renamed because there can be other acme providers... But can live with it... > [@TotallyInformation](#): > > Certificate would also be too broad surely as someone else might well come up with a more generic process for managing certs. Yes was thinking the same last night. It is more z name for a sidebar panel for managing stores and keys and certificates... ---

**Author:** ![Paul-Reed](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/paul-reed/32/66906_2.png) [@Paul-Reed](https://discourse.nodered.org/u/Paul-Reed)\ **Post date:** [19 May 2020 22:36 UTC](https://discourse.nodered.org/t/announce-node-red-contrib-letsencrypt-beta-version/25386/38 "2020-05-19T22:36:37Z")

[ionos.co.uk](http://ionos.co.uk) are the largest hosting company in Europe and host 12 million domains, yet I don't see them in the DNS list. Are they not compatible with acme? ---

**Author:** ![BartButenaers](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/bartbutenaers/32/10476_2.png) [@BartButenaers](https://discourse.nodered.org/u/BartButenaers)\ **Post date:** [20 May 2020 05:45 UTC](https://discourse.nodered.org/t/announce-node-red-contrib-letsencrypt-beta-version/25386/39 "2020-05-20T05:45:43Z")

> [@Paul-Reed](#): > > don't see them in the DNS list Will need to add that to my readme page. The guys from the "root" group (who build this library) have added a [tutorial](https://git.rootprojects.org/root/acme-dns-01-test.js#user-content-the-easy-way-to-build-a-plugin) on how to build such a plugin. There is also a "_ **contact** _" link on the bottom of the page, but that doesn't seem to work. But haven't done it myself yet. Will do that once I'm retired 😉 ---

**Author:** ![afelix](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/afelix/32/9743_2.png) [@afelix](https://discourse.nodered.org/u/afelix)\ **Post date:** [20 May 2020 06:30 UTC](https://discourse.nodered.org/t/announce-node-red-contrib-letsencrypt-beta-version/25386/40 "2020-05-20T06:30:58Z")

Paul, based on what a quick google search showed they’re indeed not compatible as they don’t allow (through api ~~or otherwise I couldn’t find~~ ) TXT dns records. So you could do it manually set your A record, take web server down, issue challenge and bring it up again but things like wildcard certs will be hard or impossible. All the while asking customers to instead pay for their certificates that could be set up through LE/ACME instead. [https://github.com/go-acme/lego/issues/727](https://github.com/go-acme/lego/issues/727) See this issue [Previous page](https://discourse.nodered.org/t/announce-node-red-contrib-letsencrypt-beta-version/25386.md?page=1) [Next page](https://discourse.nodered.org/t/announce-node-red-contrib-letsencrypt-beta-version/25386.md?page=3)