tls-alpn-01 key and certificate permissions too strict #488

New Issue

adam · 2025-12-29T01:26:07+01:00

adam commented

2025-12-29 01:26:07 +01:00

Originally created by @georgefx on GitHub (Aug 15, 2020).

Running dehydrated on FreeBSD 12.1-p8.

dehydrated-0.6.5 installed via pkg. dehydrated is running as user and group letsencrypt.

I have www as a member of group letsencrypt

# pw groupshow letsencrypt
letsencrypt:*:1002:www

In generate_alpn_certificate() openssl generates key and cert file with mode 600 (o=rw), thus www cannot read the tls-alpn-01 key and certificate (maybe this is specific to FreeBSD?). www cannot read the files and the challenge fails.

My naive fix is to add a chmod g+r in generate_alpn_certificate(). Not sure if this is generally appropriate though.

Note:
Since sudo is not available I'm running dehydrated as su -m letsencrypt -c "dehydrated -c -x". As far as I can tell from the code, dehydrated basically achieves the same effect using sudo, so this should not change anything. Maybe using su would generally be more portable?

Originally created by @georgefx on GitHub (Aug 15, 2020). Running dehydrated on **FreeBSD 12.1-p8**. **dehydrated-0.6.5** installed via pkg. dehydrated is running as user and group letsencrypt. I have www as a member of group letsencrypt # pw groupshow letsencrypt letsencrypt:*:1002:www In `generate_alpn_certificate()` openssl generates key and cert file with mode 600 (o=rw), thus www cannot read the tls-alpn-01 key and certificate (maybe this is specific to FreeBSD?). www cannot read the files and the challenge fails. My naive fix is to add a `chmod g+r` in `generate_alpn_certificate()`. Not sure if this is generally appropriate though. *Note:* Since sudo is not available I'm running dehydrated as `su -m letsencrypt -c "dehydrated -c -x"`. As far as I can tell from the code, dehydrated basically achieves the same effect using sudo, so this should not change anything. Maybe using su would generally be more portable?

adam closed this issue

2025-12-29 01:26:08 +01:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/dehydrated#488