All my life, every time I opened the web configuration page of a device, I usually received a warning saying the certificate was not safe. I always ignored it, because I knew the device.
So sometimes (probably every time) when I get stuck with a hard or unpleasant task, I double down on an even more mysterious and complicated one just to avoid doing my actual obligation. I don’t know (but I guess) what the hell is wrong with me.
That’s why I started working on this infrastructure, to procrastinate more important things.
The first thing I did was check if there were any packages on pfSense that could issue certificates automatically. There are — the ACME package.
After configuring the ACME package, I realized that every three months I would probably have a problem, because either I would forget how to do it or I would simply forget to do it. So it was better to build a more reliable setup that could survive over time.
But that wasn’t my priority yet. The first thing I needed to do was send the new certificates to the WAPs as soon as they were issued. Luckily, the ACME package already has a trigger functionality for this.
With that in mind, I just needed a script to send the new certificate to the right place. That part wasn’t hard — it was just a script using scp. The hard part was figuring out the correct location where the certificate files needed to go.
Once the script was ready, I could already see the next step. In order to securely send the certificates without human intervention, I needed SSH keys so the firewall could communicate with the WAPs.
So here we go again, trying to figure out where the keys should be stored. The usual place (~/.ssh/known_hosts) was being ignored.
It turns out OpenWrt does not use OpenSSH — it uses Dropbear, which relies on a different file for key configuration.
Now I know it, and now you do too. But until I figured that out, I spent a little bit of time debugging.
Once the script and the keys were working, I ran a final test by issuing a new certificate.
And voilà — immediately all the WAPs received the new certificate.
Everything was ready. Time to deploy my certificates.
Yeeeaah… not quite.
There was one last piece missing from this puzzle.
The ACME package only supports a limited number of DNS providers, and unfortunately my DNS provider was not on that list.
I have to confess something: I’m a lazy person. The idea of migrating my DNS to another service didn’t make me happy at all.
So I pushed that problem to another day.
Eventually, though, I had to deal with it, and I ended up migrating everything to Cloudflare.
Luckily, that part was very easy. Cloudflare imported all the DNS entries from my previous provider, and after that the only thing I had to do was update the nameservers at the registrar.
And finally everything started working the way it should.
Now that you know the whole journey, I’ll explain in detail how to configure everything in another post, which I will link here someday. Sometime. Believe me — I will.