Ez-as-pie SSL certificate generation

Usage:

npx instacert key_path cert_path domains...
npx instacert key_path cert_path verify_method domains...

Verification methods:

• Default: Manual DNS verification, you'll be expected to add a temporary DNS record.
• http: Verify automatically over HTTP port 80
• cf:[api_token] - Automatic DNS verification with Cloudflare and API token
• cf:[email]:[api_key] - Automatic DNS verification with Cloudflare and Email + API key

Example: npx instacert ssl.key ssl.crt http example.com

Certificates are saved to the specified paths. The private key is generated if not present and reused if present. Certificates expire after 90 days.

Note: verification and issuance is subject to LetsEncrypt, notably:

• LetsEncrypt won't verify bare IP addresses (i.e you need an actual domain)
• LetsEncrypt does not perform Organization Validation (i.e no company name on padlock in browser)
• LetsEncrypt enforces a reasonable rate-limit: don't programmatically request hundreds of certificates
• LetsEncrypt won't issue certificates that last any longer than 90 days: this is by design, don't waste your time trying to avoid it.

Good practices

• Keep your certificates and keys in a common dot-directory (like ~/.keys)
• Use an automatic verification method when available (anything except default)
• Use DNS verification methods like cf:[api_token] over http
  • http requires binding to port 80 which requires sudo
  • http cannot verify wildcard domains (e.g, *.example.com)
• Renew your certificates every 80 days. Give yourself some buffer time.
  • If you renew automatically, renew every 89 days.
• Restart all servers that use the certificate. If available, have them watch for changes to the cert file and renew automatically.