Let's Encrypt

https://letsencrypt.org/docs
Admin
Let's Encrypt is a free, automated, and open certificate authority that provides digital...
Tokens:37,247
Snippets:432
Trust Score:10
Update:1 month ago
Show doc for...
Tokens:
Raw
### Example PEM-encoded certificate header

Source: https://letsencrypt.org/docs/a-warm-welcome-to-asn1-and-der

A snippet showing the beginning of a PEM-encoded certificate file.

```text
-----BEGIN CERTIFICATE-----

MIIFajCCBFKgAwIBAgISA6HJW9qjaoJoMn8iU8vTuiQ2MA0GCSqGSIb3DQEBCwUA
...
```

--------------------------------

### Define CPSuri as IA5String

Source: https://letsencrypt.org/docs/a-warm-welcome-to-asn1-and-der

An example of defining a field type using the ASN.1 module syntax.

```ASN.1
CPSuri ::= IA5String
```

--------------------------------

### Verify certificate prefix with xxd and base64

Source: https://letsencrypt.org/docs/a-warm-welcome-to-asn1-and-der

A command-line example demonstrating how the first bytes of a DER-encoded certificate result in the 'MII' prefix when base64 encoded.

```bash
xxd -r -p <<<308200 | base64
```

--------------------------------

### IMPLICIT UTF8String Encoding

Source: https://letsencrypt.org/docs/a-warm-welcome-to-asn1-and-der

An example of an ASN.1 encoding instruction using IMPLICIT and its resulting byte representation.

```ASN.1
[5] IMPLICIT UTF8String
```

```hex
85 02 68 69
```

--------------------------------

### BIT STRING encoding example

Source: https://letsencrypt.org/docs/a-warm-welcome-to-asn1-and-der

Encoding of the 18-bit string 011011100101110111, requiring three bytes with six unused bits.

```text
03 04 06 6e 5d c0
```

--------------------------------

### DER encoding of a 64-bit positive integer

Source: https://letsencrypt.org/docs/a-warm-welcome-to-asn1-and-der

Example of encoding the value 2^63+1 as a 9-byte DER encoded INTEGER.

```text
02 09 00 80 00 00 00 00 00 00 01
```

--------------------------------

### OCTET STRING encoding example

Source: https://letsencrypt.org/docs/a-warm-welcome-to-asn1-and-der

Encoding of an OCTET STRING containing the bytes 03, 02, 06, and A0.

```text
04 04 03 02 06 A0
```

--------------------------------

### EXPLICIT UTF8String Encoding

Source: https://letsencrypt.org/docs/a-warm-welcome-to-asn1-and-der

An example of an ASN.1 encoding instruction using EXPLICIT and its resulting byte representation.

```ASN.1
[5] EXPLICIT UTF8String
```

```hex
A5 04 0C 02 68 69
```

--------------------------------

### Rate limit error message format

Source: https://letsencrypt.org/docs/rate-limits

Example of the error message returned when a rate limit is exceeded, including the retry timestamp.

```text
too many new registrations (10) from this IP address in the last 3h0m0s,
retry after 1970-01-01 00:18:15 UTC.
```

--------------------------------

### GeneralName dNSName encoding

Source: https://letsencrypt.org/docs/a-warm-welcome-to-asn1-and-der

Encoding of a GeneralName containing the dNSName 'example.com'.

```text
82 0b 65 78 61 6d 70 6c 65 2e 63 6f 6d
```

--------------------------------

### Generate localhost certificate with OpenSSL

Source: https://letsencrypt.org/docs/certificates-for-localhost

Uses the openssl req command to create a private key and a self-signed certificate for localhost. The command includes specific configuration for subjectAltName and key usage to ensure compatibility.

```bash
openssl req -x509 -out localhost.crt -keyout localhost.key \
  -newkey rsa:2048 -nodes -sha256 \
  -subj '/CN=localhost' -extensions EXT -config <( \
   printf "[dn]\nCN=localhost\n[req]\ndistinguished_name = dn\n[EXT]\nsubjectAltName=DNS:localhost\nkeyUsage=digitalSignature\nextendedKeyUsage=serverAuth")
```

--------------------------------

### GeneralName CHOICE definition

Source: https://letsencrypt.org/docs/a-warm-welcome-to-asn1-and-der

An example of a CHOICE field from RFC 5280 using encoding instructions to distinguish between types.

```asn1
   GeneralName ::= CHOICE {
        otherName                       [0]     OtherName,
        rfc822Name                      [1]     IA5String,
        dNSName                         [2]     IA5String,
        x400Address                     [3]     ORAddress,
        directoryName                   [4]     Name,
        ediPartyName                    [5]     EDIPartyName,
        uniformResourceIdentifier       [6]     IA5String,
        iPAddress                       [7]     OCTET STRING,
        registeredID                    [8]     OBJECT IDENTIFIER }
```

--------------------------------

### Retrieve a PEM encoded certificate

Source: https://letsencrypt.org/docs/ct-logs

Fetches a certificate from a website to use for experimental CT log submission.

```bash
$ echo | \
openssl s_client \
    -connect "letsencrypt.org":443 \
    -servername "letsencrypt.org" \
    -verify_hostname "letsencrypt.org" 2>/dev/null | \
sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > example.crt
```

--------------------------------

### Enumerate included roots for a CT log

Source: https://letsencrypt.org/docs/ct-logs

Use this command to list the root certificates included in a specific CT log shard.

```bash
$ for i in $(curl -s https://oak.ct.letsencrypt.org/2020/ct/v1/get-roots | jq -r '.certificates[]'); do
    echo '------'; base64 -d <<< "${i}" | openssl x509 -inform der -noout -issuer -serial
done
```

--------------------------------

### TBSCertificate ASN.1 Definition

Source: https://letsencrypt.org/docs/a-warm-welcome-to-asn1-and-der

An example of a TBSCertificate structure from RFC 5280 demonstrating the use of EXPLICIT and IMPLICIT tagging.

```ASN.1
TBSCertificate  ::=  SEQUENCE  {
     version         [0]  Version DEFAULT v1,
     serialNumber         CertificateSerialNumber,
     signature            AlgorithmIdentifier,
     issuer               Name,
     validity             Validity,
     subject              Name,
     subjectPublicKeyInfo SubjectPublicKeyInfo,
     issuerUniqueID  [1]  IMPLICIT UniqueIdentifier OPTIONAL,
                          -- If present, version MUST be v2 or v3
     subjectUniqueID [2]  IMPLICIT UniqueIdentifier OPTIONAL,
                          -- If present, version MUST be v2 or v3
     extensions      [3]  Extensions OPTIONAL
                          -- If present, version MUST be v3 --  }
```

--------------------------------

### Simple Let's Encrypt CAA Record

Source: https://letsencrypt.org/docs/caa

A basic configuration allowing Let's Encrypt to issue certificates for example.org.

```text
example.org         CAA 0 issue "letsencrypt.org"
```

--------------------------------

### Complex CAA Record Set

Source: https://letsencrypt.org/docs/caa

An example demonstrating multiple CAA records, including validation method restrictions and account URI constraints.

```text
example.org         CAA 0 issue "myca.org;validationmethods=dns-01"
example.org         CAA 0 issuewild "myca.org"
example.org         CAA 128 issue "otherca.com;accounturi=https://otherca.com/acct/123456"
```

--------------------------------

### Revoke certificate with original account

Source: https://letsencrypt.org/docs/revoking

Use this command when you still have control of the account used to issue the certificate.

```bash
certbot revoke --cert-path /etc/letsencrypt/archive/${YOUR_DOMAIN}/cert1.pem
```

--------------------------------

### Define OIDs using human-readable names

Source: https://letsencrypt.org/docs/a-warm-welcome-to-asn1-and-der

Example of defining OIDs in ASN.1 using human-readable names and concatenation, as seen in RFC 8017.

```ASN.1
   pkcs-1    OBJECT IDENTIFIER ::= {
       iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) 1
   }
   ...

   sha256WithRSAEncryption      OBJECT IDENTIFIER ::= { pkcs-1 11 }
```

--------------------------------

### INTEGER encoding rules for BER and DER

Source: https://letsencrypt.org/docs/a-warm-welcome-to-asn1-and-der

Rules for ensuring integers are represented in the shortest form possible in BER and DER.

```text
... the bits of the first octet and bit 8 of the second octet:

1.  shall not all be ones; and
2.  shall not all be zero.
```

--------------------------------

### Define Point with context-specific tags

Source: https://letsencrypt.org/docs/a-warm-welcome-to-asn1-and-der

The standard approach for resolving ambiguity using context-specific tags represented by brackets.

```asn1
Point ::= SEQUENCE {
  x [0] INTEGER OPTIONAL,
  y [1] INTEGER OPTIONAL
}
```

--------------------------------

### Define Point with APPLICATION tags

Source: https://letsencrypt.org/docs/a-warm-welcome-to-asn1-and-der

An ASN.1 definition using APPLICATION class tags to resolve field ambiguity.

```asn1
Point ::= SEQUENCE {
  x [APPLICATION 0] INTEGER OPTIONAL,
  y [APPLICATION 1] INTEGER OPTIONAL
}
```

--------------------------------

### Revoke downloaded certificate

Source: https://letsencrypt.org/docs/revoking

After validating domain control and downloading the certificate, use this command to revoke it.

```bash
certbot revoke --cert-path /PATH/TO/downloaded-cert.pem
```
Tokens:
Raw