Posh-ACME VS dehydrated

Yes. It’s just text, right? So as long as the process you’re using to copy the contents into the string variable isn’t accidentally adding or removing white space (including line breaks), it should just be a matter of matching the output encoding and line endings. If the source file has Unix line endings, you may need to drop into .NET in order to output your string variable to the file. There’s an example you can use at the end of this file.

Dropped it for Posh-ACME https://github.com/rmbolger/Posh-ACME

Also wanted to plug my cert related modules Posh-ACME and Posh-ACME.Deploy for getting and deploying free certs from Let's Encrypt or other ACME-based cert authorities. Though my modules typically require at least PS 5.1 and .NET 4.7.1.

while it does indeed work well and i did some tests with it in my home env things like https://github.com/rmbolger/Posh-ACME/issues/333 happening don't really help putting trust in the reliability of that unfortunately.

Setup a KeyVault and Managed Identity, which you can integrate with DigiCert natively. If you'd rather use Let's Encrypt, keyvault-acmebot does work well. Certify and win-acme have KeyVault plugins, just run the software on a VM somewhere and update KeyVault. You can also use Posh-ACME and the Azure Az PowerShell module to roll your own. You could also do it on a Linux/BSD OS with various ACME implementations and the Azure CLI.

Posh-ACME can help with obtaining a free cert from a public CA. I know nothing about Dynamics365 though. So I'll have to defer to others on being able to deploy the cert to it.

From this commit:

https://github.com/dehydrated-io/dehydrated/commit/b116e6bc2...

I've had a lot of success with https://github.com/dehydrated-io/dehydrated . It exposes the different parts of the process (deploy challenge to DNS, deploy cert to filesystem, etc) as hooks, so it's pretty easy to integrate with anything and however you want, if you don't mind writing a bit of bash. There's a few scripts out there that use Cloudflare that you can use as well.

Depend on host's capability... - lego - dehydrated - caddy - in case it already works as a web server, it will automatically issue and renew certs

Take a look at this great project : https://github.com/dehydrated-io/dehydrated/wiki : many dns providers are documented.

> Oh, and that 500-line shell script probably ends up being a 5000-line Python monster anyway.

The dehydrated ACME client is 2400 lines of bash/zsh:

* https://github.com/dehydrated-io/dehydrated

And its external dependencies are OpenSSL and cURL. The acme.sh shell ACME client is 8000 lines of shell:

* https://github.com/acmesh-official/acme.sh

The official Let's Encrypt client is written in Python, and the core 'executable' is much longer, and in addition it pulls in a boatload of dependencies:

* https://packages.debian.org/bullseye/python3-certbot

Dehydrated.io, damn few dependencies.

You're welcome.

https://github.com/dehydrated-io/dehydrated

I prefer dehydrated as an ACME client because it's written in bash and the only dependencies are sed, awk, grep, and openssl. This will also leave you free to customize your nginx config as necessary without having to try to cram your needs into a generator that doesn't account for what you're trying to do. It seems odd to me that the generator would create the intermediary file (as per your quoted output above), but then not put that in the nginx config.

This project has helped us immensely with cert renewals - https://github.com/dehydrated-io/dehydrated