tisba/fritz-tls

Automate TLS certificate installation for AVM FRITZ!Box

FRITZ!Box TLS Certificate Installer

This is a little pet project to install TLS certificates into your FRITZ!Box. I use Let’s Encrypt to get free certificates and I got tired using this tedious process to update the certs all the time. So I started to poke at my FRITZ!Box Fon WLAN 7390 and now it is automated!

Although it should work with other versions as well, it is only tested with:

• FRITZ!Box Fon WLAN 7530 (FRITZ!OS: 07.57)
• FRITZ!Box 7490 (FRITZ!OS: 07.57)

In case you want to know how to do that manually, take a look at AVM's knowledge base article.

Installation

Homebrew:

brew install tisba/taps/fritz-tls

Go

go get -u github.com/tisba/fritz-tls

Usage

fritz-tls --domain fritz.example.com

Done :)

General options for fritz-tls are:

• --help to get usage information
• --host (default: http://fritz.box) to specify how to talk to your FRITZ!Box. If you want to login with username and password, specify the user in the URL: --host http://[email protected]:8080.
• --insecure (optional) to skip TLS verification when talking to --host in case it's HTTPS and you currently have a broken or expired TLS certificate.
• --verification-url (optional) to specify what URL to use to check certificate installation. Defaults to --host.

fritz-tls can install any TLS certificate or acquire one using Let's Encrypt.

Let's Encrypt Mode

By default, Let's Encrypt is used to acquire a certificate, options are:

• --domain the domain you want to have your certificate generated for (if --host is not fritz.box, --domain it will default to the host name in --host).
• --email (optional) your mail address you want to have registered with Let’s Encrypt expiration service.
• --save (optional) to save generated private key and acquired certificate.
• --dns-provider (default manual) to specify one of lego's supported DNS providers. Note that you might have to set environment variables to configure your provider, e.g. AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_REGION and AWS_HOSTED_ZONE_ID. I use name servers by AWS/Route53 and inwx, so I have to provide INWX_USERNAME, INWX_PASSWORD. I'm not sure if there is a overview, so for now you have to consult the source.
• --dns-resolver (optional) to specify the resolver to be used for recursive DNS queries. If not provided, the system default will be used. Supported format is host:port.
• --force-renew to force a renewal, even if the current certificate is valid for the requested domain and still valid for at least the next 30 days.

Manual Certificate Installation

You can also provide a certificate bundle (cert + private key) directly to fritz-tls so they can be installed:

1. obtain your TLS certificate, e.g. via Let’s Encrypt.
2. install the newly generated certificate:

fritz-tls --key=./certbot/live/demo.example.com/privkey.pem --fullchain=./certbot/live/demo.example.com/fullchain.pem

• --key and --fullchain to provide the private key and the certificate chain.
• --bundle as an alternative for --key and --fullchain. The bundle where the password-less private key and certificate are both present.

Renew Automation

You can use cron (on Linux) or launchd (on macOS) to run fritz-tls automatically. By default, it will check if the cert is still valid and only renew if the remaining validity is less then 30 days. Check out https://www.launchd.info to learn how launchd can be used or use https://launched.zerowidth.com to generate a plist file.

TODOs and Ideas

These are some things I'd like to to in the future:

• add validation for private keys and certificate before uploading (avoid trying to upload garbage)
• allow password protected private keys (when not provisioned by LE)

Make Release

Releases are done via Github Actions on push of a git tag. To make a release, run

git tag va.b.c
git push --tags

fritz-tls's Issues

Defaulting `--tls-port` from port in `--host` does not work for validation

$ fritz-tls --auto-cert --email [email protected] --host https://[email protected]:8443

Does seem to work, but tries to validate against https://[email protected]:443. Needs more validation.

fritz-tls reported unsuccessful upload but it was successful

fritz-tls output that the TLS certificate upload was not successful - but actually, it worked perfectly. Here's the output from the script:

2021/09/03 14:53:52 TLS certificate upload not successful, check response: <!DOCTYPE html>
<html>
<head>
<meta http-equiv=content-type content="text/html; charset=utf-8" />
<meta http-equiv="X-UA-Compatible" content="IE=edge" />
<meta name="format-detection" content="telephone=no" />
<meta http-equiv="x-rim-auto-match" content="none" />
<meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no, minimal-ui" />
<meta name="mobile-web-app-capable" content="yes" />
<meta name="apple-mobile-web-app-capable" content="yes" />
<meta name="apple-mobile-web-app-status-bar-style" content="black-translucent" />
<meta http-equiv="cleartype" content="on">
<link rel="shortcut icon" type="image/x-icon" href="/favicon.ico" />
<link rel="apple-touch-icon" href="/css/rd/logos/logo_fritzDiamond.png" />
<link rel="apple-touch-startup-image" href="/css/rd/logos/logo_fritzDiamond.png">
<link rel="stylesheet" type="text/css" href="/css/rd/singleside_old.css"/>
<title>FRITZ!Box</title>

<script type="text/javascript" src="/js/post_upload.js"></script>
</head>
<body>
<div id="main_page_all">
<header class="" name="" id="blueBarBox">
<div class="logoBox" name="" id=""></div>
<div class="blue_bar_titel" name="" id="blueBarTitel">FRITZ!Box</div>
<div class="logoBox fake" name="" id=""></div>
</header>
<div id="page_content_no_menu_box">

<div class="blue_bar_back">
<h2>FRITZ!Box</h2>
</div>
<div id="page_content" class="page_content">
<form method="POST" name="mainform" action="/index.lua">
<p>
Import of the SSL certificate was successful.
<br>
</p>
<input type="hidden" name="sid" value="<REMOVED>">
<input type="hidden" id="uiLP" name="lp" value="remoteHttps">
</form>
</div>
<script type="text/javascript">
postUpload.redirect();
</script>
<div class="clear_float"></div>
</div>
</div>
</div>
</body>
</html>

This is on a FritzBox 3490 and

$ ./fritz-tls -version
2021/09/03 16:01:19 fritz-tls 0.8.0 (2021-03-30T18:45:13Z, 8ae4cde1c43ed67971088e5326a75256d71e329c)

More info on LE auto renew

Hi, I don't understand how to handle cert renew automatically, is it possible with this CLI?

Add support for alternative DNS resolvers in lego

Hey there!
Thanks for putting this together!

There is an option in lego that allows for alternative DNS resolvers to be used. This option is not passed through fritz-tls - would it be possible to allow that?
The reason they allow it is to override the local system resolvers to solve the DNS challenge. This would be very helpful to avoid DNS TTL issues - I currently have to have the polling interval set to every couple of minutes, but wait up to 2 hours for propogation to take place.
If I could override the resolvers to point directly to my DNS' providers namesevers, it would speed up the process considerably.

It's referenced in the lego repo here:
https://github.com/go-acme/lego/blob/83c626d9a1889fa499bc9c97bc2fdea965307002/cmd/flags.go#L97-L99

I'm a little confused also because I used https://github.com/kchristensen/udm-le to automate the certificate generation (also uses lego in the backend) for another device, and for some reason lego automatically decided to go to my authoratative nameservers directly to resolve the record. So I'm not 100% sure why that behaviour wasn't matched here - it used my system resolvers instead.
There's references to that in the code hre: https://github.com/go-acme/lego/blob/83c626d9a1889fa499bc9c97bc2fdea965307002/challenge/dns01/precheck.go#L70
https://github.com/go-acme/lego/blob/83c626d9a1889fa499bc9c97bc2fdea965307002/challenge/dns01/nameserver.go#L96-L97

Add launchd example to README

See #18

Running fritz-tls automatically on a schedule would be nice. For macOS that should be done with launchd and we can easily provide some examples. Maybe we can even use homebrew to set the launchd service up.