Configurare certificat TLS cu Let's Encrypt

The tunnel is always encrypted. tls in [server.enc] chooses where the certificate comes from: acme, file, or self_signed. The installer leaves you on a self-signed certificate, which is the right default when the server has an IP and no domain.

Let's Encrypt (ACME)

Issuance is HTTP-01. The server listens on port 80 unless you set acme_challenge_port. The domain must resolve to this host. An IP address or localhost is not eligible; the server logs that and keeps a self-signed certificate.

[server.enc]
tls = "acme"
domain = "relay.example.com"
contact = "mailto:admin@example.com"
cache_dir = "/var/lib/hash-relay/certs"
frame_encrypt_alg = 0
# acme_challenge_port = 8080   # if something else owns port 80
# acme_staging = true          # test only; do not use in production

Renewal is automatic: the process checks often and renews when the remaining life is at most 30 days, or one third of the lifetime, whichever is shorter. A failed renewal keeps the still-valid certificate. Account state is stored as acme-account.json under the cache directory.

If port 80 is taken, set acme_challenge_port to a high port and reverse-proxy /.well-known/acme-challenge/ to it. The server.toml example shows Nginx and Caddy snippets for that.

Your own certificate

[server.enc]
tls = "file"
cert_path = "/etc/hash-relay/certs/fullchain.pem"
key_path = "/etc/hash-relay/certs/privkey.pem"

File certificates are re-read when the files change (Caddy or certbot renewals), with a short delay so the cert and key are not read mid-write. The hashrelay user must be able to read the files.

No domain

Keep tls = "self_signed". On first start the server logs pin_sha256. Put that value in the client's [client.enc] pin_sha256. insecure = true skips verification and is for a lab only.