it would be great if, as part of the SSL integration, ikiwiki-hosting would call up on the [letsencrypt.org gods][] to install proper certs.

so far I have done this by hand:

2. install the letsencrypt client software:

   * if you are on Debian sid, stretch (or when [letsencrypt enters backports][]):

            apt install letsencrypt

   * otherwise, run the magic commands:

            git clone https://github.com/letsencrypt/letsencrypt
            cd letsencrypt
            ./letsencrypt-auto --server https://acme-v01.api.letsencrypt.org/directory --help

3. request a certificate:

        sudo -s
        source venv/bin/activate
        letsencrypt certonly --webroot \
          --server https://acme-v01.api.letsencrypt.org/directory \
          --agree-dev-preview --agree-tos \
          --webroot-path=/home/w-example/public_html/ \
          --domains example.com --email nobody@example.com

    ... notice how you need to change the two last lines for your
    environment.

4. this will create a certificate in
      `/etc/letsencrypt/live/example.com`. install it where ikiwiki
      expects it:

        ln -s /etc/letsencrypt/live/example.com/cert.pem /etc/ikiwiki-hosting/config/w-example/ssl.crt
        ln -s /etc/letsencrypt/live/example.com/fullchain.pem /etc/ikiwiki-hosting/config/w-example/ssl.chain
        ln -s /etc/letsencrypt/live/example.com/privkey.pem /etc/ikiwiki-hosting/config/w-example/ssl.key

5. regenerate the apache configs and restart apache:

        ikisite enable example.com
        service apache2 reload # or restart?

Ikiwiki hosting would need to perform steps 3 to 5, and probably have
a `Recommends` on letsencrypt. -- [[anarcat]]

Oh, and this could be a [plugin][], not sure if that would make sense, but it's the way it works on that side of the world.

Finally, note that there is now a fairly [large set of Let's Encrypt clients][]. For example, there is a [bash-only client][] that could work in Wheezy and a [much simpler implementation in Python][]. Those have not been reviewed or tested for compatiblity with ikiwiki-hosting however.

Also, renewals need to be processed in some way.

 [letsencrypt.org gods]: https://letsencrypt.org
 [letsencrypt enters backports]: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=809018
 [plugin]: https://github.com/letsencrypt/letsencrypt/wiki/Plugins
 [bash-only client]: https://github.com/lukas2511/letsencrypt.sh
 [large set of Let's Encrypt clients]: https://community.letsencrypt.org/t/list-of-client-implementations/2103
 [much simpler implementation in Python]: https://github.com/kuba/simp_le

> I would much rather use something small enough to be reviewable, particularly if we're
> going to have to run it unattended as root; the official Let's Encrypt client is *huge*.
> We don't have to worry about portability to non-Debian environments or non-Apache
> web servers, which takes away a lot of the reason to use something so big. --smcv
