alambrec / validation-hooks-certbot-godaddy

Pre and Post Validation Hooks for manual mode of `certbot` with Godaddy domains

validation-hooks-certbot-godaddy

Pre and Post Validation Hooks DNS for manual mode of certbot with GoDaddy domains

What is it ?

This repository contains pre and post validation hooks to be used with certbot command in manual mode to certify a GoDaddy Domains with DNS-01 method.

More informations are available on Certbot Doc

Required package

This script is a shell script based on /bin/bash. It uses following command tools :

curl
dig

It depends on several packages :

yum install curl
# dig command depends on bind-utils package
yum install bind-utils

How to

1. Download this script on your system
2. Replace SHELL variables API_KEY and API_SECRET in this script to match them with yours values
3. Run certbot in manual mode with this two scripts as arguments :

certbot certonly --manual --preferred-challenges=dns --manual-auth-hook ./authenticator_godaddy.sh --manual-cleanup-hook ./cleanup_godaddy.sh -d $YOUR_DOMAIN

4. If certbot return success, you would get your new certificate on your system

Debug

If you have any problems, you can run separately this script.

For authenticator_godaddy.sh, you must set manually following variables :

• CERTBOT_DOMAIN
• CERTBOT_VALIDATION

For example, if your domain is auth.foo.mydomain.com, these variables must set like :

# Uncomment this lines only to test this script manually
CERTBOT_DOMAIN="auth.foo.mydomain.com"
CERTBOT_VALIDATION="test_value"

Once the authenticator_godaddy.sh script ended, your domain must be upgrade with _acme-challenge.auth.foo TXT record with test_value as value.

However, these lines must be commented in normal mode because $CERTBOT_DOMAIN and $CERTBOT_VALIDATION variables is defined by certbot command.

(Optional) Separate credentials

It is recommended to store separately credentials from script to avoid a security risk. By default, these scripts will try to load your credentials from secrets file in : /etc/certbot/$CERTBOT_DOMAIN/secrets

An sample of secrets file, named secrets.sample, is available to help you how it must be formated.

Similarly, you can modify default path of secrets file used, by editing SECRET_FILE variable.

Testing systems

• macSierra
• CentOS 7

validation-hooks-certbot-godaddy's Issues

Help? Failed add txt record. What's wrong?

Failed authorization procedure. fashionworldhongkong.com (dns-01): urn:ietf:params:acme:error:dns :: DNS problem: NXDOMAIN looking up TXT for _acme-challenge.fashionworldhongkong.com

IMPORTANT NOTES:

• The following errors were reported by the server:

  Domain: fashionworldhongkong.com
  Type: None
  Detail: DNS problem: NXDOMAIN looking up TXT for
  _acme-challenge.fashionworldhongkong.com

I Checked Godaddy DNS, The txt record value is "none".
What's wrong?

There is a problem detecting subdomains

country domains differ from normal domains

the rule to detect a subdomain is [subdomain] . [domain] . [TDL]

but country domains are [domain] . [SLD] . [country code]

The rule is misfiring on Country code second-level domain deteting domains as subdomains

authenticator doesn't work well with SAN certificates

The authenticator script only works well, when there's one challenge per certificate to process.
If there are multiple challenges, the script is executed multiple times and each time replaces the TXT record created by the previous iteration. Thus, by the time certbot does the validation, there is always at least one TXT record missing.

With a little tinkering, one can work around it and only do a replace when there was an entry "none" before.
(me having replaced host by dig and figuring out an authoritative name server for the domain may or may not be relevant.)

authenticator_godaddy.sh.diff.txt