desec-io / desec-certbot-hook

Use deSEC to obtain certificates with certbot DNS ownership verification.

dedyn.io certbot DNS challenge automatization

The certbot hook script of this repository has been retired in favor of certbot-dns-desec.

How to Migrate

1. Remove certbot configuration for your domain.
2. Delete the token from the .dedynauth file from your deSEC account.
3. Remove .dedynauth file that belonged to the hook script.
4. Follow instructions for certbot-dns-desec.

desec-certbot-hook's Issues

${CERTBOT_VALIDATION} sometimes begins with hyphen, breaking grep

i noticed that during my most recent renewal, it appears that certbot set ${CERTBOT_VALIDATION} to a string beginning with a hyphen, e.g.: -7aFBtiaGe8oob7quee6Oochahvahtufohcixaic8oh (not the actual token, just the beginning -7aFB is real...)
this caused the grep command to error out while the hook attempted to confirm the successful creation of the TXT entry:
grep: tiaGe8oob7quee6Oochahvahtufohcixaic8oh: invalid context length argument
i think the easiest way to fix this would be to add a '--' to the grep like so:
CURRENT=$(host -t TXT _acme-challenge.$DEDYN_NAME ns1.desec.io | grep -- "$CERTBOT_VALIDATION")
i'm not certain that's 100% portable across other platforms, e.g. bsd. the error occurred on linux with GNU grep.
to be clear, the challenge did get set correctly via the http PUT and the renewal was otherwise successful.
thanks for providing this functionality :) my experience with setting up hooks, etc. has been that it's tricky because you only can test your setup every 3 months.

Fix shellcheck issues

Pasting your script into https://www.shellcheck.net/ shows many issues:

 
Line 8:
    PATH=`pwd`/.dedynauth
    ^-- SC2123: PATH is the shell search path. Use another name.
         ^-- SC2006: Use $(..) instead of legacy `..`.
 
Line 13:
source .dedynauth
^-- SC1091: Not following: .dedynauth was not specified as input (see shellcheck -x).
 
Line 16:
    PATH=`pwd`./dedynauth
    ^-- SC2123: PATH is the shell search path. Use another name.
         ^-- SC2006: Use $(..) instead of legacy `..`.
 
Line 24:
    PATH=`pwd`./dedynauth
    ^-- SC2123: PATH is the shell search path. Use another name.
         ^-- SC2006: Use $(..) instead of legacy `..`.
 
Line 48:
curl -X PUT "${args[@]}" -f https://desec.io/api/v1/domains/$DEDYN_NAME/rrsets/_acme-challenge.../TXT/ \
                                                            ^-- SC2086: Double quote to prevent globbing and word splitting.
 
Line 49:
|| $(>&2 echo "If the previous error was a 404 error, that's ok"; curl -X POST "${args[@]}" https://desec.io/api/v1/domains/$DEDYN_NAME/rrsets/)
   ^-- SC2091: Remove surrounding $() to avoid executing output.
                                                                                                                            ^-- SC2086: Double quote to prevent globbing and word splitting.
 
Line 52:
>&2 echo "Current Time: `date`"
                        ^-- SC2006: Use $(..) instead of legacy `..`.
 
Line 54:
for i in `seq 1 60`;
^-- SC2034: i appears unused. Verify it or export it.
         ^-- SC2006: Use $(..) instead of legacy `..`.
 
Line 57:
        CURRENT=$(host -t TXT _acme-challenge.$DEDYN_NAME ns1.desec.io | grep -- "$CERTBOT_VALIDATION")
                                              ^-- SC2086: Double quote to prevent globbing and word splitting.

Support wildcard certificates

Calling the hook script with -d "myname.dedyn.io" -d "*.myname.dedyn.io" does not work, but the reverse order works. (Possible race condition?)

Winacme Guide

As the title says: is it possible to have a step by step guide for make it works using winacme? thank you!

Offer a way to add subdomains to the certificate

Can't get cert

Hi, I've problems generating a cert for my subdomain.
I have downloaded to hookscript, added all information to the auth file and updated the commandline for my subdomain, but when I run the command, it get stuck at

Are you OK with your IP being logged?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: y

After 12 minutes I cancelled the command with the following python error
According to the logfile, it got stuck here, before I cancelled:

2019-01-17 12:17:29,999:INFO:certbot.auth_handler:Performing the following challenges:
2019-01-17 12:17:30,001:INFO:certbot.auth_handler:dns-01 challenge for jj.dedyn.io
2019-01-17 12:29:41,132:DEBUG:certbot.error_handler:Encountered exception:
Traceback (most recent call last):
  File "/usr/lib/python3/dist-packages/certbot/auth_handler.py", line 75, in handle_authorizations
    resp = self._solve_challenges(aauthzrs)
[…]

Here is the full log file (without any tokens)

Any idea what could be the problem?

Add "secure .dedynauth file" to instructions

IMHO just to be sure, the docs should mention to properly secure the .dedynauth file. I think it may be enough if root can read it, is not it? (as certbot runs as root?)

[QUESTION]: Certificate Signing Request (CSR)?

Hello Folks!

How to use CSR file with desec-certbot-hook?

Regards,
RG.

Wrong command in section 4 of readme

in Section 4 the command starts with certbot-auto, but it should be just certbot
(I installed certbot following the instructions on the homepage)

this wokrs for me:

     certbot --manual \
     --text \
     --preferred-challenges dns \
     --manual-auth-hook ./hook.sh \
     -d "YOURDOMAINNAME.dedyn.io" \
     certonly

cleanup-hook Script

Hallo,

die per dns_01 erzeugten challenge-Einträge könnte man mittels cleanup-hook auch wieder entfernen.

Sie beigefügtes cleanup.sh(.txt)
cleanup.sh.txt

Grüße
Peter

hook.sh only working for dedyn.io domains

I have a problem using the hook script with a custom domain name not ending in dedyn.io. The authorization domain name from .dedynauth is always taken also for addressing the right RRSet. The correct way in my opinion should be a substring of the variable CERTBOT_DOMAIN. See lines 75, 78, 101.
Any chance to correct this in the script if you can confirm the error?

Hook-Script-Error when using certbot renew via cron

Hi,
thanks for the great service provided by deSEC! Am using it for a while and works flawlessly and very easy to handle! Naturally I donated aswell...
I've only one issue with the hook.sh for auto-renewing (via certbot and cron) my LetsEncrypt-Certs...
My cron command is simply:
/usr/bin/certbot renew
When putting the same command manually everything works as hook.sh and .dedynauth are in the same folder and have the right permissions but when cron triggers it I always get this error-message:
Hook command "hook.sh" returned error code 1
Error output from hook.sh:
File /root/.dedynauth not found. Please place .dedynauth file in appropriate location.
I tried to change the lines regarding the path for .dedynauth in the hook.sh but whatever I put there it always sets a "/root/" in front of the path.
Thanks for ideas/solutions!