Package: certbot-dns-desec
certbot-dns-desec: Get Let's Encrypt Certificates for Domains Hosted at deSECCertbot plugin to obtain TLS certificates from Let's Encrypt for domains hosted with deSEC.io, using the DNS challenge
challenge mechanism.InstallationTo get certificates from Let's Encrypt, install certbot and this plugin.
There are many ways to install certbot, this guide uses Python'spip:python3-mpipinstallcertbotcertbot-dns-desecPrerequisitesTo get a Let's Encrypt certificate for your domain$DOMAIN,
you need a deSEC API token$TOKENwith sufficient permission for performing the required DNS changes on your domain.
Also make sure that your domain name has been delegated to deSEC
(in other words: make sure that the parent registry has the right NS records).If you don't have a token yet, an easy way to obtain one is by logging into your account atdeSEC.io.
Navigate to "Token Management" and create a new one.
It's good practice to restrict the token permissions as much as possible,
e.g. by setting the maximum unused period to four months.
This way, the token will expire if it is not continuously used to renew your certificate.
Tokens can also be createdusing the deSEC API.Request CertificateTo issue and renew certificates usingcertbot-dns-desec, an access token to your deSEC account is required.
To store such a token in a secure location, use, e.g.:DOMAIN=example.comTOKEN=your-desec-access-token
sudomkdir-p/etc/letsencrypt/secrets/
sudochmod700/etc/letsencrypt/secrets/echo"dns_desec_token =$TOKEN"|sudotee/etc/letsencrypt/secrets/$DOMAIN.ini
sudochmod600/etc/letsencrypt/secrets/$DOMAIN.iniAdjust$DOMAINand$TOKENaccording to your domain and deSEC access token, respectively.
The file location is just a suggestion and can be changed.With the credentials stored, you can request a wildcard certificate for your domain by using, e.g.,certbotcertonly\--authenticatordns-desec\--dns-desec-credentials/etc/letsencrypt/secrets/$DOMAIN.ini\-d"$DOMAIN"\-d"*.$DOMAIN"In this command,--authenticator dns-desecactivates thecertbot-dns-desecplugin;
the--dns-desec-credentialsargument provides the deSEC access token location to the plugin.
These flags can be combined with more sophisticated usages of certbot,
e.g. to automatically reload servers after the renewal process.
Such functionality is independent of this plugin; for details, see the certbot documentation.CLI InterfaceThis plugin is activated by passing the--authenticator dns-desecargument to certbot.
It accepts the following command line arguments:--dns-desec-credentials <file>Specifies the file holding the deSEC API credentials (required, see below).--dns-desec-propagation-secondsWaiting time for DNS to propagate before asking the ACME server to verify the
DNS record.Credentials File FormatAn examplecredentials.inifile:dns_desec_token = tokenAdditionally, the URL of the deSEC API can be specified using thedns_desec_endpointconfiguration option.https://desec.io/api/v1/is the default.Development and TestingTo test certbot-dns-desec, create a virtual environment atvenv/for this repository and activate it.
Register a domain$DOMAINwith desec.io, and obtain a DNS management token$TOKEN. Then runpython3-mpipinstall.TOKEN=token-you-obtained-from-desec-ioDOMAIN=domain-you-registered-at-desec-ioEMAIL=youremail@example.comecho"dns_desec_token =$TOKEN">desec-secret.ini
chmod600desec-secret.ini
./venv/bin/certbot\--config-dirtmp/certbot/config\--logs-dirtmp/certbot/logs\--work-dirtmp/certbot/work\--test-cert\-d$DOMAIN-d"*.$DOMAIN"\--authenticatordns-desec\--dns-desec-credentialsdesec-secret.ini\--non-interactive--agree-tos\--email$EMAIL\certonlyMaintenance: Prepare New ReleaseMake sure tests are okay (see GitHub actions)Commit all changesClean updist/folderSet up new release version:RELEASE=x.y.zUpdate version tox.y.zinsetup.pyCommit with message "Release Version vx.y.z":git commit -p -m "Release Version v$RELEASE"Tag commit usinggit tag -as v$RELEASE -m "Release Version v$RELEASE"Pushbranch:git pushtag:git push origin v$RELEASESet environment variablesGITHUB_TOKENto a GitHub token,TWINE_USERNAMEandTWINE_PASSWORDto PyPi
credentials.Publish usingpython3 -m publish desec-io certbot-dns-desec