Certbot and mixed challenges

Client dev
1

I am trying to analyze Certbot renewal files, and trying to wrap my head around the likelihood of mixed dns-01 and http-01 challenges.

It looks like Certbot doesn't support specifying the challenge for a certificate by domain on the commandline or storage file. I thought there might be some ways to trick Certbot into handling this through plugins, but I haven't found any major plugins that are doing this.

Can someone confirm the above, or point me in the direction of any tools that are doing this?

I am hoping Certbot does not support this, because that would make today a lot simpler!

Thanks in advance!

3 Likes
2

[[webroot-map]] wouldn't exsit if renewalconfig allowed setting authenticator per domain, (it would be [[authenticator-map]]) I don't think they allow setting authenticator per domain.

3 Likes
3

Thanks. I had noticed something like that in the code. I think it is theoretically possible within the design to have the authenticators decide which challenge to use themselves -- but I haven't found any that do that (or that implement the plugin storage backend to save information that could do that).

My current understanding is that seeing 'dns-01' in the renewal config will mean that everything uses dns-01 challenge (even though it's a list of strings, so ["dns-01", "http-01"] is a possible entry.

3 Likes
4

Just trying that you get :slight_smile:

sudo certbot certonly --webroot -w /var/www/html -d example.com --dns-cloudflare -d www.example.com --dry-run
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Too many flags setting configurators/installers/authenticators 'webroot' -> 'dns-cloudflare'
4 Likes
5

Sweet! Everythings coming up Milhouse!

5 Likes
6

This is just not something Certbot was build with in mind.. Unfortunately..

2 Likes
7

Not unfortunate for me :wink: This significantly drops the complexity of what I'm doing!

6 Likes
8

KISS wins!

:kiss_mark: :trophy:

1 Like
9

The common advice in this case was to (ab)use the cached authorizations and perform them one at a time. It does rely on Let's Encrypt implementation details (do other CAs even cache authorizations? How long do they cache them?)

4 Likes
10

Yes, I was just concerned if it was technically possible to somehow configure Certbot to handle this. I am finalizing a tool to import certbot renewal configurations.

4 Likes