How to expand certificate with a wildcard subdomain?

Help
6

Great !!! It finally worked …

I was trying to run the acme-dns API inside my own server, but I was unable to make the required settings on my domain controller. I think the problem is my controller that does not offer NS records option.

So I decided to try with the API available at https://auth.acme-dns.io. That way I only needed to do a POST at https://auth.acme-dns.io/register to obtain the necessary json to directly use the hook available at https://github.com/koesie10/acme-dns-certbot:

curl -X POST https://auth.acme-dns.io/register

I created an entry in my DNS:
_acme-challenge.polisoftware.com.br. type CNAME pointing to the value that the POST in https://auth.acme-dns.io/register returned in the “fulldomain” field of json.

I created a /etc/acme-dns folder with files:

/etc/acme-dns/acme-dns-certbot-hook
/etc/acme-dns/hook.json

The file acme-dns-certbot-hook can be obtained with the command:

go get github.com/koesie10/acme-dns-certbot-hook
(needs go installed)

The hook.json file must be created with the information obtained from the POST at https://auth.acme-dns.io/register, mine was like this:

{
        "acme_dns_url" : "https://auth.acme-dns.io",
        "propagation_duration" : "10s",
        "domains" : {
                "polisoftware.com.br" : {
                        "allowfrom" : [],
                        "username":"0683e???????????????????36fdd",
                        "password":"qT4h1i????????????????????????????????ZasVUN33iO",
                        "fulldomain":"c5ad???????????????????????????.auth.acme-dns.io",
                        "subdomain":"c5ade?????????????????????cfa8"
                }
        }
}

So I made some changes to the file: /etc/letsencrypt/renewal/polisoftware.com.br.conf that looked like this:

# renew_before_expiry = 30 days
version = 0.40.0
archive_dir = /etc/letsencrypt/archive/polisoftware.com.br
cert = /etc/letsencrypt/live/polisoftware.com.br/cert.pem
privkey = /etc/letsencrypt/live/polisoftware.com.br/privkey.pem
chain = /etc/letsencrypt/live/polisoftware.com.br/chain.pem
fullchain = /etc/letsencrypt/live/polisoftware.com.br/fullchain.pem

# Options used in the renewal process
[renewalparams]
account = <YOUR LESTENCRYPT ACC ID>
pref_challs = dns-01,
authenticator = manual
manual_auth_hook = /etc/acme-dns/acme-dns-certbot-hook -config /etc/acme-dns/hook.json
manual_public_ip_logging_ok = yes
installer = nginx
server = https://acme-v02.api.letsencrypt.org/directory

Now the command:
sudo certbot renew –dry-run

Saving debug log to /var/log/letsencrypt/letsencrypt.log

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Processing /etc/letsencrypt/renewal/polisoftware.com.br.conf
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Cert not due for renewal, but simulating renewal for dry run
Plugins selected: Authenticator manual, Installer nginx
Renewing an existing certificate
Performing the following challenges:
dns-01 challenge for polisoftware.com.br
dns-01 challenge for polisoftware.com.br
Running manual-auth-hook command: /etc/acme-dns/acme-dns-certbot-hook -config /etc/acme-dns/hook.json
Running manual-auth-hook command: /etc/acme-dns/acme-dns-certbot-hook -config /etc/acme-dns/hook.json
Waiting for verification...
Cleaning up challenges

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
new certificate deployed with reload of nginx server; fullchain is
/etc/letsencrypt/live/polisoftware.com.br/fullchain.pem
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
** DRY RUN: simulating 'certbot renew' close to cert expiry
**          (The test certificates below have not been saved.)

Congratulations, all renewals succeeded. The following certs have been renewed:
  /etc/letsencrypt/live/polisoftware.com.br/fullchain.pem (success)
** DRY RUN: simulating 'certbot renew' close to cert expiry
**          (The test certificates above have not been saved.)
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Once again thank you very much for showing the way !!!

2 Likes