Letsencrypt Wildcard SSL with DNS method

Help
#1

Hello guys,

We are providing some cloud services, where we deploy servers for our clients remotely. We also provide temporary domains to our clients for initial usage, for e.g. something.example.com

Now when client add their own domain name for e.g. something.xyz.com , we want to provide lets encrypt wild card ssl's for their own domains > ( something.xyz.com ),

we are using shell scripts remotely on client's servers to generate these wild card lets encrypt ssl.
one method is I am aware of that we can generate ssl using cert-bot command where it gives us a random value and we have to create the TXT record inside DNS and add that random value, but in my scenario i can't get that random VALUE , because we are running remote shell scripts and it can't provide us that random value. i want to automate this thing. For standard SSL we are using certbot to genrate ssl, please let me know the best solution for my scenario.

Thanks in advance.

1 Like
#2

The best solution in your scenario is avoid using the dns-01 challenge and evaluate how to obtain the same with either http-01 or tls-alpn-01.

Another option, you can use acme-dns and have them delegate their _acme-challenge DNS label to you. But that's an overkill.

And I don't get why you want to use wildcards instead of certificates for the specific FQDN.

1 Like
#3

I don't really follow. Why wouldn't the TXT value be of any use in your shell script? You shouldn't want to do this manually, as @9peppe already mentioned.

2 Likes
#4

Hey @9peppe , thanks for quick reply, Actually clients can add multiple domains for their website that is why we are generating wildcard ssl for them, but this process needs to be automated.

and i also saw a CNAME method on lets-encrypt's official documentation , will that help me to achieve my goal ?

image
image1227×496 110 KB

#5

Multiple... how many?

Because managing the dns-01 challenge is hard.

With http-01 or tls-alpn-01 you only need the A/AAAA record pointing to your server.

Imho it's not an issue if you make a certificate for ten subdomains, or even ten different certificates one for each subdomain.

1 Like
#6

@9peppe
Actually we don't want to create ssl again and again, just create a wildcard ssl and then client can add multiple domain, through our application.

FYI : - we have a application for all this , in which clients perform their activities like managing server, restarting services etc,

We want to automate this process of generating wildcard ssl.

#7

Unless you host their nameservers or you get that cname, it's going to be an incredible mess.

Avoid it if you can.

You will reissue each certificate every two months regardless. Issuing one per service instead of one per registered domain is the way I would do it.

1 Like
#8

how to Add a CNAME record as _acme-challenge and point it to one of the already added domain on that server ?
i think in this blog they are suggesting the same way

image
image1378×620 143 KB

#9

No, you would point it to a subdomain you control completely and could use a DNS API to update automatically the TXT records.

See the acme-dns documentation.

1 Like
#10

Please see the below screenshot , this is reference application , Cloudways.com,

image
image880×542 41.5 KB

They are generating ssl automatically,

here wordpress-695704-2298218.cloudwaysapps.com is the temporary domain they provide to user and i added a domain livesem.co.il for wildcard ssl, they asked me to add new DNs record _acme-challenge and point to wordpress-695704-2298218.cloudwaysapps.com , i am little confused how they are giving wildcard ssl support.

#11

When you add that cname, they can use that to put any txt record they want there, thus they can perform a dns-01 validation against your domain.

See here: GitHub - joohoi/acme-dns: Limited DNS server with RESTful HTTP API to handle ACME DNS challenges easily and securely.

1 Like
#12

So to achieve this actually i need any developer's help right ?
it will will be achieved using API ?

#13

I'm inclined to say yes but I also think my answer is meaningless here.

Yes, you will need to install some software and make it work together.

1 Like
#14

ok got it, so basically using their DNS provider i.e. cloudwaysapps.com they will able to add TXT record for my doman i.e. livesem.co.il
am i right ?

#15

More or less, yes.

The CNAME record literally means "clone every record you see at this other label"

(Including A, TXT, whatever)

1 Like
#16

but when i created this CNAME into my dns , i can't see any TXT record into it, what does it mean ?

#17

You will see the cname. If you want to see the txt you have to make an actual DNS query.

(And the TXT record used for DNS validation is very short lived, it gets deleted at the end of the validation, it's difficult you'd see it.)

1 Like
#18

@9peppe But that's not how "Cloudways" works apparently. They "require" the CNAME to their DNS server.

@amit_942 What is "Cloudways" anyway?

2 Likes
#19

If you tell them you want a wildcard, I guess they have to. (There's a checkbox)

Moreover, they're using the same label for the website and _acme-challenge.

2 Likes
#20

@amit_942
At first glance, wild card certs may seem simpler...
But they add a great deal of complexity to the problem.
In your scenario, I would seriously look at NOT using wild cards (unless absolutely necessary).

2 Likes