Multi domain cert, DNS auth, multiple DNS providers

Help
1

My domain is: (many, but to show the issue smtp-in.tucs-workbench.com and inbound-2.t-b-o-h.net)

I'm trying to: I have a single mail server that accepts mail for ~50 domains, most of them with AWS, some with Cloudflare (I need to do this for the CDN'd domains)

What I'm looking to do: I'd like to use DNS authentication since I can't afford to take down my webserver while renewing or creating cerets

What I do now: When I only want to do all AWS domains, I use -
AWS_PROFILE="DNSCertbot" python certbot -d DOMAINA --dns-route53 --agree-tos --non-interactive --preferred-challenges dns

and for Cloudflare -
python certbot -d DOMAINB --dns-cloudflare --dns-cloudflare-credentials /etc/letsencrypt/cloudflare.ini --dns-cloudflare-propagation-seconds 60 --agree-tos --non-interactive

What I need to do: I need to be able to make 1 call to certbot, generate 1 cert, that calls AWS for the AWS domains, and Cloudflare for the Cloudflare domains.

What I've looked at: certbot-dns-multi, which can interface to 117+ providers, but apparently not more than one at the same time.

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): certbot 4.2.0

Is there some other way to accomplish this?

Tnx, Tuc

2

Welcome @tuc

One option is to write your own --manual-auth-hook for Certbot and handle the DNS interactions in that hook. I think that would work but I don't recall seeing it tried with multiple providers.

A simpler option is probably to switch to an ACME Client that supports that directly. See this past thread for an example using acme.sh: Acme.sh with multiple DNS providers for same cert?

acme.sh currently defaults to issuing certs from ZeroSSL. To maintain Let's Encrypt just specify LE on the command line or change the default. I don't have a reference available for that off-hand

3

I'm confused :confused:
Running an email server (at one IP) only requires one FQDN with one cert holding one SAN entry.
[regardless of how many email domains it serves]

So...
My question is: Why do you require more than one name on the email server certificate?

4

Thanks @MikeMcQ ! Yea, I switched over the acme.sh (After acme.sh --set-default-ca --server letsencrypt ) and scratching my head for a while and realizing my cloudflare API token didn't have the right permissions, it's working perfectly. Script looks something like -

#!/bin/bash
# Define API credentials globally once
export CF_Token="cfut_XXX"
export AWS_ACCESS_KEY_ID="AKXXXX"
export AWS_SECRET_ACCESS_KEY="SHHHHH"
# Execute multi-provider registration block
acme.sh --issue \
-d SMTP-IN.AWSDO.MAIN --dns dns_aws \
-d SMTP-IN.CFDO.MAIN --dns dns_cf

And to answer @rg305 , I'm EXTREMELY vain, so every domain I host mail for I create it's own A and MX record for SMTP-IN. (I won't get into the fact that they all get their own IP too. Or that the A records are in 2 different personally owned (Not rented, not AWS) /24's, but hosted in AWS on a single 172.16.X.X machine . Fun with networking happening here.) Without TLS, no one cares. With TLS, they'll care. :slight_smile: (Ok, I'm not EXTREMELY vain, just regular vain.... )

Would have been nice if certbot-dns-multi could do it. I couldn't find any docs really other than the README.MD

Thanks!
(Yes, I create my own problems many times, but that's adds to the fun of learning)
Tuc

5

You could give them their own FQDN from their domain and then CNAME that to your name.
OR
Realize that no one digs that deep [nor do they dig at all].
Take Gmail/O365 for instance...
Millions of domains point their MX records to them.
[no one notices - no one complains - no one cares]

6

No user should have to care. For inbound mail (sent to the MX), MX authenticity is provided through TLS and either MTA-STS (which requires a webserver serving mta-sts.<domain>) or DANE (which requires DNSSEC).

Only MTA-STS requires a per domain certificate and even then, it's not for mail, it's just to publish the policy over HTTPS.