Comments (6)
wisq
commented on July 25, 2024
1
Hm, getting closer. Just tried this with 0.4.1, and it does seem to upload the new certificate (judging from the timestamps). However, it does not seem to update the CloudFront distribution to use the new cert (like it does when I first install a cert).
from certbot-s3front.
shadow-light
commented on July 25, 2024
1
I also just discovered that my certs are being renewed but not deployed. So running renew reports everything as fine as the certs are not outdated, but my sites go down because the new version hasn't been uploaded/enabled in CF.
from certbot-s3front.
wisq
commented on July 25, 2024
Since my cert was about to expire, I went and deleted the cert and recreated it, and as usual, it worked fine on the initial create:
% sudo chpst -e /etc/letsencrypt/env.d -- certbot --agree-tos -a certbot-s3front:auth --certbot-s3front:auth-s3-bucket i.wisq.net -i certbot-s3front:installer --certbot-s3front:installer-cf-distribution-id E2L7B2VHN1HT68 -d i.wisq.net
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator certbot-s3front:auth, Installer certbot-s3front:installer
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for i.wisq.net
Found credentials in environment variables.
Starting new HTTPS connection (1): s3.amazonaws.com
Waiting for verification...
Cleaning up challenges
Starting new HTTPS connection (1): s3.amazonaws.com
Starting new HTTPS connection (1): iam.amazonaws.com
Starting new HTTPS connection (1): cloudfront.amazonaws.com
-------------------------------------------------------------------------------
Congratulations! You have successfully enabled https://i.wisq.net
You should test your configuration at:
https://www.ssllabs.com/ssltest/analyze.html?d=i.wisq.net
-------------------------------------------------------------------------------
Notably, there are extra HTTPS connections to iam.amazonaws.com and cloudfront.amazonaws.com, which I assume are the actual "let's update the cert" calls. I still have no idea why it doesn't make these calls on a renewal request.
from certbot-s3front.
dlapiduz
commented on July 25, 2024
@wisq can you please try the new version? I just pushed a new version that supports the renew motions.
from certbot-s3front.
selu
commented on July 25, 2024
I also tried version 0.4.1 and the renewal does not work because from renew_deploy only deploy_cert is called and save does not and only save updates the CloudFront distribution. However, I think, the code, what moved into save should be kept in deploy_cert, because it's simply part of the deploy in this case.
from certbot-s3front.
ajorg
commented on July 25, 2024
I spent some time on this today as it was time to renew again. I'm sorry I haven't made time yet to actually work up a patch for the plugin, but here's a breakdown of what's still going on.
The certificate gets renewed and uploaded to IAM, but the CloudFront distribution config doesn't get updated. The new certificate ID is known:
$ grep -F ServerCertificateId ~/certbot/log/letsencrypt.log
b'<UploadServerCertificateResponse xmlns="https://iam.amazonaws.com/doc/2010-05-08/">\n <UploadServerCertificateResult>\n <ServerCertificateMetadata>\n <Path>/cloudfront/letsencrypt/</Path>\n <UploadDate>2019-11-09T17:57:26Z</UploadDate>\n <Expiration>2020-02-07T16:57:24Z</Expiration>\n <ServerCertificateName>le-andrew.jorgensenfamily.us-1573322246</ServerCertificateName>\n <Arn>arn:aws:iam::246745595609:server-certificate/cloudfront/letsencrypt/le-andrew.jorgensenfamily.us-1573322246</Arn>\n <ServerCertificateId>ASCATS4ZO73M6ISFBOSPD</ServerCertificateId>\n </ServerCertificateMetadata>\n </UploadServerCertificateResult>\n <ResponseMetadata>\n <RequestId>6cb46a72-8115-409d-8566-82226dec944e</RequestId>\n </ResponseMetadata>\n</UploadServerCertificateResponse>\n'
But the distribution continues to use the old certificate ID:
$ aws cloudfront get-distribution-config --id EODMNMAEHV4AH | jq -r .DistributionConfig.ViewerCertificate.IAMCertificateId
ASCATS4ZO73MQGKXGCWT3
Here's what I've been doing to deploy the certificate (licensed to whomever under MIT No Attribution):
# Copyright (c) Andrew Jorgensen. All rights reserved.
# SPDX-License-Identifier: MIT-0
# Requires jq and assumes AWS CLI --output json
DISTRIBUTION_ID="<YOUR DISTRIBUTION ID>"
DISTRIBUTION_CONFIG="$(
aws cloudfront get-distribution-config \
--id "${DISTRIBUTION_ID}" \
| jq -c .)"
# FRAGILE! Picks a certificate created today (UTC).
CERTIFICATE_ID="$(
aws iam list-server-certificates \
| jq -r ".ServerCertificateMetadataList[]
| select(.UploadDate | startswith(\"$(date --utc +%F)T\"))
| .ServerCertificateId")"
aws cloudfront update-distribution \
--id "${DISTRIBUTION_ID}" \
--if-match "$(jq -r '.ETag' <<<"${DISTRIBUTION_CONFIG}")" \
--distribution-config "$(
jq -c --arg certificate "${CERTIFICATE_ID}" \
'.DistributionConfig
| .ViewerCertificate.IAMCertificateId = $certificate
| .ViewerCertificate.Certificate = $certificate' \
<<<"${DISTRIBUTION_CONFIG}")"I hope that's helpful to someone. I'll eventually get around to adding support to deploy the renewed and uploaded certificate, but I won't be sad if someone else gets to it before me.
from certbot-s3front.
Related Issues (20)
- ot
- This worked like a dream! Thank you. =) HOT 1
- Issue installing with certbot 0.23.0 HOT 1
- NoCredentialsError HOT 3
- Max retries exceeded with url HOT 3
- [0.4.0] SyntaxError with python 3.6.6 HOT 1
- KeyError: 'IAMCertificateId' on new distribution HOT 10
- Error in configuring distribution with certificate HOT 1
- Cannot run on raspbian stretch HOT 1
- Not Python3 compatible HOT 2
- AttributeError: module 'certbot.interfaces' has no attribute 'RenewDeployer' HOT 1
- Configure dns in aws route 53
- Unreliable with load balancers and API Gateways HOT 1
- issue with certificate generation HOT 1
- Support non Amazon hosts (region endpoints)
- Unable to upload/update renewed cert via s3front HOT 1
- Add support for certbot 2.x HOT 1
- Failing when trying to use the docker container
- certbot: error: unrecognized arguments: --certbot-s3front:auth-s3-bucket my-bucket HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from certbot-s3front.