fmstrat / easywildcard Goto Github PK

A single-command docker container that makes it easy for anyone to utilize a wildcard SSL certificate from Let's Encrypt.

Shell 100.00%

easywildcard's Introduction

Easywildcard - Easy wildcard certs from Let's Encrypt

This extension of certbot is intended to be a docker container that makes it easy for anyone to get a wildcard SSL certificate. The way it works is:

You set up some basic DNS entries to point to the server you will run Easywildcard on (can be a dynamic IP)
You forward port 53 to the server you will run Easywildcard on (Easywildcard will only be listening for the short period of time it is running)
Easywildcard fires up certbot and bind to handle the requests

Setting up your DNS

This assumes:

Your domain is example.com
The host you run Easywildcard on is mydynamichost.anyplace.com
mydynamichost.example.com uses Dynamic DNS to stay updated

To get things going, create the following DNS records:

acme-dns.example.com that is a CNAME to mydymanichost.anyplace.com (or an A record to a static IP)
acme-challenge.example.com that is an NS type with an answer of acme-dns.example.com
_acme-challenge.example.com that is a CNAME to acme-challenge.example.com

That's it!

Setting up the machine to run Easywildcard

Make sure your Dynamic DNS provider is set up so your IP always has a static hostname (or use a provider with a static IP)
Make sure you forward port 53 externally to port 5053 on the local machine (or whatever port is specified below)

Usage

Until this is live on the HUB and documentation is complete, clone and then:

docker build --tag easywildcard .
DOMAIN="example.com"
EMAIL="[email protected]"
PORT=5053
mkdir -p /tmp/letsencrypt

Then, to get a new cert:

docker run -p ${PORT}:53/tcp -p ${PORT}:53/udp -v /tmp/letsencrypt/:/etc/letsencrypt --rm -i -e "EMAIL=${EMAIL}" -e "DOMAIN=${DOMAIN}" easywildcard

You can run the above for as many domains as you need SSL certs for.

From then out, to renew, you can do the following in cron:

  docker run -p ${PORT}:53/tcp -p ${PORT}:53/udp -v /tmp/letsencrypt/:/etc/letsencrypt --rm -i -e "RENEW=1" easywildcard

You can add certs at any time using the first command. Renew will just pick them up

Optional variables

STAGING=1 # To use staging servers
SERVER=<server> # To use a specific ACME server

easywildcard's People

Contributors

Stargazers

Watchers

Forkers

nospam2k infowolfe chrishirsch micudaj temach tascape xserveraws renatofrota binovo jcward

easywildcard's Issues

NS Record?

Sorry to be a noob, but in cPanel, I don't see an option for NS record. Only A, AAAA, CAA, CNAME, MX, SRV, TXT. Thanks for bearing with me.

Never mind. I found it. Not in cPanel but WHM.

Fails if we don't have two challenges

I'm a very happy user of easywildcard.

For a couple of domains I seen this error

Some challenges have failed.
IMPORTANT NOTES:
 - The following errors were reported by the server:

   Domain: smtp.no.ist.com
   Type:   dns
   Detail: DNS problem: SERVFAIL looking up TXT for
   _acme-challenge.smtp.no.ist.com - the domain's nameservers may be
   malfunctioning

when running docker run -v /etc/letsencrypt/:/etc/letsencrypt --rm -i -e "[email protected]" -e "DOMAIN=smtp.no.ist.com" easywildcard

The reason is certbot only gets one challenge, and bind is only startet if there are two challenges, due to https://github.com/Fmstrat/easywildcard/blob/master/hooks/auth-hook.sh's if [ $NUM -eq 2 ]

My workaround is to run docker run -v /etc/letsencrypt/:/etc/letsencrypt -v /tmp/:/tmp --rm -i -e "[email protected]" -e "DOMAIN=smtp.no.ist.com" easywildcard twice ... this way /tmp/easywildcard/VALIDATION will contain two challanges and bind will start.

Please replace if [ $NUM -eq 2 ] with if [ $NUM -ge 1 ]

Have a nice day.
Greetings, Christian

Feature Request

@bmw For continuation of dialog from archived repo: Fmstrat/easywildcard-old#1

Rebuilt as non-fork.

Usage instructions for newbies

Hi,
this seems like an excellent piece of code, but I am not Linux expert and I have no idea, what your instructions say:
Until this is live on the HUB and documentation is complete, clone (what's clone...how to do it on, for eg. Ubuntu 12.04?) and then:

docker build --tag easywildcard .
DOMAIN="example.com"
EMAIL="[email protected]"
PORT=5053
mkdir -p /tmp/letsencrypt

Where to put these lines?

I've checked my install and I have:

certbot-auto --version

certbot 0.27.1

Populated:
/var/lib/letsencrypt/
/etc/letsencrypt/

But:
/opt/certbot or /opt/letsencrypt do not exist on my server.

Please, could you be so kind and add some instructions for newbies.
thanx!

Doesn't work...

I get this error with your first command:

"docker build" requires exactly 1 argument.
See 'docker build --help'.

Usage:  docker build [OPTIONS] PATH | URL | -

Build an image from a Dockerfile

If I run the command as just docker build easywildcard it seems to work until the end when I get this:

fetch http://dl-cdn.alpinelinux.org/alpine/v3.11/main/x86_64/APKINDEX.tar.gz
ERROR: http://dl-cdn.alpinelinux.org/alpine/v3.11/main: temporary error (try again later)
WARNING: Ignoring APKINDEX.70f61090.tar.gz: No such file or directory
fetch http://dl-cdn.alpinelinux.org/alpine/v3.11/community/x86_64/APKINDEX.tar.gz
  bind (missing):
    required by: world[bind]
ERROR: http://dl-cdn.alpinelinux.org/alpine/v3.11/community: temporary error (try again later)
WARNING: Ignoring APKINDEX.ca2fea5b.tar.gz: No such file or directory
ERROR: unsatisfiable constraints:
The command '/bin/sh -c apk --update add bind' returned a non-zero code: 1

--rsa-key-size 4096

hello,

first of all: thank you for your script! it works very well and easy. i use it in an lxc ct on a proxmox host.
i change all directory from /tmp/easywildcard to /opt/easywildcard , because after an reboot my /tmp folder is empty (and all certs and configs are gone).
i would like to use an 4096 bit cert, so i tried to add --rsa-key-size 4096 in the getcert.sh . but it won't work. i only get 2048 bit certs. is there an workaround?

sorry for my bad english.
lg phill

SOLVED: Google Domains DNS, failed authorization procedure

Hi, I followed the instructions carefully, creating DNS entries for my domain like this in the Google Domains DNS settings:

And when I run the script, I get:

Failed authorization procedure. example.com (dns-01): urn:ietf:params:acme:error:dns :: DNS problem: NXDOMAIN looking up TXT for _acme-challenge.example.com - check that a DNS record exists for this domain, example.com (dns-01): urn:ietf:params:acme:error:dns :: DNS problem: NXDOMAIN looking up TXT for _acme-challenge.example.com - check that a DNS record exists for this domain

Solution: I've worked with multiple DNS services, and I could swear Google is the first one that's let me make the mistake of entering the domain name in what's supposed to be strictly the prefix field on the left.

In other words, all 3 records need to look like this (NO domain name in the left column, yes domain in the right column):

Hopefully my mistake saves someone else some trouble. 👍