This is a hook for the Let's Encrypt ACME client
dehydrated (previously known as
letsencrypt.sh) that allows you to use GleSYS DNS
records to respond to dns-01 challenges.
The hook requires Python 3.x, a GleSYS account and an API key.
$ git clone https://github.com/lukas2511/dehydrated
$ cd dehydrated
$ mkdir hooks
$ git clone https://github.com/blastur/glesys-dnshook.git hooks/glesys
Ensure that the dig tool is installed and in your PATH. It's used by the hook
to verify DNS propagation. If you're using a Debian/Ubuntu-based system, you can
get Dig through the dnsutils package:
$ apt-get install dnsutils
Your account's GleSYS account name and API key are expected to be in the environment, so make sure to:
$ export GLESYS_USER='CL12345'
$ export GLESYS_KEY='AvMCkh0Ykeifz10qQri5IoF442mnW65GBRj69t4A'
You can obtain an API key by logging onto the GleSYS customer portal at https://customer.glesys.com/.
Refer to the dehydrated README for information on how setup it up. For the impatient:
$ ./dehydrated --register
Read and accept the terms, as the output suggest.
Once setup, you can sign/renew a certificate like so:
./dehydrated -c -t dns-01 -k hooks/glesys/hook.py --domain mycooldomain.se
(mycooldomain.se must obviously be managed by GleSYS)
You can simplify the call to dehydrated by creating a config and domains.txt file. See the dehyrated docs/ for more information. The dehyrated config is also a good place to store hook config, as it is sourced automatically. For example:
echo "export GLESYS_USER=user@example.com" >> config
echo "export GLESYS_KEY=AvMCkh0Ykeifz10qQri5IoF442mnW65GBRj69t4A" >> config
By default, Glesys DNS serves (ns1.namesystem.se) are used to verify DNS propagation. This is the same servers used by LetsEncrypt to verify the challenge. If you still wish to change the verification DNS, you may set the GLESYS_DNS_SERVER environment variable:
$ export GLESYS_DNS_SERVER='1.2.3.4'
It'll wait for 300 seconds for the record to propagate. You can override the
timeout via the GLESYS_PROPAGATION_TIMEOUT environment variable (specified
in seconds):
$ export GLESYS_PROPAGATION_TIMEOUT=500
If you want more information about what is going on while the hook is running:
$ export GLESYS_HOOK_DEBUG='1'
Like the basic configuration (GLESYS_USER and GLESYS_KEY), you can put these into the dehydrated config to automatically set them up when dehydrated run.