0

I manually set up a Certbot cert on an EC2 instance so that I could set up a wildcard cert.

Specifically, I used the following command (with the real domain, not example.com) to set up the manual certificate:

sudo certbot -d example.com -d *.example.com --manual --preferred-challenges dns certonly

I then set the necessary DNS TXT records through Google Domains to handle the challenges. This works fine, and I was able to properly set up the wildcard cert, but the problem is that I cannot figure out how to auto-renew the cert since I set it up manually.

The Certbot docs mention that you have to set up an authentication hook script to auto-renew manual certs, but the docs are pretty complicated, and I don't really understand how to turn what the docs are saying into what I want.

Specifically, I'm referencing this and this:

Could someone that understands this please explain to me how I need to set up an authentication hook script like they mention to allow me to auto-renew the manual cert I've set up? Thank you.

Improve this question
6
  • Does the method at the end of this article help in your case?
    – harrymc
    Jun 7, 2022 at 19:47
  • "I don't really understand how to turn what the docs are saying into what I want." - Which steps are you stuck on exactly?
    – Ramhound
    Jun 7, 2022 at 19:47
  • @harrymc, thank you, but unfortunately, no. When you manually set up a Certbot cert, the standard renewal method doesn't work, thus my confusion. If there were an easier way to create wildcard certs with Certbot, this wouldn't be an issue to begin with, but alas.
    – HartleySan
    Jun 7, 2022 at 20:34
  • @Ramhound, basically the whole thing. My understanding is that I essentially have to re-perform the original cert setup in the hook script, but I don't know how you're supposed to do that in a shell script since you have to response to prompts as well as add TXT records to the DNS in Google Domains before performing the challenges, etc. And as far as I can tell, none of that is explained in the Certbot docs, thus why I'm asking here.
    – HartleySan
    Jun 7, 2022 at 20:37
  • Certbot has the '-q' flag.
    – harrymc
    Jun 7, 2022 at 20:48

2 Answers 2

Reset to default
1

Using certbot-dns-google is useless for Google Domains, it only works with Google Cloud which is far too expensive for personal use.

Improve this answer
1
  • Thank you for clarifying that.
    – HartleySan
    Nov 13, 2022 at 2:26
0

  1. If you are using the aws platform, better to use AWS Certificate Manager instead of installing certbot

  2. But, if managed by Google Domains, you must use certbot with DNS Plugins

  3. if you have Self-Managed BIND, you can use the certbot-dns-rfc2136 plugin

  4. And you can also use certbot without DNS Plugins for wildcard domain if you have Self-Managed BIND

Improve this answer
2
  • 1
    Link only answer is useless. Can you elaborate on this a litle more?
    – Toto
    Aug 8, 2022 at 15:57
  • Updated answer. And I recommend number 2. certbot with DNS Plugins.
    – tonic
    Aug 9, 2022 at 14:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .