Let's Encrypt wildcard certificates and ACMEv2 are available today! More information can be found here: https://t.co/0SdH98Oabn
— Let's Encrypt (@letsencrypt) March 13, 2018
今年の3月くらいからLet’s Encryptが完全にワイルドカードを対応しました。そこで!AWSのRoute53を使って証明書自動更新するにはなかなか特殊なのですが、ワイルドカードの場合、毎回TXTレコードをRoute53で設定し直して(下記のように)証明書を更新するという、なんとも対話形式で、aws cli使うしかないのでは！？とツラいな思いをするのかと思いきや…certbot-dns-route53というプラグインを使うことで自動で認識してくれましたのでブログします。
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 |
# certbot certonly --manual \ > --server https://acme-v02.api.letsencrypt.org/directory \ > --preferred-challenges dns-01 \ > -d *.adachin.jp \ > -m adachin@adachin.com \ > --agree-tos \ > --manual-public-ip-logging-ok \ > --debug Saving debug log to /var/log/letsencrypt/letsencrypt.log Plugins selected: Authenticator manual, Installer None Cert not yet due for renewal You have an existing certificate that has exactly the same domains or certificate name you requested and isn't close to expiry. (ref: /etc/letsencrypt/renewal/adachin.jp.conf) What would you like to do? ------------------------------------------------------------------------------- 1: Keep the existing certificate for now 2: Renew & replace the cert (limit ~5 per 7 days) ------------------------------------------------------------------------------- Select the appropriate number [1-2] then [enter] (press 'c' to cancel): 2 Renewing an existing certificate /usr/lib/python2.7/dist-packages/josepy/jwa.py:107: CryptographyDeprecationWarning: signer and verifier have been deprecated. Please use sign and verify instead. signer = key.signer(self.padding, self.hash) Performing the following challenges: dns-01 challenge for adachin.jp ------------------------------------------------------------------------------- Please deploy a DNS TXT record under the name _acme-challenge.adachin.jp with the following value: wxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxyeahxxxxxxxxxx Before continuing, verify the record is deployed. ------------------------------------------------------------------------------- Press Enter to Continue^CCleaning up challenges |
■ちなみにいつものよう更新してみると？
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 |
# certbot renew --force-renewal Saving debug log to /var/log/letsencrypt/letsencrypt.log ------------------------------------------------------------------------------- Processing /etc/letsencrypt/renewal/adachin.com.conf ------------------------------------------------------------------------------- Could not choose appropriate plugin: The manual plugin is not working; there may be problems with your existing configuration. The error was: PluginError('An authentication script must be provided with --manual-auth-hook when using the manual plugin non-interactively.',) Attempting to renew cert (crowdsourcing-i.com) from /etc/letsencrypt/renewal/adachin.com.conf produced an unexpected error: The manual plugin is not working; there may be problems with your existing configuration. The error was: PluginError('An authentication script must be provided with --manual-auth-hook when using the manual plugin non-interactively.',). Skipping. ------------------------------------------------------------------------------- Processing /etc/letsencrypt/renewal/adachintaro.conf ------------------------------------------------------------------------------- Could not choose appropriate plugin: The manual plugin is not working; there may be problems with your existing configuration. The error was: PluginError('An authentication script must be provided with --manual-auth-hook when using the manual plugin non-interactively.',) Attempting to renew cert (adachin.jp) from /etc/letsencrypt/renewal/adachintaro.conf produced an unexpected error: The manual plugin is not working; there may be problems with your existing configuration. The error was: PluginError('An authentication script must be provided with --manual-auth-hook when using the manual plugin non-interactively.',). Skipping. All renewal attempts failed. The following certs could not be renewed: /etc/letsencrypt/live/adachin.com/fullchain.pem (failure) /etc/letsencrypt/live/adachintaro.jp/fullchain.pem (failure) ------------------------------------------------------------------------------- All renewal attempts failed. The following certs could not be renewed: /etc/letsencrypt/live/adachin.com/fullchain.pem (failure) /etc/letsencrypt/live/adachintaro.jp/fullchain.pem (failure) ------------------------------------------------------------------------------- 2 renew failure(s), 0 parse failure(s) |
更新できません。
■Welcome to certbot-dns-route53’s documentation
https://certbot-dns-route53.readthedocs.io/en/latest/
とりあえず、IAMでユーザ作ってポリシー作ってクレデンシャル配布して、プラグインインストールからの更新みたいな感じですな。
■Add user,policy
- IAMでcerbotユーザを作成
- cerbotユーザにIAMロールポリシー(Cerbot_Route53)にアタッチ
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 |
{ "Version": "2012-10-17", "Id": "certbot-dns-route53 sample policy", "Statement": [ { "Effect": "Allow", "Action": [ "route53:ListHostedZones", "route53:GetChange" ], "Resource": [ "*" ] }, { "Effect" : "Allow", "Action" : [ "route53:ChangeResourceRecordSets" ], "Resource" : [ "arn:aws:route53:::hostedzone/ID!!!!!!!!" ] } ] } |
21行目ではRoute53のホストIDを入れましょう。
- サーバにクレデンシャル追加
■install certbot-dns-route53
・easy_install pi
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 |
# easy_install pi Searching for pi Reading https://pypi.python.org/simple/pi/ Downloading https://files.pythonhosted.org/packages/c5/49/b6bf523a86a63dd364ae0fb6df85645961af166855cf038b361a31d5d504/pi-0.1.2.tar.gz#sha256=8d503a790317f7fbce7469c4160e44b1c76492571b2b0c0596636a1794800f75 Best match: pi 0.1.2 Processing pi-0.1.2.tar.gz Writing /tmp/easy_install-uFzKrJ/pi-0.1.2/setup.cfg Running pi-0.1.2/setup.py -q bdist_egg --dist-dir /tmp/easy_install-uFzKrJ/pi-0.1.2/egg-dist-tmp-uDZ3_p zip_safe flag not set; analyzing archive contents... pi.cli: module references __path__ creating /usr/local/lib/python2.7/site-packages/pi-0.1.2-py2.7.egg Extracting pi-0.1.2-py2.7.egg to /usr/local/lib/python2.7/site-packages Adding pi 0.1.2 to easy-install.pth file Installing pi script to /usr/local/bin Installing easy_uninstall script to /usr/local/bin Installed /usr/local/lib/python2.7/site-packages/pi-0.1.2-py2.7.egg Processing dependencies for pi Finished processing dependencies for pi |
・pip upgrade
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 |
# cp /usr/local/bin/pip /usr/sbin/ # which pip /usr/sbin/pip # easy_install --upgrade pip Searching for pip Reading https://pypi.python.org/simple/pip/ Best match: pip 10.0.1 Processing pip-10.0.1-py2.7.egg pip 10.0.1 is already the active version in easy-install.pth Installing pip script to /usr/local/bin Installing pip2.7 script to /usr/local/bin Installing pip2 script to /usr/local/bin Using /usr/local/lib/python2.7/site-packages/pip-10.0.1-py2.7.egg Processing dependencies for pip Finished processing dependencies for pip |
・pip install certbot-dns-route53
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 |
# pip install certbot-dns-route53 Collecting certbot-dns-route53 Using cached https://files.pythonhosted.org/packages/57/1d/8aa46ffff66315312199a2b93ff1bf9bed4f5f79f7e8426cf3a7be3913c0/certbot_dns_route53-0.24.0-py2.py3-none-any.whl Collecting acme>=0.21.1 (from certbot-dns-route53) Using cached https://files.pythonhosted.org/packages/07/b1/7eeec0282118464fef85bc5b9fc279d62a7d924ae0a753d773cf818d73af/acme-0.24.0-py2.py3-none-any.whl Collecting boto3 (from certbot-dns-route53) Using cached https://files.pythonhosted.org/packages/65/c8/543a86e5e5cb91ab735a1926a1b5902b6b245998c1e83f04f13abbd2dd3a/boto3-1.7.21-py2.py3-none-any.whl Requirement already satisfied: mock in /usr/local/lib/python2.7/site-packages (from certbot-dns-route53) (2.0.0) Collecting zope.interface (from certbot-dns-route53) Using cached https://files.pythonhosted.org/packages/ac/8a/657532df378c2cd2a1fe6b12be3b4097521570769d4852ec02c24bd3594e/zope.interface-4.5.0.tar.gz Requirement already satisfied: setuptools in /usr/lib/python2.7/dist-packages (from certbot-dns-route53) (36.2.7) Collecting certbot>=0.21.1 (from certbot-dns-route53) Using cached https://files.pythonhosted.org/packages/8d/8c/c42769847918cf2854e4193f7c3d07e8e451880a7ea36a62e0d2b574e716/certbot-0.24.0-py2.py3-none-any.whl Requirement already satisfied: six>=1.9.0 in /usr/local/lib/python2.7/site-packages (from acme>=0.21.1->certbot-dns-route53) (1.11.0) Requirement already satisfied: pyrfc3339 in /usr/local/lib64/python2.7/site-packages (from acme>=0.21.1->certbot-dns-route53) (1.0) Requirement already satisfied: pytz in /usr/local/lib/python2.7/site-packages (from acme>=0.21.1->certbot-dns-route53) (2018.4) Requirement already satisfied: cryptography>=0.8 in /usr/local/lib64/python2.7/site-packages (from acme>=0.21.1->certbot-dns-route53) (2.2.2) Collecting requests[security]>=2.4.1 (from acme>=0.21.1->certbot-dns-route53) Using cached https://files.pythonhosted.org/packages/49/df/50aa1999ab9bde74656c2919d9c0c085fd2b3775fd3eca826012bef76d8c/requests-2.18.4-py2.py3-none-any.whl Collecting josepy>=1.0.0 (from acme>=0.21.1->certbot-dns-route53) Using cached https://files.pythonhosted.org/packages/23/46/30ac29742b03be92e05d1fd9048df6f0902bb0b3b042a7ea76a2b3c30f7e/josepy-1.1.0-py2.py3-none-any.whl Collecting PyOpenSSL>=0.13 (from acme>=0.21.1->certbot-dns-route53) Using cached https://files.pythonhosted.org/packages/79/db/7c0cfe4aa8341a5fab4638952520d8db6ab85ff84505e12c00ea311c3516/pyOpenSSL-17.5.0-py2.py3-none-any.whl Requirement already satisfied: jmespath<1.0.0,>=0.7.1 in /usr/lib/python2.7/dist-packages (from boto3->certbot-dns-route53) (0.9.2) Collecting botocore<1.11.0,>=1.10.21 (from boto3->certbot-dns-route53) Using cached https://files.pythonhosted.org/packages/be/02/c225b57b9b775f9d70d5b70a6d950cdd7e3dd0ee7b0a6c8a322c90732f9d/botocore-1.10.21-py2.py3-none-any.whl Collecting s3transfer<0.2.0,>=0.1.10 (from boto3->certbot-dns-route53) Using cached https://files.pythonhosted.org/packages/d7/14/2a0004d487464d120c9fb85313a75cd3d71a7506955be458eebfe19a6b1d/s3transfer-0.1.13-py2.py3-none-any.whl Requirement already satisfied: funcsigs>=1; python_version < "3.3" in /usr/local/lib/python2.7/site-packages (from mock->certbot-dns-route53) (1.0.2) Requirement already satisfied: pbr>=0.11 in /usr/local/lib/python2.7/site-packages (from mock->certbot-dns-route53) (4.0.3) Collecting zope.component (from certbot>=0.21.1->certbot-dns-route53) Using cached https://files.pythonhosted.org/packages/b6/e8/6eb8e2c6e856fb9bfe842afe01695da53d046fd5ddee358cde24d8aab31f/zope.component-4.4.1-py2.py3-none-any.whl Collecting parsedatetime>=1.3 (from certbot>=0.21.1->certbot-dns-route53) Using cached https://files.pythonhosted.org/packages/1d/48/ac8d4c6239437592852e951bcb9438dc585f80c29777c391aef69c67dc79/parsedatetime-2.4-py2-none-any.whl Requirement already satisfied: configobj in /usr/lib/python2.7/dist-packages (from certbot>=0.21.1->certbot-dns-route53) (4.7.2) Collecting ConfigArgParse>=0.9.3 (from certbot>=0.21.1->certbot-dns-route53) Using cached https://files.pythonhosted.org/packages/77/61/ae928ce6ab85d4479ea198488cf5ffa371bd4ece2030c0ee85ff668deac5/ConfigArgParse-0.13.0.tar.gz Requirement already satisfied: asn1crypto>=0.21.0 in /usr/local/lib/python2.7/site-packages (from cryptography>=0.8->acme>=0.21.1->certbot-dns-route53) (0.24.0) Requirement already satisfied: enum34; python_version < "3" in /usr/local/lib/python2.7/site-packages (from cryptography>=0.8->acme>=0.21.1->certbot-dns-route53) (1.1.6) Requirement already satisfied: cffi>=1.7; platform_python_implementation != "PyPy" in /usr/local/lib64/python2.7/site-packages (from cryptography>=0.8->acme>=0.21.1->certbot-dns-route53) (1.11.5) Requirement already satisfied: ipaddress; python_version < "3" in /usr/local/lib/python2.7/site-packages (from cryptography>=0.8->acme>=0.21.1->certbot-dns-route53) (1.0.22) Requirement already satisfied: idna>=2.1 in /usr/local/lib/python2.7/site-packages (from cryptography>=0.8->acme>=0.21.1->certbot-dns-route53) (2.6) Requirement already satisfied: urllib3<1.23,>=1.21.1 in /usr/local/lib/python2.7/site-packages (from requests[security]>=2.4.1->acme>=0.21.1->certbot-dns-route53) (1.22) Requirement already satisfied: certifi>=2017.4.17 in /usr/local/lib/python2.7/site-packages (from requests[security]>=2.4.1->acme>=0.21.1->certbot-dns-route53) (2018.4.16) Collecting chardet<3.1.0,>=3.0.2 (from requests[security]>=2.4.1->acme>=0.21.1->certbot-dns-route53) Using cached https://files.pythonhosted.org/packages/bc/a9/01ffebfb562e4274b6487b4bb1ddec7ca55ec7510b22e4c51f14098443b8/chardet-3.0.4-py2.py3-none-any.whl Requirement already satisfied: docutils>=0.10 in /usr/lib/python2.7/dist-packages (from botocore<1.11.0,>=1.10.21->boto3->certbot-dns-route53) (0.11) Requirement already satisfied: python-dateutil<3.0.0,>=2.1; python_version >= "2.7" in /usr/lib/python2.7/dist-packages (from botocore<1.11.0,>=1.10.21->boto3->certbot-dns-route53) (2.1) Requirement already satisfied: futures<4.0.0,>=2.2.0; python_version == "2.6" or python_version == "2.7" in /usr/lib/python2.7/dist-packages (from s3transfer<0.2.0,>=0.1.10->boto3->certbot-dns-route53) (3.0.3) Collecting zope.event (from zope.component->certbot>=0.21.1->certbot-dns-route53) Using cached https://files.pythonhosted.org/packages/03/62/bb2d843b59f62bac43d071e2d3543ffc63d35fcc515a5796c759b62de49b/zope.event-4.3.0-py2.py3-none-any.whl Collecting future (from parsedatetime>=1.3->certbot>=0.21.1->certbot-dns-route53) Using cached https://files.pythonhosted.org/packages/00/2b/8d082ddfed935f3608cc61140df6dcbf0edea1bc3ab52fb6c29ae3e81e85/future-0.16.0.tar.gz Requirement already satisfied: pycparser in /usr/local/lib/python2.7/site-packages (from cffi>=1.7; platform_python_implementation != "PyPy"->cryptography>=0.8->acme>=0.21.1->certbot-dns-route53) (2.18) awscli 1.14.9 has requirement botocore==1.8.13, but you'll have botocore 1.10.21 which is incompatible. Installing collected packages: chardet, PyOpenSSL, requests, josepy, acme, botocore, s3transfer, boto3, zope.interface, zope.event, zope.component, future, parsedatetime, ConfigArgParse, certbot, certbot-dns-route53 The script chardetect is installed in '/usr/local/bin' which is not on PATH. Consider adding this directory to PATH or, if you prefer to suppress this warning, use --no-warn-script-location. Found existing installation: requests 1.2.3 Uninstalling requests-1.2.3: Successfully uninstalled requests-1.2.3 The script jws is installed in '/usr/local/bin' which is not on PATH. Consider adding this directory to PATH or, if you prefer to suppress this warning, use --no-warn-script-location. Found existing installation: botocore 1.8.13 Uninstalling botocore-1.8.13: Successfully uninstalled botocore-1.8.13 Running setup.py install for zope.interface ... done Running setup.py install for future ... done Running setup.py install for ConfigArgParse ... done The script certbot is installed in '/usr/local/bin' which is not on PATH. Consider adding this directory to PATH or, if you prefer to suppress this warning, use --no-warn-script-location. Successfully installed ConfigArgParse-0.13.0 PyOpenSSL-17.5.0 acme-0.24.0 boto3-1.7.21 botocore-1.10.21 certbot-0.24.0 certbot-dns-route53-0.24.0 chardet-3.0.4 future-0.16.0 josepy-1.1.0 parsedatetime-2.4 requests-2.18.4 s3transfer-0.1.13 zope.component-4.4.1 zope.event-4.3.0 zope.interface-4.5.0 |
ハイパーエラー出た..
chardetがいらないみたいなので抹消!!
|
1 2 3 4 5 6 7 |
>>> import chardet >>> print chardet.__file__ /usr/lib/python2.7/dist-packages/chardet/__init__.pyc >>> quit() constants.py euctwprober.pyc langcyrillicmodel.pyo mbcssm.py # rm -rf /usr/lib/python2.7/dist-packages/chardet |
■certbot force-renew
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 |
# AWS_PROFILE=certbot certbot certonly --dns-route53 --force-renew --rsa-key-size 4096 -d *.adachin.jp --server https://acme-v02.api.letsencrypt.org/directory Saving debug log to /var/log/letsencrypt/letsencrypt.log Credentials found in config file: ~/.aws/config Plugins selected: Authenticator dns-route53, Installer None Renewing an existing certificate /usr/lib/python2.7/dist-packages/josepy/jwa.py:107: CryptographyDeprecationWarning: signer and verifier have been deprecated. Please use sign and verify instead. signer = key.signer(self.padding, self.hash) Performing the following challenges: dns-01 challenge for adachin.jp Starting new HTTPS connection (1): route53.amazonaws.com Waiting for verification... Cleaning up challenges IMPORTANT NOTES: - Congratulations! Your certificate and chain have been saved at: /etc/letsencrypt/live/adachin.jp/fullchain.pem Your key file has been saved at: /etc/letsencrypt/live/adachin.jp/privkey.pem Your cert will expire on 2018-09-10. To obtain a new or tweaked version of this certificate in the future, simply run certbot again. To non-interactively renew *all* of your certificates, run "certbot renew" - If you like Certbot, please consider supporting our work by: Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate Donating to EFF: https://eff.org/donate-le |
■まとめ
このプラグインでRoute53の設定全て消えるんじゃないかとビビりましたが、特に何もなく更新できました。というよりも、更新というよりrenewコマンドでいつでも再取得可能なので、一ヶ月に1回cronで回せば問題なさそうですね。
参考
https://marvelworks.org/archives/233
0件のコメント