[TUTO] [Zone publique sur DNS Server] Renouvellement automatisé de certificat wildcard

[.Shad.]

Voilà, mis à jour.

[aozorashinyuu]

Hello,

Here is a really big huge thanks for this script. I have a proposal to extends its capabilities:
 - init method: add bool variable saying whereas the ZONE_NAME is an alias domain or not

ZONE_ALIAS=true # Zone is alias

- certificate_issue method: replace the acme.sh line to handle challenge-alias when the previous variable is set to true

certificate_issue() {

    echo -e "Issueing certificate...\n"

    if [ "$ZONE_ALIAS" = true ];

    then

        ${ACME_DIR}/acme.sh --issue -d ${CERT_DOMAIN} -d ${CERT_WDOMAIN} --challenge-alias ${ZONE_NAME} --dns --yes-I-know-dns-manual-mode-enough-go-ahead-please --server letsencrypt | tee ${CERT_HOME}/${CERT_DOMAIN}/${LOG}

    else

        ${ACME_DIR}/acme.sh --issue -d ${CERT_DOMAIN} -d ${CERT_WDOMAIN}  --dns --yes-I-know-dns-manual-mode-enough-go-ahead-please --server letsencrypt | tee ${CERT_HOME}/${CERT_DOMAIN}/${LOG}

    fi

    mapfile -t array < <(grep -A1 "Domain: '" ${CERT_HOME}/${CERT_DOMAIN}/${LOG} | cut -d"'" -f2 | sed 's/--//g' | sed '/^$/d')

    echo "${array[0]}. 1 IN TXT \"${array[1]}"\" >> ${ZONE}

    echo "${array[2]}. 1 IN TXT \"${array[3]}"\" >> ${ZONE}

    echo -e "\nTXT records are :\n"

    tail -n 2 ${ZONE}

}

- saved_syno_values_removing method: replace prevent a crash by adding some conditions (file does not exists uh?)

saved_syno_values_removing() {

    CERT_CONF=${CERT_HOME}/${CERT_DOMAIN}/${CERT_DOMAIN}.conf

    if [ -f "${CERT_CONF}" ]; then

        sed -E '/^SAVED_SYNO|Le_DeployHook/d' ${CERT_CONF} > ${CERT_CONF}.bkp

    fi

    if [ -f "${CERT_CONF}.bkp" ]; then

        mv ${CERT_CONF}.bkp ${CERT_CONF}

    fi

}

- dns_spread: add a sleep after the changes (30 seconds may be way too much but oh well, the Txt fields would not spread to slave dns zones without this, uh?...). 

dns_spread() {

    echo -e "\nSpreading zone changes to slave DNS servers, please wait 30 seconds...\n"

    SERIAL=$(sed -n '/SOA/{n;p}' $ZONE)

    INCR_SERIAL=$((SERIAL+1))

    sed "s/${SERIAL}/\t${INCR_SERIAL}/" ${ZONE} > ${ZONE_TEMP}

    mv ${ZONE_TEMP} ${ZONE}

    sleep 30

}

WIth theses changes i only expose online a slave synology dns zone from a syno router and i removed all encountered bugs. 🙂

[.Shad.]

@aozorashinyuu I didn't expect anytone to use this script one day besides @Jeff777 😄 

I'll try to incorporate the changes you mentionned as soon as I can, thanks for your input. 🙂 

[Jeff777]

Le 24/11/2022 à 04:07, aozorashinyuu a dit :

WIth theses changes i only expose online a slave synology dns zone from a syno router and i removed all encountered bugs.

Brillant ! I will test the new script as soon as @.Shad. implement the changes 😉. Next review is mid january.

Modifié le 3 octobre 2023 par Jeff777

[Jeff777]

@.Shad. J'ai finalement fait la modif. et ça marche toujours aussi bien !

[.Shad.]

@Jeff777 J'avais complètement zappé la modif à intégrer 😄 Tant mieux si tout fonctionne toujours 👌

[Jeff777]

Bonjour à tous,

De retour de congé je constate que mon nouveau certificat Let's Encrypt est notifié : "émis par  R10" (R3 précédemment).

Qu'est-ce que cela signifie ?

 

[Mic13710]

Tu vas chercher des trucs toi !

R3 est l'ancien intermédiaire RSA.

Extrait de la version française du site LE du 02/10/2021 :

Let’s Encrypt R3 (RSA 2048, O = Let's Encrypt, CN = R3)

• Signé par ISRG Root X1 : der, pem, txt
• Contre-signé par IdenTrust : der, pem, txt (retiré)

R10 est le nouvel intermédiaire depuis le mois de juin semble t'il.

Extrait de la version anglaise du site LE du 11/06/2024 :

• Let’s Encrypt R10
  • Subject: O = Let's Encrypt, CN = R10
  • Key type: RSA 2048
  • Validity: until 2027-03-12
  • CA details: crt.sh, issued certs
  • Certificate details (signed by ISRG Root X1): der, pem, txt

La version française n'a pas encore été mise à jour ce qui permet de retrouver le R3.

A mon avis, c'est la même chose pareil 😉