DNS-01 va certbot bilan wildcard sertifikatlar

DNS-01 tekshiruvi domenni boshqarishingizni veb-sahifa o'rniga TXT yozuvi orqali isbotlaydi. Bu wildcard sertifikat olishning yagona usuli bo'lib, internetdan kirib bo'lmaydigan serverlar uchun ham ishlaydi. Ushbu hook certbot'ga bu yozuvni NameOcean API orqali e'lon qilish imkonini beradi.

NameOcean o'zi NameOcean DNS'dagi har qanday domen uchun bepul wildcard sertifikat beradi, uni yangilaydi va sizga yuklab olish havolasini taqdim etadi (SSL yoki POST /ssl/example.com). Serveringiz sertifikatni o'zi olishi va yangilashi kerak bo'lsa, ushbu qo'llanmadan foydalaning.

Sizga nima kerak

Domen DNS'i NameOcean'da bo'lishi kerak (nameserverlar ns1.nameocean.net dan ns4.nameocean.net gacha).
Serverda certbot, dig (dnsutils yoki bind-utils) va nameocean CLI o'rnatilgan bo'lishi kerak.
dns:read va dns:write ruxsatlariga ega API kaliti. Iloji bo'lsa, uni serverning IP manzili bilan cheklang.

1. Hook'ni o'rnatish

root@server

# curl -fsSL https://nameocean.net/install.sh | sh
# curl -fsSL https://nameocean.net/developers/guides/letsencrypt-dns-01/nameocean-hook.sh \
    -o /etc/letsencrypt/nameocean-hook.sh
# chmod 700 /etc/letsencrypt/nameocean-hook.sh
# echo 'NAMEOCEAN_API_KEY=no_live_…' > /etc/letsencrypt/nameocean.env
# chmod 600 /etc/letsencrypt/nameocean.env

Kalit faqat root o'qiy oladigan faylda saqlanadi; certbot saqlaydigan yangilash sozlamalarida u hech qachon bo'lmaydi.

2. Sertifikatni olish

root@server

# certbot certonly --manual --preferred-challenges dns \
    --manual-auth-hook "/etc/letsencrypt/nameocean-hook.sh auth" \
    --manual-cleanup-hook "/etc/letsencrypt/nameocean-hook.sh cleanup" \
    -d example.com -d "*.example.com"

Hook har bir nom uchun u tegishli bo'lgan zonani NameOcean zonalaringiz orasidan topadi, _acme-challenge ni TXT yozuvi sifatida qo'shadi va to'rtala nameserver ham uni qaytarguncha kutadi, odatda o'n soniya ichida. Tekshiruvdan so'ng tozalash bosqichi aynan o'zi qo'shgan yozuvni o'chiradi. example.com va *.example.com ikkalasi ham _acme-challenge.example.com dan foydalanadi; ikkala qiymat yonma-yon e'lon qilinadi.

3. Yangilashlar

certbot hook'larni sertifikat bilan birga saqlaydi, shuning uchun uning taymeri sertifikatni xuddi shu usulda yangilaydi. Buni bir marta sinab ko'ring:

root@server

# certbot renew --dry-run

Hook qo'shgan va o'chirgan har bir yozuv buni bajargan kalit bilan birga Boshqaruv paneli → Faoliyat bo'limida ko'rinadi hamda dns.record.created va dns.record.deleted webhook hodisalarini yuboradi.

Hook

Uni root sifatida ishga tushirishdan oldin o'qib chiqing. U faqat nameocean CLI va dig'ni chaqiradi.

/etc/letsencrypt/nameocean-hook.sh

#!/bin/sh
# certbot DNS-01 hooks for NameOcean DNS:
#   --manual-auth-hook "/etc/letsencrypt/nameocean-hook.sh auth"
#   --manual-cleanup-hook "/etc/letsencrypt/nameocean-hook.sh cleanup"
# Needs the nameocean CLI and an API key with dns:write, in /etc/letsencrypt/nameocean.env:
#   NAMEOCEAN_API_KEY=no_live_...
set -e
[ -f /etc/letsencrypt/nameocean.env ] && . /etc/letsencrypt/nameocean.env && export NAMEOCEAN_API_KEY

# the zone CERTBOT_DOMAIN is in: the longest of your zones it ends with
zone="$NAMEOCEAN_ZONE"
if [ -z "$zone" ]; then
  for z in $(nameocean dns ls --json | sed -n 's/.*"name": *"\([^"]*\)".*/\1/p'); do
    case "$CERTBOT_DOMAIN" in "$z" | *".$z") [ ${#z} -gt ${#zone} ] && zone="$z" ;; esac
  done
fi
[ -n "$zone" ] || { echo "no NameOcean DNS zone for $CERTBOT_DOMAIN" >&2; exit 1; }
name="_acme-challenge"
[ "$CERTBOT_DOMAIN" = "$zone" ] || name="_acme-challenge.${CERTBOT_DOMAIN%.$zone}"

case "$1" in
auth)
  id=$(nameocean dns add "$zone" TXT "$name" "$CERTBOT_VALIDATION" --ttl 5m --json \
    | sed -n 's/.*"id": *\([0-9][0-9]*\).*/\1/p' | head -n 1)
  [ -n "$id" ] || { echo "could not add the TXT record" >&2; exit 1; }
  echo "$id" # certbot passes this to the cleanup hook as CERTBOT_AUTH_OUTPUT
  # wait until all four nameservers answer with it (usually a few seconds)
  for i in $(seq 1 60); do
    n=0
    for ns in ns1 ns2 ns3 ns4; do
      dig +short TXT "$name.$zone" "@$ns.nameocean.net" | grep -q -- "$CERTBOT_VALIDATION" && n=$((n + 1))
    done
    [ "$n" -eq 4 ] && exit 0
    sleep 2
  done
  echo "the TXT record is not on every nameserver after 2 minutes" >&2
  exit 1
  ;;
cleanup)
  [ -z "$CERTBOT_AUTH_OUTPUT" ] || nameocean dns rm "$zone" TXT "$CERTBOT_AUTH_OUTPUT"
  ;;
*)
  echo "usage: $0 auth|cleanup" >&2
  exit 2
  ;;
esac

CLI'siz

Hook ikkita API so'rovini yuboradi, ularni istalgan ACME mijozi yoki dasturlash tilidan yuborishingiz mumkin:

curl

$ curl -X POST https://nameocean.net/api/v1/dns/example.com/records \
    -H "Authorization: Bearer $NAMEOCEAN_API_KEY" -H "Content-Type: application/json" \
    -d '{"type": "TXT", "hostname": "_acme-challenge", "text": "<validation>", "ttl": "5m"}'
{"id": 4190, "type": "TXT", "hostname": "_acme-challenge", …}
$ curl -X DELETE https://nameocean.net/api/v1/dns/example.com/records/TXT/4190 \
    -H "Authorization: Bearer $NAMEOCEAN_API_KEY"