Let's Encrypt startet Wildcard-Zertifikate

Michael · 28. März 2018 um 07:53

Hi.
Daran scheitert es auch hier gerade. Die domain example.org ist vollständig bei uns auf einem vServer verwaltbar.

Ich hatte es bisher via http-01 versucht, was aber nicht für alle Clients in der Domain klappt (s. Parallelthread). Das Verfahren via dns-01 wird zum Beispiel hier beschrieben:

github.com

lukas2511/dehydrated/blob/master/docs/dns-verification.md

### dns-01 challenge

This script also supports the new `dns-01`-type verification. This type of verification requires you to be able to create a specific `TXT` DNS record for each hostname included in the certificate.

You need a hook script that deploys the challenge to your DNS server.

The hook script (indicated in the config file or the `--hook/-k` command line argument) gets four arguments:

$1 an operation name (`clean_challenge`, `deploy_challenge`, `deploy_cert`, `invalid_challenge` or `request_failure`) and some operands for that.
For `deploy_challenge` 

$2 is the domain name for which the certificate is required, 

$3 is a "challenge token" (which is not needed for dns-01), and 

$4 is a token which needs to be inserted in a TXT record for the domain.

Typically, you will need to split the subdomain name in two, the subdomain name and the domain name separately. For example, for "my.example.com", you'll need "my" and "example.com" separately. You then have to prefix "_acme-challenge." before the subdomain name, as in "_acme-challenge.my" and set a TXT record for that on the domain (e.g. "example.com") which has the value supplied in $4

```

This file has been truncated. show original

Dort gibt es auch bereits hooks für diverse Anbieter – allerdings klappte das hier bisher alles nicht wie erhofft. Der allround-Weg scheint via “lexicon” zu laufen. Aber das habe ich mir nicht mehr näher angesehen.

Michael