1

I have used letsencrypt's certbot for creating certs for my domains. I have to download certbot and run in my machine and it gives a string to be placed in as dns record. I have to manually add the dns record. Then the certbot will verify it and generate my cert. I thought the process was cool compared to previously hectic process of CSR generation, pay the CA, wait for CA etc

But today I setup a GSuite account for one of my sites. I type my domain name and click verify. They automatically add dns record and verify it, I just have to give them permission by clicking ok when my domain registrar asks me whether I allow google to do this.

Why not letsencrypt work that way? Its fast and no manual work

  • "I type my domain name and click verify. They automatically add dns record and verify it, I just have to give them permission by clicking ok when my domain registrar asks me whether I allow google to do this." Which registrar/DNS provider? Providers may, not for technical reasons, be more willing to automate things with "Google" instead of something (Let's Encrypt) that can be deemed to cater only for some specific population. You shouldn't also confuse registrar with DNS providers, those are two different jobs even if they can be done by the same company. – Patrick Mevzek Jul 8 at 17:33
2

If you have to do manual work with certbot, you aren't doing it right. Certbot is designed to be automated. Introducing anything manual into the process isn't a good idea. Having to perform a manual task every 3 months is easy to mess up or forget. At some point your certificate is going to expire and your visitors to your site will get errors.

You don't say where your DNS is hosted, but there are many plugins for certbot that automate the process. I use AWS Route 53 for DNS. I generate an encrypted key pair that allows scripts to add DNS records to be added to my zones. Then I use the dns-route53 certbot plugin to automatically add those records when it runs. I have certbot running in a cron job periodically and I never have to manually do any verification or manually install certificates.

The certbot user guide lists the following plugins for various DNS providers:

  • dns-cloudflare: Obtain certificates using a DNS TXT record (if you are using Cloudflare for DNS).
  • dns-cloudxns: Obtain certificates using a DNS TXT record (if you are using CloudXNS for DNS).
  • dns-digitalocean: Obtain certs using a DNS TXT record (if you are using DigitalOcean for DNS).
  • dns-dnsimple: Obtain certificates using a DNS TXT record (if you are using DNSimple for DNS).
  • dns-dnsmadeeasy: Obtain certificates using a DNS TXT record (if you are using DNS Made Easy for DNS).
  • dns-gehirn: Obtain certificates using a DNS TXT record (if you are using Gehirn Infrastructure Service for DNS).
  • dns-google: Obtain certificates using a DNS TXT record (if you are using Google CloudDNS for DNS).
  • dns-linode: Obtain certs using a DNS TXT record (if you are using Linode for DNS).
  • dns-luadns: Obtain certificates using a DNS TXT record (if you are using LuaDNS for DNS).
  • dns-nsone: Obtain certificates using a DNS TXT record (if you are using NS1 for DNS).
  • dns-ovh: Obtain certificates using a DNS TXT record (if you are using OVH for DNS).
  • dns-rfc2136: Obtain certificates using a DNS TXT record (if you are using BIND for DNS).
  • dns-route53: Obtain certificates using a DNS TXT record (if you are using AWS Route53 for DNS).
  • dns-sakuracloud: Obtain certificates using a DNS TXT record (if you are using Sakura Cloud for DNS).

With certbot and Let's Encrypt I would recommend making the renewal process automatic even if it means:

  • Switching to a DNS provider with a certbot plugin
  • Scripting the DNS records for your own provider
  • Switching to the older HTTP verification method and automating that.
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.