2

I have created and installed a cert for my wildcard domain *.example.com OK using a dns challenge. So far, so good.

Now I want to renew the cert using a cronjob. I will need to use the http challenge because my DNS host has no API mechanism for me to automatically create the TXT record. What I don't understand is how to tell certbot/letsencrypt where my http server is, given the domain is a wildcard that doesn't point to the server where I'm running certbot.

1
  • 1
    Even if your DNS host doesn't have an API, if you're up for it, you could do some reverse engineering of the (web, I'm guessing) interface you'd use to update DNS records, and then just write a certbot plugin to replicate the behavior of the interface. – Eric Reed Oct 22 '20 at 16:44
9

What you wanting is not possible. As per https://letsencrypt.org/docs/faq/#does-let-s-encrypt-issue-wildcard-certificates wildcard certs must be done via a DNS challenge.

This is also restated - along with DNS provider hints at https://letsencrypt.org/docs/challenge-types/

If you think about it this makes sense. To allow otherwise would enable issuing certs where the authority of the requestor is in doubt. (Ie someone who controls the TLD web site would be able to get a wildcard cert for subdomains which they may not be authorised to). On the flip side, someone who controlsndns for the domain automatically has the power to direct subdomains.

2
  • 4
    I'd recommend switching to a DNS host that has an API. Certbot has plugins for a dozen DNS hosts that make the process automatic: certbot.eff.org/docs/using.html?highlight=dns#dns-plugins It is usually possible to switch DNS hosting without changing website hosting. – Stephen Ostermiller Oct 22 '20 at 11:00
  • thanks for the info. I was hoping that certbot could use the fact that it can see the existing cert and private key files as sufficient authorisation to do a renew. – pinoyyid Oct 22 '20 at 15:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.