How to Setup Auto-Renew for Letsencrypt WILDCARD Certificate with DNS challenge? acme-dns | certbot

[@AntonPutra]

🔴 - To support my channel, I’d like to offer Mentorship/On-the-Job Support/Consulting - [e-mail]

[@TimmyNET]

Dude your videos are some of the best on KZbin.

[@AntonPutra]

Thanks, I'm gonna keep iterating hopefully twice a week :)

[@AntonPutra]

👉 How to Manage Secrets in Terraform - kzbin.info/www/bejne/aX-TpXqBrNt1mqM 👉 Terraform Tips & Tricks - kzbin.info/www/bejne/bYScZaKLid5lsJY 👉 ArgoCD Tutorial - kzbin.info/www/bejne/sHjRlZqafMZkisU

[@TonyCastiglia]

Nice guide, you are the best because it is easy, fast, understandable, detailed.

[@AntonPutra]

thank you!

[@alexanderaric4006]

Видео класс, все работает, спасибо Антон. С меня пару-тройку кофе

[@AntonPutra]

Spasibo Alexander!

[@OZTutoh]

Great video! I wish there was another cloud service out there that offered elastic IPs other than Amazon. They seem to have the lion's share of everything.

[@pberto]

Thanks for this video, Anton. I didn't undestand how can you bind acme-dns server on port 53, considering it is already used by systemd-resolve. If I shutdown systemd-resolve, do you thin I will be able to continue using the VPS normally?

[@alanadiprastyo866]

Awesome 👍

[@AntonPutra]

Thanks 🤗

[@msp767]

This is a great tutorial, thanks. Question: if you have multiple servers running on separate subdomains of the domain, how can they share the wildcard certificate?

[@AntonPutra]

Thanks, well you can allocate/create a server where you would setup a acme-dns server. It doesn't have to be located on the same host where you have you webserver (e.g nginx). In case you have multiple webservers (e.g. you need to scale horizontally) just obtain a certificate and then copy it with "scp" to all targets, just distribute that certificate amount all the webservers.

[@agenttank]

@@AntonPutra i thought automation is the only viable option

[@Serpher1]

I created CNAME, registered and made certificates but on renew I get DNS timeout. Why? Acme-dns makes TXT record and acme-dns-client sees my subdomains.

[@AntonPutra]

Can you resolve CNAME outside of that instance? Where do you get timeout?

[@quynhcherryvlogs8544]

Thank you for great video. I have followed all step and success to create, validate certs. but seem I have issue with that. my chrome said that invalid ssl. any suggestion ? thank you in advance.

[@sheryfsays]

Hello Putra, Thanks for the very good video; but i've not been able to successfully replicate it. I've setup an instance on oci with a public ip,. I assigned a network security group with ingress ports opened. I created a domain on Google domains and tried other registrars for other domains. Updated the config.cfg Problem: dig domain times out, no servers could be reached. Any thoughts kindly assist and thanks in advance

[@AntonPutra]

Sorry, it's been a while. Check firewalls and make sure the service is running

[@sheryfsays]

@@AntonPutra thanks that worked, I had to install firewalld and open up the ports. only the network security groups configuration wasn't sufficient

[@AntonPutra]

@@sheryfsays glad to hear that

[@StartNight-df3sv]

Always your tutorails are ultimate. On this steps I have a doubt. You create AWS server for acme-dns server. Which is really confusing to people like me who doesn't familiar with AWS at all. Can we create acme-dns server inside my DigitalOcean/OVH VPS and run Auto-Renew WILDCARD domain on godday ? Is yes, can you please share the some releated links for low cost VPS ?

[@AntonPutra]

Thanks for the feedback. The problem with wildcard certificates is that only the DNS-01 challenge is supported. This is a very generic tutorial, so in your case, I would suggest using the cert-bot GoDaddy plugin to automate certificate issuance. Here is a link: github.com/miigotu/certbot-dns-godaddy.

[@StartNight-df3sv]

@@AntonPutra Thanks for your response. I think that script needs GoDaddy api key, which GoDaddy stop recently.

[@AntonPutra]

@@StartNight-df3sv I see. Well, the idea is to try to use host provider-specific plugins to validate the DNS challenge. If that's not possible, you can use this approach and set up a DNS resolver.

[@davidmontdajonc6332]

How do you solve the hole of leaving the port 53 opened? Through Cloudflare only traffic that goes to 443 is allowed if you have the orange cloud activated. So can you use a VPN for that and allow its IP ranges? Or would you use some sort of tunneling?

[@AntonPutra]

Well, it really depends on your set up. Do you have multiple webserver instances? Do you need to scale your workload horizontally? In some cases you should have acme-dns server setup on different machine and distribute those certificates to webservers. Would it be easier in your case just use certbot dns plugin instead of setting up it manually? I don't think VPN will work.. maybe you can just whitelist cloudflare ip ranges

[@davidmontdajonc6332]

​@@AntonPutra In the case of the OVH instance where I installed the acme-dns server it's a single one for a demo, but yes I'll have to scale horizontally, but in this case I'll set up an OVH cert in the load balancer like with the ALB or NLB in AWS so Cloudflare to Load balancer traffic will be end-to-end encrypted and then I'll probably add some basic certbot standalone certs in the origin servers cause I read that even if they're timed out they work. Didn't think of this: "In some cases you should have acme-dns server setup on different machine and distribute those certificates to webservers", maybe I should consider it. One more thing, if I set the acme-dns server to listen on localhost(it works), then the port isn't opened to the outside like the 3306 or 33060 of mysql right? Thank you!

[@AntonPutra]

​ @David O.O Yes, if you bind to the localhost/127.0.0.1 it will be reachable from that machine only. You can test, run "nc -vz localhost 53" from the local host and from outside using the external IP of that machine. If request times out means it is not reachable.

[@davidmontdajonc6332]

@@AntonPutra Cool, thanks Anton!

[@morganharlowe819]

Hi, amazing tutorial. But when I try to access my website, it only works without the https and it still says not secure. DO I have to modify or edit the nginx conf?

[@AntonPutra]

Yes, you need to update nginx conf, provide paths to cert, key and ca

[@unhealthytomato3219]

Hello, amazing video it helped me understand some basic concepts but I wasn't able to implement it succesfully. In status it says that Error in DB upgrade unable to open database file on such file or directory Failed with result 'exit-code' Start request repeated too quickly Any ideas why? Thanks

[@AntonPutra]

You can reset with "systemctl reset-failed " But still, need to resolve the underlining issue.

[@willl0014]

excelent video, my acme-dns-client never find the cname record that i create, any suggestions?

[@AntonPutra]

try to resolve. those records by using "dig "

[@KingTrump2024]

Everytime I see an Letsencrypt cert, I know the user cheap and does not care about security only theatre !

[@jamiuadam1938]

This is really a great tutorial, but i dont know why my configuration is not working, even though my scenario is kind of different, so i already configured a wildcard letsencrypt on the server using one of your former tutorials, so now my letsencrypt period just finished, so i though instead of manually renewing the wildcard letsencrypt why not use this new tutorial to configure an automatic renewal, after following the processes in the tutorial, while trying to test the configuration using dig, it returning error, don't know if you can help, by the way am running the server on digitalocean

[@AntonPutra]

Well, it's hard for me to debug your setup. In general when you obtain a wildcard certificate you need to pass DNS-01 challenge, means every time you need to renew you need to create/update TXT record with a new value provided by letsencrypt. You should be able to use "dig" to query your DNS provider and get TXT.

[@lucas.n]

ugh this background music lol thanks anyway

[@AntonPutra]

no more music lol

[@ZealousSanity]

А можно по-русски? 😸

[@AntonPutra]

someday