certbot-dns-alibabacloud 0.1.0b1

Installation

pip install certbot-dns-alibabacloud

Named Arguments

Credentials

You need to provide a credentials file containing your Alibaba Cloud AccessKey to Certbot so that it can communicate with Alibaba Cloud and complete the DNS-01 domain validation on your behalf. The Access Key can be created through the Alibaba Cloud RAM (Resource Access Management) console.

An example credentials file is shown below:

# Alibaba Cloud API credentials used by Certbot
dns_alibabacloud_access_key_id = LTAI5txxxxxxxxxxxxxxxxxx
dns_alibabacloud_access_key_secret = yyyyyyyyyyyyyyyyyyyyyyyyyyyyyy

To manage the DNS records required for the challenge, the plugin first needs to locate the corresponding managed domain in Alibaba Cloud DNS for the requested certificate domain name.

The Access Key must have permission to list managed domains in Alibaba Cloud DNS, create and delete DNS records, and query existing records for challenge cleanup after the validation completes:

• alidns:DescribeDomains

• alidns:AddDomainRecord

• alidns:DeleteDomainRecord

• alidns:DescribeDomainRecords

Here is an example RAM policy that follows the Principle of Least Privilege:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "alidns:DescribeDomains",
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "alidns:AddDomainRecord",
        "alidns:DeleteDomainRecord",
        "alidns:DescribeDomainRecords"
      ],
      "Resource": "acs:alidns:*:*:domain/YOUR-DOMAIN-NAME.COM"
    }
  ]
}

Examples

To acquire a certificate for example.com:

certbot certonly \
  --authenticator dns-alibabacloud \
  --dns-alibabacloud-credentials ~/.secrets/certbot/alibabacloud.ini \
  -d example.com

To acquire a single certificate for both example.com and www.example.com:

certbot certonly \
  --authenticator dns-alibabacloud \
  --dns-alibabacloud-credentials ~/.secrets/certbot/alibabacloud.ini \
  -d example.com \
  -d www.example.com

To acquire a certificate for example.com, waiting 60 seconds for DNS propagation:

certbot certonly \
  --authenticator dns-alibabacloud \
  --dns-alibabacloud-credentials ~/.secrets/certbot/alibabacloud.ini \
  --dns-alibabacloud-propagation-seconds 60 \
  -d example.com