Certbot DNS-STACKIT Authenticator Plugin

The Certbot DNS-STACKIT Authenticator Plugin facilitates the procurement of SSL/TLS certificates from Let's Encrypt utilizing the DNS-01 challenge methodology in conjunction with STACKIT as the designated DNS service provider. This document elucidates the procedural steps for the installation and operational utilization of this plugin.

Installation

To initialize the Certbot DNS-STACKIT Authenticator Plugin, deploy the following pip command:

pip install certbot-dns-stackit

Usage

Upon successful integration of the plugin, it becomes viable to employ it with Certbot for the retrieval of SSL/TLS certificates. The subsequent section delineates the pertinent arguments and their respective examples:

Arguments

Example

Below is a structured example detailing the application of Certbot in conjunction with the DNS-STACKIT Authenticator Plugin to retrieve a certificate:

certbot certonly \
  --authenticator dns-stackit \
  --dns-stackit-credentials ./credentials.ini \
  --dns-stackit-propagation-seconds 900 \
  --server https://acme-v02.api.letsencrypt.org/directory \
  --agree-tos \
  --rsa-key-size 4096 \
  -d 'example.runs.onstackit.cloud' \
  -d '*.example.runs.onstackit.cloud'

For this example, example.runs.onstackit.cloud represents the designated domain (zone) for certificate procurement.

Example of credentials.ini

To operationalize the plugin, it's imperative to curate a credentials.ini file encompassing your STACKIT DNS credentials:

dns_stackit_auth_token = "your_token_here"
dns_stackit_project_id = "your_project_id_here"

It's crucial to replace "your_token_here" and "your_project_id_here" placeholders with the genuine STACKIT authentication token and project ID. The token's associated service account necessitates project membership privileges for record set creation.

Authentication via STACKIT service account

The service account allows the user to use a long lived authentication which generates short lived tokens. To setup a service account refer to the service account documentation. It's important to also set the --dns-stackit-project-id flag to the corresponding STACKIT project when using a service account.

Test Procedures

• Unit Testing:

  make test
  

• Linting:

  make lint
  

Contribute

See CONTRIBUTING.md