Tencent Cloud DNS Authenticator plugin for Certbot
Project description
certbot-dns-tencentcloud
This package provides a Certbot authenticator plugin that can complete the DNS-01 challenge using the Tencent Cloud API.
Installation
Only Tested on python 3.8, should work on python 3.7 too.
- no plan to support python2
- dataclasses is used, so python 3.6 and down will not work. However you can try installing
dataclasses
from pypi.
Use pip to install this package:
sudo pip3 install certbot-dns-tencentcloud
Verify the installation with Certbot:
sudo certbot plugins
You should see dns-tencentcloud
in the output.
Usage
To use this plugin, set the authenticator to dns-tencentcloud
via the -a
or --authenticator
flag.
You may also set this using Certbot's configuration file (defaults to /etc/letsencrypt/cli.ini
).
You will also need to provide a credentials file with your Tencent Cloud API key id and secret, like the following:
dns_tencentcloud_secret_id = TENCENT_CLOUD_SECRET_ID
dns_tencentcloud_secret_key = TENCENT_CLOUD_SECRET_KEY
The path to this file can be provided interactively or via the --dns-tencentcloud-credentials
argument.
CAUTION: Protect your API key as you would the password to your account. Anyone with access to this file can make API calls on your behalf. Be sure to read the security tips below.
Arguments
--dns-tencentcloud-credentials
path to Tencent Cloud credentials INI file (Required)--dns-tencentcloud-propagation-seconds
seconds to wait before verifying the DNS record (Default: 10)
NOTE: Due to a limitation in Certbot, these arguments cannot be set via Certbot's configuration file.
Example
certbot certonly \
-a dns-tencentcloud \
--dns-tencentcloud-credentials ~/.secrets/certbot/tencentcloud.ini \
-d example.com
Security Tips
Restrict access of your credentials file to the owner.
You can do this using chmod 600
.
Certbot will emit a warning if the credentials file
can be accessed by other users on your system.
Use a separate key from your account's primary API key. Make a separate user under your account, and limit its access to only allow DNS access and the IP address of the machine(s) that will be using it.
FAQ
- Which strategy should I choose to limit my API key access to only allow DNS resolution related operation?
Response from official team:
感谢反馈。DNS 解析已有 QCloudCNSFullAccess 策略,但需要加白才可使用。后续 DNS 解析会接入 CAM 。
Translation:
DNS reslution now already has QCloudCNSFullAccess strategy, but needs whitelist to be able to use (probably needs ticket?). Later this will be added to CAM (If I understand correctly this means it will be available just like other strategies).
Update:
As of now (2021-06-12) it seems QCloudCNSFullAccess
may not be usable even by opening a ticket, YMMV.
- renew certs for
*.abc.com
andabc.com
sometimes show error about incorrect TXT records.
It seems Let's Encrypt cache TXT records for at most 60 seconds, since DNSPod doesn't seem
to allow setting TXT record's TTL below 60, in this case the best/safest way is to set
--dns-tencentcloud-propagation-seconds
longer than 60.
- Debug mode?
--dns-tencentcloud-debug true
Project details
Release history Release notifications | RSS feed
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Source Distribution
Built Distribution
Hashes for certbot-dns-tencentcloud-1.3.0.tar.gz
Algorithm | Hash digest | |
---|---|---|
SHA256 | 5cb84df07d54e895f874c35fa56d788a207663214cb3aa9a2b47d631ffb0ac85 |
|
MD5 | ae9129f4b519f35e2a6b115ffa0fbe8b |
|
BLAKE2b-256 | ee6b04ddc7d1f3f9d6ef27c4d2633e46dfb156da2666d89e224b5ee53899290f |
Hashes for certbot_dns_tencentcloud-1.3.0-py3-none-any.whl
Algorithm | Hash digest | |
---|---|---|
SHA256 | d6e1ea622de0e0a324b55f0c28f56f3b996774e13328b48ed2cd1216eb4d1a7a |
|
MD5 | 16eaf927dcc4bd175e53e8f63d1e7086 |
|
BLAKE2b-256 | e5914b35908605f1534145eddd83e201941ada01f5254e4daae6555f294d1fe5 |