Certbot DNS plugin

This plugin uses certbot's dns-01 challenge to create and delete TXT records on a Wedos domain server, thanks to the API interface called WAPI provided by Wedos. With this plugin, you can issue wildcard SSL/TLS certificates.

Installation

Prerequisites

The following software is required to use this plugin.

Note that in theory, even older versions should work, but it has not been tested.

WAPI

You will also need to have WAPI activated for communication between Wedos and the plugin. To activate WAPI, you can read the article from Wedos, available at this link WAPI activation and settings.

CAUTION: Please note that the IP address of the server where running Certbot must be whitelisted in WAPI, otherwise it will not work.

Installation methods

With snap (recommended)

sudo snap install certbot-dns-wedos
sudo snap set certbot trust-plugin-with-root=ok
sudo snap connect certbot:plugin certbot-dns-wedos

With pip

sudo pip install certbot-dns-wedos

From source

git clone https://github.com/clazzor/certbot-dns-wedos.git
sudo pip install ./certbot-dns-wedos

After installation, the cloned repository can be deleted.

rm -r certbot-dns-wedos

Setup

Arguments

The default value of propagation-seconds is 450. If there is a problem with validation, increase the number. The lower limit is 300.

Command example

The basic structure of the command is the same as with all other certbot plugins, we define which plugin to use, propagation-seconds, credentials file and domains, like this:

certbot certonly \
--authenticator dns-wedos \
--dns-wedos-propagation-seconds 450 \
--dns-wedos-credentials /path/to/the/file.ini \
-d example.com -d *.example.com

Credentials file

This is what the credentials file for the wedos plugin should look like.

dns_wedos_user=user@example.com
dns_wedos_auth=examplepassword

• Values are written after an equals sign =. For values with spaces, such as hello world, a space can be used.
• For the ini file you should apply permission: chmod 600 file.ini for security reasons.

Reloading certificates on services

Usually services like haproxy, nginx, apache and more need to reload to retrieve a new certificate. The --deploy-hook is used for this purpose.

Example

certbot certonly \
--authenticator dns-wedos \
--dns-wedos-propagation-seconds 450 \
--dns-wedos-credentials /path/to/the/file.ini \
-d example.com -d *.example.com \
--deploy-hook "COMMAND_TO_RELOAD_SERVICE"

Nginx

--deploy-hook "systemctl reload nginx"

Apache

--deploy-hook "systemctl reload apache2"

HAProxy

HAProxy requires the certificate and private key to be joined into a single .pem file:

--deploy-hook "cat /etc/letsencrypt/live/example.com/fullchain.pem /etc/letsencrypt/live/example.com/privkey.pem > /etc/haproxy/certs/combined.pem && systemctl reload haproxy"

Errors

If an error occurs, Certbot will display the type of error that has occurred.

• If you get this error "Certbot failed to authenticate some domains (authenticator: dns-wedos)", increase the value in the --dns-wedos-propagation-seconds argument.
• Standard HTTP error codes are returned in case of communication issues with the WAPI endpoint.
• If it is an error related to communication between the plugin and WAPI, you will receive a WAPI return code.

Used Modules/Libraries

The following modules and libraries are used by this plugin (useful for debugging purposes):