EasyDNS Wildcard Records
Processing a Letsencrypt Wildcard Certificate renewal at EasyDNS
You will need to create an API token to use with the certbot script we will be creating.
To create the token for EasyDNS, log into the control panel and navigate to…
User > Security
Scroll to the REST API section near the bottom of the page and create a new token.
NOTE: If you do not see the API section, you must first complete and submit the easyAPI Signup Form and request access from the EasyDNS development team.
Secrets INI
Then on the server that will be processing the wildcard certificate create a secrets.ini file.
The ini file should be owned by the root user with permission of 600 ( RW only for the root user ).
The ini file should be created in the following folder…
/etc/letsencrypt/.secrets/yourdomain.ini
The format of the ini file is:
dns_easydns_usertoken = token_name
dns_easydns_userkey = api1234xxx
dns_easydns_endpoint = https://rest.easydns.net
Certbot Shell Script
Next you will create shell script that will attempt to renew the certificate from LetsEncrypt using the certbot program.
If you need to install certbot, the command on Ubuntu is:
sudo apt update
sudo apt install certbot python3-certbot-nginx
The format of the certbot.sh script is (replace username with your user)…
#!/bin/sh
AUTH="dns-easydns"
CREDS="/etc/letsencrypt/.secrets/soupco.ca.ini"
POSTHOOK="systemctl reload nginx"
LOG="/home/username/certs/certbot.log"
DATE=$(date +"%Y-%m-%d")
echo "Certbot attempt on $DATE ." >>$LOG
/usr/bin/certbot renew --authenticator $AUTH --dns-easydns-credentials $CREDS --post-hook "systemctl reload nginx" >>$LOG
Cron Job
You will need to create a cron job which will check if the certificate needs to be renewed. I chose to run at 3:30 am on Monday morning
So, my crontab looks like…
30 3 * * 1 /usr/local/bin/certbot.sh 2>&1
Source
I used a lot of the notes from CertBot-DNS-EasyDNS but, I used a local shell script rather than firing up another Docker container. This felt easier to me because I am using an Nginx server which is installed on my Docker host itself rather than in a Docker container. In a later posting I will also show the simple Nginx config file I use to reverse proxy my various Docker micro-services.
Do not run this script too often
The renewal script should not be run too often as that can be viewed as spamming by the Letsencrypt servers. Once per week should be more than adequate.