This is an old revision of the document!
Table of Contents
ACME DNS
- service-urls:
- http://https://acmedns.hamburg.ccc.de
- host-fqdn:
- acmedns.hosts.hamburg.ccc.de
- netbox-link:
- http://https://netbox.hamburg.ccc.de/virtualization/virtual-machines/85/
- server:
- servername
- maintainer:
- stb
- ccchh-id-integration:
- false
Description
acme-dns is a specialized name server that can be used to implent the ACME DNS-01 challenge.
We run an instance of acme-dns so we can more easily create Let's Encrypt certificates for hosts, in particular those that are not accessible from the Internet, and thus can't use the HTTP-01 challenge.
Configuration
See the Ansible repo. We are using [[https://github.com/oauth2-proxy/oauth2-proxy|oauth2-proxy|| to limit access to the register API endpoint to users that can log in through our Keycloak.
Using ACME-DNS
To enable requesting Let's Encrypt certificates with acme-dns, you need to register a record in acme-dns, then you need to configure your DNS entry so it points to the acme-dns zone (and thus the acme-dns name server), and finally you need to configure your ACME client to issue the certificate.
Register an Entry in ACME DNS
Go to https://acmedns.hamburg.ccc.de, log in if necessary, and click Register. A table will be shown with four parameters that you will need. This information is only shown once, so make sure to save or copy it straight away.
* Full Domain: is the target of the CNAME entry you need to create * Subdomain, X-Api-User and X-Api-Key: configuration for the ACME client.