digicert/dnstrust-constellix-certbot

Constellix certbot

certbot-dns-constellix Documentation

The certbot-dns-constellix plugin is used to automate the process of a dns-01 challenge in Certbot to allow the requesting and renewal of SSL certificates through the Constellix DNS API.

This is done through the process of adding and removing TXT records to the appropriate domain in your Constellix DNS account.

There are two different methods of installing, configuring and using the plugin depending on if you're using certbot installed through snapd or through your operating system's package manager.

Certbot Installed using Snapd

If you installed certbot using snapd, do the following to install and configure the plugin:

Installation

Run the following commands to install the plugin with snapd.

sudo snap install certbot-dns-constellix
sudo snap set certbot trust-plugin-with-root=ok
sudo snap connect certbot:plugin certbot-dns-constellix

Verify that the plugin is installed by running certbot plugins. You should see the dns-constellix plugin in the list.

Configuration

The plugin requires an API key and secret key for the Constellix DNS API. The key will need to have permissions to add and remove records on the domain you want to issue certificates for.

These will need to be added to a file, eg. constellix.ini in the following format:

dns_constellix_apikey=5fb4e76f-ac91-43e5-f982458bc595
dns_constellix_secretkey=47d99fd0-32e7-4e07-85b46d08e70b
dns_constellix_endpoint=https://api.dns.constellix.com/v1

Caution

You should secure this file from any unauthorised access. Anyone with access to these credentials and this file will be able to add and remove records from your domain. You should configure the file to not be readable by any other users on the system

Usage

Once the plugin is installed and configured it can be used by specifying the plugin in the certbot command and the location of the credentials file.

certbot certonly \
    --authenticator=dns-constellix \
    --dns-constellix-credentials=~./constellix.ini \
    -d example.com

For more options please check the certbot documentation.

Certbot Installed using OS Package Manager/Python

If you installed certbot using your operating system's package manager (apt, yum, etc.) or directly with Python, you can install it using these instructions.

Installation

Run the following commands to install the plugin using pip.

sudo python3 -m pip install certbot-dns-constellix

Verify that the plugin is installed by running certbot plugins. You should see the dns-constellix plugin in the list.

Configuration

The plugin requires an API key and secret key for the Constellix DNS API. The key will need to have permissions to add and remove records on the domain you want to issue certificates for.

These will need to be added to a file, eg. constellix.ini in the following format:

certbot-dns-constellix:dns_constellix_apikey=5fb4e76f-ac91-43e5-f982458bc595
certbot-dns-constellix:dns_constellix_secretkey=47d99fd0-32e7-4e07-85b46d08e70b
certbot-dns-constellix:dns_constellix_endpoint=https://api.dns.constellix.com/v1

The extra certbot-dns-constellix: is required due to how older versions of Certbot load plugins.

Caution

You should secure this file from any unauthorised access. Anyone with access to these credentials and this file will be able to add and remove records from your domain. You should configure the file to not be readable by any other users on the system

Usage

Once the plugin is installed and configured it can be used by specifying the plugin in the certbot command and the location of the credentials file.

certbot certonly \
    --authenticator=certbot-dns-constellix:dns-constellix \
    --certbot-dns-constellix:dns-constellix-credentials=~./constellix.ini \
    -d example.com

The extra certbot-dns-constellix: is required due to how older versions of Certbot load plugins.

For more options please check the certbot documentation.

License

Copyright 2020 Constellix, a division of Tiggee LLC.

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.

You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

See the License for the specific language governing permissions and limitations under the License.

dnstrust-constellix-certbot's Issues

TypeError: 'type' object is not iterable (in zope/interface/declarations.py)

Hi, I'm trying to use this plugin but facing the following error with any certbot command as soons as I enable it:

> sudo certbot plugins
An unexpected error occurred:
TypeError: 'type' object is not iterable
Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /tmp/certbot-log-e_s5tyou/log or re-run Certbot with -v for more details.

The stacktrace from the tmp log file is the following:

2023-04-04 08:10:34,605:DEBUG:urllib3.connectionpool:http://localhost:None "GET /v2/connections?snap=certbot&interface=content HTTP/1.1" 200 None
2023-04-04 08:10:35,279:DEBUG:certbot._internal.log:Exiting abnormally:
Traceback (most recent call last):
  File "/snap/certbot/2836/bin/certbot", line 8, in <module>
    sys.exit(main())
  File "/snap/certbot/2836/lib/python3.8/site-packages/certbot/main.py", line 19, in main
    return internal_main.main(cli_args)
  File "/snap/certbot/2836/lib/python3.8/site-packages/certbot/_internal/main.py", line 1835, in main
    plugins = plugins_disco.PluginsRegistry.find_all()
  File "/snap/certbot/2836/lib/python3.8/site-packages/certbot/_internal/plugins/disco.py", line 192, in find_all
    cls._load_entry_point(entry_point, plugins)
  File "/snap/certbot/2836/lib/python3.8/site-packages/certbot/_internal/plugins/disco.py", line 199, in _load_entry_point
    plugin_ep = PluginEntryPoint(entry_point)
  File "/snap/certbot/2836/lib/python3.8/site-packages/certbot/_internal/plugins/disco.py", line 40, in __init__
    self.plugin_cls: Type[interfaces.Plugin] = entry_point.load()
  File "/snap/certbot/2836/lib/python3.8/site-packages/pkg_resources/__init__.py", line 2468, in load
    return self.resolve()
  File "/snap/certbot/2836/lib/python3.8/site-packages/pkg_resources/__init__.py", line 2474, in resolve
    module = __import__(self.module_name, fromlist=['__name__'], level=0)
  File "/snap/certbot-dns-constellix/current/lib/python3.8/site-packages/certbot_dns_constellix/dns_constellix.py", line 21, in <module>
    class Authenticator(dns_common.DNSAuthenticator):
  File "/snap/certbot-dns-constellix/current/lib/python3.8/site-packages/zope/interface/declarations.py", line 994, in __call__
    directlyProvides(ob, *self.interfaces)
  File "/snap/certbot-dns-constellix/current/lib/python3.8/site-packages/zope/interface/declarations.py", line 816, in directlyProvides
    interfaces = _normalizeargs(interfaces)
  File "/snap/certbot-dns-constellix/current/lib/python3.8/site-packages/zope/interface/declarations.py", line 1170, in _normalizeargs
    _normalizeargs(v, output)
  File "/snap/certbot-dns-constellix/current/lib/python3.8/site-packages/zope/interface/declarations.py", line 1169, in _normalizeargs
    for v in sequence:
TypeError: 'type' object is not iterable
2023-04-04 08:10:35,279:ERROR:certbot._internal.log:An unexpected error occurred:
2023-04-04 08:10:35,280:ERROR:certbot._internal.log:TypeError: 'type' object is not iterable

I installed the plugin this way:

sudo snap set certbot trust-plugin-with-root=ok
sudo snap install certbot-dns-constellix
sudo snap connect certbot:plugin certbot-dns-constellix

I'm not sure what to do with this error but I know it comes from the constellix plugin (we can see it in the stacktrace and of my installation was working previously with the DME plugin). I'm running python 3.10.6 on Ubuntu Server 22.04.1 LTS.

Any help appreciated :)