From 835980f5d0d1e017bac62a85de85bded55491ba6 Mon Sep 17 00:00:00 2001
From: Fritiof Hedman <mail@fritiofhedman.se>
Date: Tue, 29 Aug 2017 11:44:58 +0000
Subject: [PATCH] initial commit

---
 README.md        | 25 +++++++++++++++++++++++++
 certbot-auth.sh  | 11 +++++++++++
 certbot-clean.sh | 11 +++++++++++
 3 files changed, 47 insertions(+)
 create mode 100644 README.md
 create mode 100755 certbot-auth.sh
 create mode 100755 certbot-clean.sh

diff --git a/README.md b/README.md
new file mode 100644
index 0000000..ef97c3b
--- /dev/null
+++ b/README.md
@@ -0,0 +1,25 @@
+#Using certbot (Let's encrypt) with RFC2136
+
+Some servers are unable to have a web server installed, but can still make use of a certificate (for example, mail servers).
+These scripts automates the authentication and clean up using DNS for validation. 
+
+##Installation
+
+clone this repo, or download the files.
+Update the files with the data necessary, such as zone name, name server and path to your key-file.
+
+Your server needs nsupdate, which at least on debian is in the bind9utils package. You also need to create a keypair that you use for validate that you have the right to update the zone data.
+
+Create your key by using `dnssec-keygen`, for example:
+`$ dnssec-keygen -a HMAC-MD5 -b 512 -n USER keyname`
+This will create to files, a .private, and a .key file. Upload the key file to your DNS administrator, or set up bind as per below. The .private file is, as the name implies, supposed to be private as anyone with that file can update your DNS zone. This is also the file that you should point out by the scripts.
+
+Then, setup certbot;
+```sudo certbot certonly --preferred-challenges=dns --manual --manual-auth-hook /usr/sbin/certbot-auth.sh  --manual-cleanup-hook /usr/sbin/certbot-clean.sh -d yourdomain.tld --manual-public-ip-logging-ok```
+
+It will then verify your domain, and then download the certificate. Afterwards, `sudo certbot renew` will update the certificate. Use a renew hook if you want to do something after renewal, such as reloading postfix, or whatever service that uses the certificates.
+
+##BIND installation
+I'm running BIND on my DNS servers, and followed [this guide] (http://linux.yyz.us/dns/ddns-server.html) to set it up.
+
+
diff --git a/certbot-auth.sh b/certbot-auth.sh
new file mode 100755
index 0000000..44bc86c
--- /dev/null
+++ b/certbot-auth.sh
@@ -0,0 +1,11 @@
+#!/usr/bin/env bash
+set -e
+set -u
+set -o pipefail
+
+NSUPDATE="nsupdate -k /path/to/private"
+DNSSERVER="masterns.yourdomain.tld"
+ZONE="yourzonename.tld"
+TTL=300
+
+printf "server %s\nzone %s.\nupdate add _acme-challenge.%s. %d in TXT \"%s\"\nsend\n" "${DNSSERVER}" "${ZONE}" "${CERTBOT_DOMAIN}" "${TTL}" "${CERTBOT_VALIDATION}" | $NSUPDATE
diff --git a/certbot-clean.sh b/certbot-clean.sh
new file mode 100755
index 0000000..1829581
--- /dev/null
+++ b/certbot-clean.sh
@@ -0,0 +1,11 @@
+#!/usr/bin/env bash
+set -e
+set -u
+set -o pipefail
+
+NSUPDATE="nsupdate -k /path/to/private"
+DNSSERVER="masterns.yourdomain.tld"
+ZONE="yourzonename.tld"
+TTL=300
+
+printf "server %s\nzone %s.\nupdate delete _acme-challenge.%s. %d in TXT \"%s\"\nsend\n" "${DNSSERVER}" "${ZONE}" "${CERTBOT_DOMAIN}" "${TTL}" "${CERTBOT_VALIDATION}" | $NSUPDATE