Versions Compared

Old Version 3

changes.mady.by.user Paul Allen

Saved on

compared with

New Version Current

changes.mady.by.user Paul Allen

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

  1. Install certbot and the certbot Route 53 DNS plugin. 
    • E.g. for Ubuntu 22.04 using apt
      Code Block
      apt-get install certbot python3-certbot-dns-route53
  2. Configure AWS credentials that have permissions required by the Route 53 plugin.
    • Set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables or otherwise setup a profile in your ~/.aws/config credentials configuration file.
  3. Create a certificate using the certbot CLI. In the example below, the AWS profile with Route 53 privileges in the dns profile:
    Code Block
    $ AWS_PROFILE=dns certbot certonly \
    --non-interactive \
    --dns-route53 \
    --agree-tos \
    --email abc123@cornell.edu \
    --domain myserver.example.cucloud.net \
    --cert-name mycert53 \
    --verboseSaving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator dns-route53, Installer None
Requesting a certificate for myserver.example.cucloud.net
Performing the following challenges:
dns-01 challenge for myserver.example.cucloud.net
Waiting for verification...
Cleaning up challenges

Successfully received certificate.
Certificate is saved at: /etc/letsencrypt/live/mycert53/fullchain.pem
Key is saved at: /etc/letsencrypt/live/mycert53/privkey.pem
This certificate expires on 2024-09-01.
These files will be updated when the certificate renews.
Certbot has set up a scheduled task to automatically renew this certificate in the background.

Notes

  • The record that certbot creates in Route 53 seems to be automatically deleted once the certificate is validated.
  • Certbot certificates validated with Route 53 have a 3-month lifespan.
  • Certbot can optionally, automatically configure/install certificates for several types of web servers. The example here uses certbot just to create/renew certificates but see certbot documentation for web server integration options.

Renewal

You will need to ensure that the scheduled task that cerbot  creates on your system can run successfully to ensure the certificate is renewed automatically, or you will need to trigger renewal some other way before your certificate expires. 

...