Certbot

1: Cloudflare
2: Route53

Certbot is a useful utility for obtaining certificates from the Let’s Encrypt project. This is a free service and can be used both for web and other services like email and WiFi.

The utility establishes proof-of-ownership a couple different ways. The normal way is by answering a request on port 80. This proves you are at least in control of a server. But you can also use DNS when you don’t want to open a given server up to the internet.

You can also request wildcard certs via the DNS challenge. These are useful both when you’re hosting many sites, but also when you don’t want to advertise to the world the sites you are hosting.

1 - Cloudflare

If you use Cloudflare, there’s the Cloudflare DNS plugin from certbot.

Create a token first, as in https://roelofjanelsinga.com/articles/using-caddy-ssl-with-cloudflare/

# Install the module. It will pull in the parts of certbot that are needed
sudo apt install python3-certbot-dns-cloudflare

# Create a credential file. Certbot will save the path for use during renewals
sudo bash -c 'echo "dns_cloudflare_api_token = aLongStringOfChars" > /etc/letsencrypt/cloudflare.ini'
sudo chmod 600 /etc/letsencrypt/cloudflare.ini

DOMAIN=your.org

# We added a hook for mail, but substitute your own as desired
sudo certbot certonly \
    --agree-tos \
    --dns-cloudflare \
    --dns-cloudflare-credentials /etc/letsencrypt/cloudflare.ini \
    --domains mail.$DOMAIN \
    --email postmaster@$DOMAIN \
    --deploy-hook "service postfix reload; service dovecot reload"

You may see a warning about the plugin version not being pinned. That’s safe to ignore. You’re looking for the message that it successfully received a certificate.

2 - Route53

This is similar to Cloudflare. This main difference is setting up the IAM user.

Account Setup

Go to route 53 and get your zone ID

Sign in to the AWS Management Console.
Search for Route 53 in the top search bar and select it.
Click on Hosted zones in the left-hand navigation pane.
You will see a list of your domains. Locate the Hosted Zone ID column next to your domain name. It typically looks like a string of random capital letters and numbers (e.g., Z1R8UBAEXAMPLE).

Go to the IAM console and create a policy and user

Navigate to the AWS IAM Console.
Click Create Policy and switch to the JSON tab.
Paste the following policy (replace YOUR_HOSTED_ZONE_ID with your actual Route 53 zone ID, or use * for all zones):

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "route53:ListHostedZones",
                "route53:GetChange"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "route53:ChangeResourceRecordSets"
            ],
            "Resource": "arn:aws:route53:::hostedzone/YOUR_HOSTED_ZONE_ID"
        }
    ]
}

Create the user

In the IAM Users section, click Add user.
Enter a name (e.g., certbot-dns-user) and click Next.
Under Permissions options, select Attach policies directly.
Search for and check the CertbotRoute53Policy you just created.
Complete the creation process.

Generate and Store Credentials

Select your new user from the list, go to the Security credentials tab, and click Create access key.
Select Command Line Interface (CLI) as the use case.
Save the Access Key ID and Secret Access Key. You will not be able to see the secret key again.

Cerbot Setup

Install and Configure Certbot and the Plugin

sudo apt install python3-certbot-dns-route53

sudo cat /etc/letsencrypt/route53.ini

[default]
aws_access_key_id=aLongString
aws_secret_access_key=anEvenLongerString

Request the Certificate

sudo AWS_SHARED_CREDENTIALS_FILE=/etc/letsencrypt/route53.ini certbot certonly --dns-route53 -d wifi.your.org

That should get a cert and create the job as shown in

cat /etc/letsencrypt/renewal/wifi.your.org.conf

Verify with

sudo openssl x509 -in /etc/letsencrypt/live/wifi.your.org/cert.pem -noout -text