Letsencrypt-Zertifikat mit Hetzner DNS-Validation

joergs

Da Hetzner demnächst seine DNS-Verwaltung umstellt, ist auch ein neues Hetzner DNS-Challenge Plugin/ Modul für die Letsencrypt-Zertifikatserstellung via Acme/ Certbot nötig. Hierzu hatte ich Certbot via PIP installiert. Auch das entsprechende Hetzner-Modul gab es bislang via PIP (pip install certbot-dns-hetzner).
Das neue Modul scheint es derzeit nur via SNAP zu geben. Daher wollte ich Certbot und dieses Modul nun via SNAP installieren. Gibt es hierzu irgendwas zu beachten? Funktioniert der Timer auch mit diesen via SNAP installierten Paketen? Außerdem habe ich gesehen, dass es bislang eine eingebaute Post-Routine unter "/usr/share/grommunio-setup/grommunio-certbot-renew-hook" gibt, die das Letsencrypt-Zertifikat und den Key nach "/etc/grommunio-common/ssl/" kopiert und die relevanten Dienste neu startet.
Läuft das auch mit einem via SNAP installierten Paket? Hat jemand schon damit Erfahrungen?

ckd

I'd avoid doing this on a server.

I have moved to Cloudflare DNS-Validation which works out of the box with cerbot available in the packet manager. On Debian you just have to install the package:
python3-certbot-dns-cloudflare

Command to get certificates:
certbot --dns-cloudflare-propagation-seconds 30 --dns-cloudflare certonly -d domainA.tld -d domainB.tld

crpb

I'm using this little script for my private VPS
https://community.hetzner.com/tutorials/letsencrypt-dns

No idea if it will still work in the near future but if not then i will definitely NOT install anything via snap. Just ran a certbot renew --force-renewal and it still seems to work not that some outputs could be handled better but as long as it works i don't care 😛.

@joergs don't know what this thing you are talking about does but if as long as it's working with certbot i guess you will we fine.
If anything is borked you could just link to /usr/share/grommunio-setup/grommunio-certbot-renew-hook in into /etc/letsencrypt/renewal-hooks/deploy/grommunio and it should do all the work again.

And of course disable the grommunio-certbot.timer + .service to not interfere anymore.

joergs

Thanks for your reply.
The DNS challenge at Hetzner will no longer work in its current form from around May onwards. A new Hetzner module for the DNS challenge of Letsencrypt certificates will then need to be installed. ACME already offers this. However, ACME is not available for Opensuse LEAP. More information here: https://www.hetzner.com/de/news/dns-beta/
I will probably solve this by first creating the certificate elsewhere, then automatically copying it to my Grommunio and restarting the usual services.

crpb

@joergs thx for the link

silly me realized the link from my previous post is already with the new "api.hetzner.cloud" so this should just work w/o any extra software other than "curl" as they don't even use "jq" in their scripts o_0.

i still had these scripts running https://github.com/dschoeffm/hetzner-dns-certbot which are talking to dns.hetzner.com 🥳

had time between other stuff so i took that from the community as a guide and reshaped it so i wouldn't bicker if i ever have to use it some place which isn't personal use...
https://gist.github.com/crpb/6e25e7e99651d88bdbb8ac1ae38b2051