MyDNSのLet’s Encryptのワイルドカード自動更新を導入した

# crontab -l
* * * * * /bin/certbot renew && /bin/systemctl reload nginx
→certbotはrootで動かしているが、他のユーザ管理にしたいね
→cronの時間は念の為マスク

# type certbot
certbot is hashed (/usr/bin/certbot)
# which certbot
/usr/bin/certbot
# ls /bin/certbot -l
-rwxr-xr-x 1 root root 960 Apr  7 10:01 /bin/certbot
# ls /usr/bin/certbot -l
-rwxr-xr-x 1 root root 960 Apr  7 10:01 /usr/bin/certbot
→ cronに登録しているcertbotが/binにたいして、certbotは/usr/binにあった
→ シンボリックリンクでもハードリンクでもない
# sha256sum /bin/certbot
2e92fb3a6ca39f7de974ca3e4161197cc347139da68484398e575ec817600587  /bin/certbot
# sha256sum /usr/bin/certbot
2e92fb3a6ca39f7de974ca3e4161197cc347139da68484398e575ec817600587  /usr/bin/certbot
→どっちとも同じハッシュで問題もなく動くが、/usrに変更
# crontab -e
crontab: installing new crontab
# crontab -l
* * * * * /usr/bin/certbot renew && /bin/systemctl reload nginx
→cronの時間は念の為マスク

# certbot renew
(抜粋)
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Processing /etc/letsencrypt/renewal/meto4d.pgw.jp.conf
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Cert is due for renewal, auto-renewing...
Could not choose appropriate plugin: The manual plugin is not working; there may be problems with your existing configuration.
The error was: PluginError('An authentication script must be provided with --manual-auth-hook when using the manual plugin non-interactively.')
Failed to renew certificate meto4d.pgw.jp with error: The manual plugin is not working; there may be problems with your existing configuration.
The error was: PluginError('An authentication script must be provided with --manual-auth-hook when using the manual plugin non-interactively.')

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

# php -v
PHP 8.0.3 (cli) (built: Mar  4 2021 13:26:46) ( NTS )
Copyright (c) The PHP Group
Zend Engine v4.0.3, Copyright (c) Zend Technologies
→PHP8がすでにarchのパッケージに配布されていた

# git clone https://github.com/disco-v8/DirectEdit.git
# ls
DirectEdit
# cd DirectEdit
# ls
README.md  txtdelete.php  txtedit.conf  txtregist.php
# chmod 700 *.php
# chmod 600 *.conf
# vim txtedit.conf
→mydnsのIDやパスワードを入力
→yourdomainはワイルドカード手前のサブドメインまで
→ *.meto4d.pgw.jpであればmeto4d.pgw.jp
# certbot certonly --manual \
--preferred-challenges=dns \
--manual-auth-hook /your/domain/directory/DirectEdit-master/txtregist.php \
--manual-cleanup-hook /your/domain/directory/DirectEdit-master/txtdelete.php \
-d meto4d.pgw.jp -d *.meto4d.pgw.jp \
--server https://acme-v02.api.letsencrypt.org/directory \
--agree-tos -m hogehoge@hoge \
--manual-public-ip-logging-ok

Use of --manual-public-ip-logging-ok is deprecated.
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator manual, Installer None
Use of --manual-public-ip-logging-ok is deprecated.
Cert not yet due for renewal

You have an existing certificate that has exactly the same domains or certificate name you requested and isn't close to expiry.
(ref: /etc/letsencrypt/renewal/meto4d.pgw.jp.conf)

What would you like to do?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
1: Keep the existing certificate for now
2: Renew & replace the certificate (may be subject to CA rate limits)
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Select the appropriate number [1-2] then [enter] (press 'c' to cancel): 2
Renewing an existing certificate for meto4d.pgw.jp and *.meto4d.pgw.jp

IMPORTANT NOTES:
 - Congratulations! Your certificate and chain have been saved at:
   /etc/letsencrypt/live/meto4d.pgw.jp/fullchain.pem
   Your key file has been saved at:
   /etc/letsencrypt/live/meto4d.pgw.jp/privkey.pem
   Your certificate will expire on 2021-08-01. To obtain a new or
   tweaked version of this certificate in the future, simply run
   certbot again. To non-interactively renew *all* of your
   certificates, run "certbot renew"
 - If you like Certbot, please consider supporting our work by:

   Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
   Donating to EFF:                    https://eff.org/donate-le

#!/bin/bash
if test $# -eq 0 ; then
  INPUT=1
else
  if test $1 -eq 1 || test $1 -eq 2; then
    INPUT=$1
  else
    INPUT=1
  fi
fi

echo $INPUT | /usr/bin/certbot certonly --manual --preferred-challenges=dns --manual-auth-hook /root/cron/mydns/DirectEdit/txtregist.php --manual-cleanup-hook /root/cron/mydns/DirectEdit/txtdelete.php -d meto4d.pgw.jp -d *.meto4d.pgw.jp --server https://acme-v02.api.letsencrypt.org/directory --agree-tos -m hogehoge@hoge

# chmod 700 certbot.mydns.sh
# certbot.mydns.sh 1
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator manual, Installer None
Cert not yet due for renewal

You have an existing certificate that has exactly the same domains or certificate name you requested and isn't close to expiry.
(ref: /etc/letsencrypt/renewal/meto4d.pgw.jp.conf)

What would you like to do?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
1: Keep the existing certificate for now
2: Renew & replace the certificate (may be subject to CA rate limits)
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Select the appropriate number [1-2] then [enter] (press 'c' to cancel): Keeping the existing certificate

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Certificate not yet due for renewal; no action taken.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Saving debug log to /var/log/letsencrypt/letsencrypt.log

# crontab -l
* * * * * /root/cron/mydns/DirectEdit/certbot.renew.mydns.sh 1; /usr/bin/certbot renew && /bin/systemctl reload nginx