Generating HTTPS Certificate using DNS a Challenge through Let's Encrypt
I have a Raspberry-Pi running a Flask app through Gunicorn (Ubuntu 20.04 LTS). I am exposing it to the internet using DuckDNS.
sudo apt update && sudo apt install certbot -y
Get the Certificate
sudo certbot certonly --manual --preferred-challenges dns-01 --email [email protected] -d mydomain.duckdns.org
After you accept that you are okay with you IP address being logged, it will prompt you with updating your dns record. You need to create a new
TXT record in the DNS settings for your domain.
For DuckDNS users it is as simple as entering this URL in their browser:
mydomain is your DuckDNS domain,
duckdnstoken is your DuckDNS Token ( Found on the dashboard when you login) and
certbotdnstxt is the TXT record value given by the prompt.
You can check if the TXT records have been updated by using the
dig navanspi.duckdns.org TXT ; <<>> DiG 9.16.1-Ubuntu <<>> navanspi.duckdns.org TXT ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 27592 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 65494 ;; QUESTION SECTION: ;navanspi.duckdns.org. IN TXT ;; ANSWER SECTION: navanspi.duckdns.org. 60 IN TXT "4OKbijIJmc82Yv2NiGVm1RmaBHSCZ_230qNtj9YA-qk" ;; Query time: 275 msec ;; SERVER: 127.0.0.53#53(127.0.0.53) ;; WHEN: Tue Nov 17 15:23:15 IST 2020 ;; MSG SIZE rcvd: 105
DuckDNS almost instantly propagates the changes but for other domain hosts, it could take a while.
Once you can ensure that the TXT record changes has been successfully applied and is visible through the
dig command, press enter on the Certbot prompt and your certificate should be generated.
As we manually generated the certificate
certbot renew will fail, to renew the certificate you need to simply re-generate the certificate using the above steps.
Using the Certificate with Gunicorn
Example Gunicorn command for running a web-app:
gunicorn api:app -k uvicorn.workers.UvicornWorker -b 0.0.0.0:7589
To use the certificate with it, simply copy the
privkey.pem to your working directory ( change the appropriate permissions ) and include them in the command
gunicorn api:app -k uvicorn.workers.UvicornWorker -b 0.0.0.0:7589 --certfile=cert.pem --keyfile=privkey.pem
Caveats with copying the certificate: If you renew the certificate you will have to re-copy the files