{"id":1261,"date":"2022-12-13T21:19:29","date_gmt":"2022-12-13T21:19:29","guid":{"rendered":"https:\/\/editjournal.redakt.eu\/faxmodem\/?p=1261"},"modified":"2022-12-14T13:47:19","modified_gmt":"2022-12-14T13:47:19","slug":"using-certbot-with-cloud-dns-for-dns-01-challenge","status":"publish","type":"post","link":"https:\/\/editjournal.redakt.eu\/faxmodem\/blog\/seo-webmaster\/using-certbot-with-cloud-dns-for-dns-01-challenge\/","title":{"rendered":"Using certbot with cloud DNS for DNS-01 challenge"},"content":{"rendered":"<ol>\n<li>\n<p>Google Cloud<\/p>\n<p>You can copy-paste the below cli commands into the Google Cloud Shell, or do each step manually if you prefer so.<\/p>\n<pre><code># Define the project ID\nexport PROJECT_ID=$(gcloud config get-value project)\n\n# Create a role for certbot with minimum required permissions\ngcloud iam roles create DNS01CERTBOT --project=$PROJECT_ID --title=\"Certbot DNS-01 Validator\" --description=\"https:\/\/github.com\/certbot\/certbot\/blob\/a807240db7b8ca60bc1bd637a66282b3ca449417\/certbot-dns-google\/certbot_dns_google\/__init__.py\" --permissions=\"dns.changes.create,dns.changes.get,dns.changes.list,dns.managedZones.get,dns.managedZones.list,dns.resourceRecordSets.create,dns.resourceRecordSets.delete,dns.resourceRecordSets.list,dns.resourceRecordSets.update\" --stage=GA\n\n# Create a service account for certbot\ngcloud iam service-accounts create certbot --project=$PROJECT_ID --display-name=\"Certbot\" --description=\"Account for Certbot performing ACME DNS-01 challenge\"\n\n# Attach the newly created service account to the above role\ngcloud projects add-iam-policy-binding $PROJECT_ID --member=serviceAccount:certbot@$PROJECT_ID.iam.gserviceaccount.com --role=projects\/$PROJECT_ID\/roles\/DNS01CERTBOT\n\n# Create a private key for the above service account\ngcloud iam service-accounts keys create ~\/gcp-$PROJECT_ID-key-certbot.json --iam-account=certbot@$PROJECT_ID.iam.gserviceaccount.com && cat ~\/gcp-$PROJECT_ID-key-certbot.json && cloudshell download ~\/gcp-$PROJECT_ID-key-certbot.json<\/code><\/pre>\n<p>Or manually:<\/p>\n<ul>\n<li>Create a new role for DNS-01 Certbot at <a href=\"https:\/\/console.cloud.google.com\/iam-admin\/roles\">https:\/\/console.cloud.google.com\/iam-admin\/roles<\/a> with the following permissions <a href=\"https:\/\/github.com\/certbot\/certbot\/blob\/a807240db7b8ca60bc1bd637a66282b3ca449417\/certbot-dns-google\/certbot_dns_google\/__init__.py\">https:\/\/github.com\/certbot\/certbot\/blob\/a807240db7b8ca60bc1bd637a66282b3ca449417\/certbot-dns-google\/certbot_dns_google\/__init__.py<\/a>. The Role launch state needs to be General availability.<\/li>\n<li>Create a new Service Account <a href=\"https:\/\/console.developers.google.com\/iam-admin\/serviceaccounts\">https:\/\/console.developers.google.com\/iam-admin\/serviceaccounts<\/a>, making sure you select the custom role created above<\/li>\n<li>Create a key for the account above <a href=\"https:\/\/developers.google.com\/identity\/protocols\/oauth2\/service-account#creatinganaccount\">https:\/\/developers.google.com\/identity\/protocols\/oauth2\/service-account#creatinganaccount<\/a><\/li>\n<\/ul>\n<p>Lastly, install certbot with the Google plugin: <\/p>\n<pre><code>apt-get install --no-install-recommends certbot python3-certbot-dns-google<\/code><\/pre>\n<p>Use  certbot with <code>--dns-google --dns-google-credentials ~\/gcp-key-certbot.json<\/code><\/p>\n<\/li>\n<\/ol>\n<p>Sources:<\/p>\n<ul>\n<li><a href=\"https:\/\/itsmetommy.com\/2019\/08\/03\/auto-renew-lets-encrypt-wildcard-certificate-using-google-cloud-dns\/\">https:\/\/itsmetommy.com\/2019\/08\/03\/auto-renew-lets-encrypt-wildcard-certificate-using-google-cloud-dns\/<\/a><\/li>\n<li><a href=\"https:\/\/techoverflow.net\/2021\/01\/10\/how-to-fix-certbot-unrecognized-arguments-dns-cloudflare-credentials-on-ubuntu\/\">https:\/\/techoverflow.net\/2021\/01\/10\/how-to-fix-certbot-unrecognized-arguments-dns-cloudflare-credentials-on-ubuntu\/<\/a><\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>Google Cloud You can copy-paste the below cli commands into the Google Cloud Shell, or do each step manually if you prefer so. # Define the project ID export PROJECT_ID=$(gcloud config get-value project) # Create a role for certbot with minimum required permissions gcloud iam roles create DNS01CERTBOT &#8211;project=$PROJECT_ID &#8211;title=&#8221;Certbot DNS-01 Validator&#8221; &#8211;description=&#8221;https:\/\/github.com\/certbot\/certbot\/blob\/a807240db7b8ca60bc1bd637a66282b3ca449417\/certbot-dns-google\/certbot_dns_google\/__init__.py&#8221; &#8211;permissions=&#8221;dns.changes.create,dns.changes.get,dns.changes.list,dns.managedZones.get,dns.managedZones.list,dns.resourceRecordSets.create,dns.resourceRecordSets.delete,dns.resourceRecordSets.list,dns.resourceRecordSets.update&#8221; &#8211;stage=GA&hellip; <a class=\"more-link\" href=\"https:\/\/editjournal.redakt.eu\/faxmodem\/blog\/seo-webmaster\/using-certbot-with-cloud-dns-for-dns-01-challenge\/\">Continue reading <span class=\"screen-reader-text\">Using certbot with cloud DNS for DNS-01 challenge<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[994],"tags":[989,982],"class_list":["post-1261","post","type-post","status-publish","format-standard","hentry","category-seo-webmaster","tag-certbot","tag-ssl","entry"],"_links":{"self":[{"href":"https:\/\/editjournal.redakt.eu\/faxmodem\/wp-json\/wp\/v2\/posts\/1261","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/editjournal.redakt.eu\/faxmodem\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/editjournal.redakt.eu\/faxmodem\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/editjournal.redakt.eu\/faxmodem\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/editjournal.redakt.eu\/faxmodem\/wp-json\/wp\/v2\/comments?post=1261"}],"version-history":[{"count":4,"href":"https:\/\/editjournal.redakt.eu\/faxmodem\/wp-json\/wp\/v2\/posts\/1261\/revisions"}],"predecessor-version":[{"id":1266,"href":"https:\/\/editjournal.redakt.eu\/faxmodem\/wp-json\/wp\/v2\/posts\/1261\/revisions\/1266"}],"wp:attachment":[{"href":"https:\/\/editjournal.redakt.eu\/faxmodem\/wp-json\/wp\/v2\/media?parent=1261"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/editjournal.redakt.eu\/faxmodem\/wp-json\/wp\/v2\/categories?post=1261"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/editjournal.redakt.eu\/faxmodem\/wp-json\/wp\/v2\/tags?post=1261"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}