You want to generate Letsencrypt certificates using You need to provide some OCI credentials to Here's what --dns-oci-credentials<\/strong> has special value In other cases, plugin requires the Go to OCI console \u2192 Identity & Security<\/em> \u2192 Policies<\/em>. Create new policy with statement:<\/p>\n Use the You will get the Configuration file preview<\/em> screen where it shows your key fingerprint and the template to create an The template will look like this:<\/p>\n Each key is documented in SDK and CLI Configuration File \u2192 File Entries<\/a>.<\/p>\n Use Cloud Shell right in OCI Console. You will have to upload the .pem and the .ini and then issue some dns command using these credentials to see if they work.<\/p>\n On top right click Developer Tools \u2192 Cloud Shell. You get something that looks like SSH in your browser.<\/p>\n Paste your .ini contents into Lastly, you will need your compartment OCID. You can get it in Cloud Shell:<\/p>\n Now we can test the credentials:<\/p>\n If you're automating deployment, you will need to store the private key only.<\/p>\n The fingerprint can be easily derived by using:<\/p>\n If you don't use The setup You want to generate Letsencrypt certificates using DNS-01 challenge (e.g. wildcard certificates) and you host your domain on Oracle Cloud. Your code is in Python and you want to use certbot-dns-oci for updating the TXT DNS records for the DNS-01 challenge. The problem You need to provide some OCI credentials to certbot-dns-oci and… Continue reading Creating API credentials for certbot-dns-oci<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[778],"tags":[989,862],"class_list":["post-1748","post","type-post","status-publish","format-standard","hentry","category-cloud-serverless","tag-certbot","tag-oracle-cloud-infrastructure","entry"],"_links":{"self":[{"href":"https:\/\/editjournal.redakt.eu\/faxmodem\/wp-json\/wp\/v2\/posts\/1748","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/editjournal.redakt.eu\/faxmodem\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/editjournal.redakt.eu\/faxmodem\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/editjournal.redakt.eu\/faxmodem\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/editjournal.redakt.eu\/faxmodem\/wp-json\/wp\/v2\/comments?post=1748"}],"version-history":[{"count":7,"href":"https:\/\/editjournal.redakt.eu\/faxmodem\/wp-json\/wp\/v2\/posts\/1748\/revisions"}],"predecessor-version":[{"id":1755,"href":"https:\/\/editjournal.redakt.eu\/faxmodem\/wp-json\/wp\/v2\/posts\/1748\/revisions\/1755"}],"wp:attachment":[{"href":"https:\/\/editjournal.redakt.eu\/faxmodem\/wp-json\/wp\/v2\/media?parent=1748"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/editjournal.redakt.eu\/faxmodem\/wp-json\/wp\/v2\/categories?post=1748"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/editjournal.redakt.eu\/faxmodem\/wp-json\/wp\/v2\/tags?post=1748"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}DNS-01<\/code> challenge<\/a> (e.g. wildcard certificates) and you host your domain on Oracle Cloud. Your code is in Python and you want to use certbot-dns-oci<\/a> for updating the TXT DNS records for the DNS-01<\/code> challenge.<\/p>\nThe problem<\/h2>\n
certbot-dns-oci<\/code> and it's not obvious where and how do you get them.<\/p>\ncertbot-dns-oci<\/code> says:<\/p>\n\n
instance_principal<\/code> that switches
\ncertbot to use the instance principal for OCI authentication
\n(please, read the documentation about the feature.<\/a>)
\nCorresponding dynamic group must be able to read dns-zones<\/code> in compartment
\nand manage dns-records<\/code>.<\/p>\n
\nOCI credentials configuration file<\/a>,
\nwhich is ~\/.oci\/config<\/code> by default.
\nThe profile can be specified by --dns-oci-profile<\/strong> (usually DEFAULT<\/code>).<\/p>\n<\/blockquote>\nThe credentials<\/h2>\n
1. Create user, group and policy<\/h3>\n
\n
\nDomains here means Identity Domains. Every tenancy has at least one, usually named \u201cDefault\u201d.<\/li>\nAllow group id OCID to manage dns in tenancy<\/code><\/pre>\nOCID<\/code> for the group you created, e.g. ocid1.group.oc1.abc...def<\/code>.
\nHere's documentation on policy syntax<\/a>.<\/p>\n<\/li>\n<\/ol>\n2. Get API keys<\/h3>\n
\n
3. Create configuration file<\/h3>\n
.ini<\/code> configuration file.<\/p>\n[DEFAULT]\nuser=ocid1.user.oc1.abc...def\nfingerprint=ab:cd:...:ef\ntenancy=ocid1.tenancy.oc1.abc...def\nregion=<your-region-here, e.g. `us-ashburn-1`>\nkey_file=<path to your private keyfile> # TODO<\/code><\/pre>\nTest user<\/h2>\n
mkdir -p ~\/.oci\nvi ~\/.oci\/config<\/code><\/pre>\n~\/.oci\/config<\/code>. Gotchas:<\/p>\n\n
[DEFAULT]<\/code> with username we're testing, e.g. api_dns_user<\/code><\/li>\nkey_file<\/code> with where the private key will actually be, e.g. ~\/.oci\/api_dns_user.pem<\/code><\/li>\nchmod 600 ~\/.oci\/config<\/code> and chmod 600 ~\/.oci\/api_dns_user.pem<\/code>, else it will complain permissions are too open<\/li>\n<\/ul>\noci iam compartment list --all --include-root --query "data[?\\"compartment-id\\"==null].id | [0]" --raw-output<\/code><\/pre>\noci --auth api_key --config-file ~\/.oci\/config --profile api_dns_user dns zone list --compartment-id COMPARTMENT_OCID<\/code><\/pre>\nBonus points<\/h2>\n
openssl rsa -pubout -outform DER -in "\/path\/to\/private-key.pem" 2>\/dev\/null | openssl md5 -c | awk '{print $2}'<\/code><\/pre>\nawk '{print $2}'<\/code> the output will be MD5(stdin)= ab:cd:...:ef<\/code><\/p>\n","protected":false},"excerpt":{"rendered":"