Certificates with Certbot

Certbot gets certificates from Let’s Encrypt. With its dns-rfc2136 plugin and your key from dns.lgbt, it proves that you control a domain by adding a TXT record at _acme-challenge, so it works for wildcard certificates and for servers that aren’t reachable from the internet. Your domain has to be active at dns.lgbt.

1. Install Certbot and the plugin

# Debian and Ubuntu
sudo apt install certbot python3-certbot-dns-rfc2136

# Snap
sudo snap install --classic certbot
sudo snap set certbot trust-plugin-with-root=ok
sudo snap install certbot-dns-rfc2136

# pip
pip install certbot certbot-dns-rfc2136

2. Save your key

On your account page, under “Certificates (Certbot)”, choose “Set up Certbot”. Copy the settings it shows into /etc/letsencrypt/rfc2136.ini and make the file readable only by root: sudo chmod 600 /etc/letsencrypt/rfc2136.ini. It looks like this:

# dns.lgbt: certbot dns-rfc2136 credentials. Keep this file private:
# chmod 600 rfc2136.ini
dns_rfc2136_server = 176.9.45.228
dns_rfc2136_port = 53
dns_rfc2136_name = 0123456789abcdef.key.dns.lgbt.
dns_rfc2136_secret = your-secret-from-the-account-page=
dns_rfc2136_algorithm = HMAC-SHA256

The key works for all your domains, but it can only add and remove TXT records at _acme-challenge names (like _acme-challenge.www), nothing else. It signs with HMAC-SHA256. You can show it again on the account page at any time.

3. Get a certificate

sudo certbot certonly \
  --dns-rfc2136 \
  --dns-rfc2136-credentials /etc/letsencrypt/rfc2136.ini \
  --dns-rfc2136-propagation-seconds 60 \
  -d example.com -d '*.example.com'

Use your domain instead of example.com, with as many -d as you need. Certbot adds the TXT records, waits 60 seconds so all our nameservers have them, and removes them once Let’s Encrypt has checked them. Don’t wait less: Let’s Encrypt may ask any of our nameservers.

4. Renewal

Certbot remembers these settings and renews the certificate before it expires (the packages install a timer for certbot renew). To try it without getting a new certificate: sudo certbot renew --dry-run.

If something goes wrong

• REFUSED: the name isn’t an _acme-challenge name, there is a CNAME record at it, the domain is full, or you haven’t agreed to the current terms of service yet (sign in to do so). Also when the key sent too much in a minute: 600 lookups and 120 updates (an update counts once per 10 changes). Over UDP there is no answer then.
• NOTAUTH: the domain isn’t active at dns.lgbt in your account, or the key name or secret in rfc2136.ini is wrong (after you replaced the secret, for example). The clock of your server has to be right to within five minutes.
• Let’s Encrypt finds no TXT record: raise --dns-rfc2136-propagation-seconds.

Other ACME clients that speak RFC 2136 (lego, acme.sh with nsupdate, cert-manager) work with the same key. To change other records from scripts, use the API.

Over Tor

Our onion service takes DNS UPDATE too, on port 53 of lgbtdns5pwlmd3owons7dkabgrge7onmisghx42rjoddinndseks6tid.onion, over TCP only (Tor carries no UDP). Certbot’s plugin only connects to IP addresses, so let socat forward a local port to the onion service through your Tor client (port 9050):

ONION=lgbtdns5pwlmd3owons7dkabgrge7onmisghx42rjoddinndseks6tid.onion
socat TCP-LISTEN:8053,bind=127.0.0.1,reuseaddr,fork \
  SOCKS4A:127.0.0.1:$ONION:53,socksport=9050

and point rfc2136.ini at it instead of our address:

dns_rfc2136_server = 127.0.0.1
dns_rfc2136_port = 8053

Tools that take a host name work through torsocks, e.g. nsupdate (-v makes it use TCP):

torsocks nsupdate -v -y hmac-sha256:<key name>:<secret> <<EOF
server lgbtdns5pwlmd3owons7dkabgrge7onmisghx42rjoddinndseks6tid.onion 53
zone example.com
update add _acme-challenge.example.com 60 TXT "test"
send
EOF

How to check the onion address and use the rest of dns.lgbt over Tor: dns.lgbt over Tor.