This guide explains how to renew a wildcard certificate wildcard via DNS challenge using Certbot.

Preamble

• Make sure to protect configuration files and scripts containing sensitive information such as API tokens.
• Test the manual and automatic renewal process to ensure everything works correctly before the expiration date of the existing certificate.

Generate the wildcard certificate

Prerequisites

1. Click here to access API management on the Infomaniak Manager (need help?).
2. Create an Infomaniak API token with the domain scope.
3. Note this token for later use.

From a Terminal type application (command-line interface, CLI / Command Line Interface) on your device — for example cmd on Windows or Terminal on macOS — run the Certbot command with the following parameters:

certbot certonly --manual -d *.domain.tld --preferred-challenges dns-01 --server https://acme-v02.api.letsencrypt.org/directory

Create the TXT record

Create the TXT record for _acme_challenge.domain.tld manually from the Infomaniak interface.

Configure automatic renewal

Create the renewal configuration file

Create or edit the file /etc/letsencrypt/renewal/domain.tld.conf with the following information:

[...]
[renewalparams]
account = xxxxx
pref_challs = dns-01,
server = https://acme-v02.api.letsencrypt.org/directory
authenticator = manual
manual_auth_hook = /root/infomaniak-auth.sh
key_type = rsa

Create the infomaniak-auth.sh script

Create the file /root/infomaniak-auth.sh with the following content:

#!/bin/bash
INFOMANIAK_API_TOKEN=XXXXXXX
certbot certonly \
--authenticator dns-infomaniak \
--server https://acme-v02.api.letsencrypt.org/directory \
--agree-tos \
--rsa-key-size 4096 \
-d $CERTBOT_DOMAIN

Replace XXXXXXX with your Infomaniak API Token.

Automatic renewal

Schedule regular execution of certbot renew via a cron job to take into account the configuration file and automatically renew your certificate at regular intervals.

0 0 */x * * /usr/bin/certbot renew --quiet --config /etc/letsencrypt/renewal/domain.tld.conf

Replace /x with the desired renewal frequency, for example, every 30 days.