Crear una integración de DNS para automatizar los certificados DV en los equilibradores de carga

Antes de comenzar, cree un script de DNS para el sistema operativo para el que desea automatizar la instalación de certificados DV. Puede creer un script o modificar uno de los script de muestra para definir su script.

Para Windows, necesita dos scripts para demostrar su control sobre los dominios: Script .bat de DNS y el postscript PowerShell integrado (.ps1, .py, .ps o cualquier otro formato).

Para Linux, necesita un script DNS .sh para demostrar el control sobre los dominios.

Ejemplo: ./adddnsintegration.sh -type custom

[root@c7-sowjanya-124 cli]# ./adddnsintegration.sh -type custom

Sensor CLI.  Copyright 2023, DigiCert Inc.
Add a DNS integration to automate DV certificates.

Enter alias:CustomeDNS
Script file path:/tmp/test.sh

DNS integration custom added.
After adding the DNS integration, go back to CertCentral and link the integration to the load balancer where you want to automate a DV certificate.

#ensure AWS PStools are installed incl
#https://docs.aws.amazon.com/powershell/latest/userguide/pstools-getting-set-up-windows.html
#Install-Module -Name AWS.Tools.Installer
#Install-AWSToolsModule AWS.Tools.Route53
#Set-AWSCredential -AccessKey <accesskey> -SecretKey <secretkey> -StoreAs TestDNSProfile

Import-Module AWSPowerShell
Function Set-R53Record {
 
    # Entry parameters
    Param (
		[Parameter(Mandatory=$True)] [String]$Profile,
        [Parameter(Mandatory=$True)][String]$Domain,
        [Parameter(Mandatory=$True)][String]$Type,
        [Parameter(Mandatory=$True)][String]$Name,
        [Parameter(Mandatory=$True)][String]$Value,
        [Int]$TTL = 300,
        [String]$Comment
    )
 
    $DomainDot = $Domain + "."
 
    # Create two objects for R53 update
    $Change = New-Object Amazon.Route53.Model.Change
    $Change.Action = "UPSERT"
    # CREATE: Creates a resource record set that has the specified values.
    # DELETE: Deletes an existing resource record set that has the specified values.
    # UPSERT: If a resource record set doesn't already exist, AWS creates it. If it does, Route 53 updates it with values in the request.
    $Change.ResourceRecordSet = New-Object Amazon.Route53.Model.ResourceRecordSet
    $Change.ResourceRecordSet.Name = "$Name.$Domain"
    $Change.ResourceRecordSet.Type = $Type
    $Change.ResourceRecordSet.TTL = $TTL
    # For TXT-based DNS challenges, value must be in quotes
    $challengeValue = if ($Type -eq "TXT") {"""$Value"""} else {$Value}
    $Change.ResourceRecordSet.ResourceRecords.Add(@{Value=$challengeValue})
 
    # Get hosted zone
    $HostedZone = Get-R53HostedZones -ProfileName $Profile| Where-Object { $DomainDot.EndsWith($_.Name) }
    Write-Output "Found HostedZone:$HostedZone"
    # Set final parameters and execute
    $Parameters = @{
        HostedZoneId = $HostedZone.Id
        ChangeBatch_Change = $Change # Object
        ChangeBatch_Comment = $Comment # "Edited A record"
    }
   return Edit-R53ResourceRecordSet -ProfileName $Profile @Parameters
}

if($args.Length -ne 1){
    Write-Output "Args not found"
    exit -1;
}

$fileInput = Get-Content $args[0]
if ($fileInput.Length -lt 3){
    Write-Output "File not found"
   exit -1;
}
$tempDomains = $fileInput[0].Split(",")
$challenge = $fileInput[2]
$domains = @()
foreach ($d in $tempDomains)
    {
        if ("$d" -ne "null")
        {
            Write-Output $d
            $domains = $domains += $d
        }
    }

foreach ($domain in $domains)
{     
    Set-R53Record -Profile DNSProfileName -Domain $domain -Type "TXT" -Name "_dnsauth" -Value $challenge -TTL 86400 -Comment "DNS challenge for $domain"
}

echo "Invoking DNS script"
pushd %~dp0
powershell.exe -File {DNSPostscriptPath} %*
echo "Exit Code : %errorlevel%"
set returnCode=%errorlevel%
popd
EXIT /B %returnCode%

#!/usr/bin/bash

set_R53_Record(){
    Profile=$1
    Domain=$2
    Type=$3
    Name=$4
    Value=$5
    TTL=$6
    Comment=$7
    DomainDot="$Domain."
    echo "Profile:$Profile Domain:$Domain"
    HOSTEDZONEID=$(/usr/local/bin/aws route53 list-hosted-zones --profile $Profile | jq '.HostedZones | .[] | select(.Name|inside('\"$DomainDot\"')) | .Id' | tr -d '"')
    cat > change-batch.json << EOL
    {"Comment":"$Comment","Changes":[{"Action":"UPSERT","ResourceRecordSet":{"Name":"$Name.$Domain","Type":"$Type","TTL":$TTL,"ResourceRecords":[{"Value":"\"$Value\""}]}}]}
EOL
    /usr/local/bin/aws route53 change-resource-record-sets --hosted-zone-id $HOSTEDZONEID --profile $Profile --change-batch file://change-batch.json
}


if [ "$#" -ne 1 ]; then
    echo "Args not found"
    exit -1;
fi

 IFS=$'\n' read -d '' -r -a lines < $1

if [ ${#lines[@]} != 3 ]; then
    echo "File not found"
    exit -1;
fi

challenge=${lines[2]}

IFS=',' read -ra domains <<< "${lines[0]}"
for domain in "${domains[@]}"; do
    set_R53_Record default $domain "TXT" "_dnsauth" $challenge 86400 "DNS challenge for $domain"
done