Créer une intégration DNS pour automatiser les certificats DV sur les équilibreurs de charge :

Avant de démarrer, créez un script DNS pour le système d’exploitation pour lequel vous souhaitez automatiser l’installation de certificats DV. Vous pouvez créer un script ou modifier l’un des exemples de script pour définir le vôtre

Sous Windows, vous avez besoin de deux scripts pour prouver que vous contrôlez les domaines : Un script DNS .bat et un postscript PowerShell intégré (.ps1, .py, .ps, ou tout autre format).

Sous Linux, vous avez besoin d'un script DNS .sh pour prouver que vous contrôlez les domaines.

Exemple : ./adddnsintegration.sh -type custom

[root@c7-sowjanya-124 cli]# ./adddnsintegration.sh -type custom

Sensor CLI.  Copyright 2023, DigiCert Inc.
Add a DNS integration to automate DV certificates.

Enter alias:CustomeDNS
Script file path:/tmp/test.sh

DNS integration custom added.
After adding the DNS integration, go back to CertCentral and link the integration to the load balancer where you want to automate a DV certificate.

#ensure AWS PStools are installed incl
#https://docs.aws.amazon.com/powershell/latest/userguide/pstools-getting-set-up-windows.html
#Install-Module -Name AWS.Tools.Installer
#Install-AWSToolsModule AWS.Tools.Route53
#Set-AWSCredential -AccessKey <accesskey> -SecretKey <secretkey> -StoreAs TestDNSProfile

Import-Module AWSPowerShell
Function Set-R53Record {
 
    # Entry parameters
    Param (
		[Parameter(Mandatory=$True)] [String]$Profile,
        [Parameter(Mandatory=$True)][String]$Domain,
        [Parameter(Mandatory=$True)][String]$Type,
        [Parameter(Mandatory=$True)][String]$Name,
        [Parameter(Mandatory=$True)][String]$Value,
        [Int]$TTL = 300,
        [String]$Comment
    )
 
    $DomainDot = $Domain + "."
 
    # Create two objects for R53 update
    $Change = New-Object Amazon.Route53.Model.Change
    $Change.Action = "UPSERT"
        # CREATE: Creates a resource record set that has the specified values.
        # DELETE: Deletes an existing resource record set that has the specified values.
        # UPSERT: If a resource record set doesn't already exist, AWS creates it. If it does, Route 53 updates it with values in the request.
    $Change.ResourceRecordSet = New-Object Amazon.Route53.Model.ResourceRecordSet
    $Change.ResourceRecordSet.Name = "$Name.$Domain"
    $Change.ResourceRecordSet.Type = $Type
    $Change.ResourceRecordSet.TTL = $TTL
    #$Change.ResourceRecordSet.ResourceRecords.Add(@{Value=$Value})
    $Change.ResourceRecordSet.ResourceRecords.Add(@{Value=if ($Type -eq "TXT") {"""$Value"""} else {$Value}})
 
    # Get hosted zone
    $HostedZone = Get-R53HostedZones -ProfileName $Profile| Where-Object { $DomainDot.EndsWith($_.Name) }
    Write-Output "Found HostedZone:$HostedZone"
    # Set final parameters and execute
    $Parameters = @{
        HostedZoneId = $HostedZone.Id
        ChangeBatch_Change = $Change # Object
        ChangeBatch_Comment = $Comment # "Edited A record"
    }
   return Edit-R53ResourceRecordSet -ProfileName $Profile @Parameters
}

if($args.Length -ne 1){
    Write-Output "Args not found"
    exit -1;
}

$fileInput = Get-Content $args[0]
if ($fileInput.Length -lt 3){
    Write-Output "File not found"
   exit -1;
}
$tempDomains = $fileInput[0].Split(",")
$challenge = $fileInput[2]
$domains = @()
foreach ($d in $tempDomains)
    {
        if ("$d" -ne "null")
        {
            Write-Output $d
            $domains = $domains += $d
        }
    }

foreach ($domain in $domains)
{     
    Set-R53Record -Profile DNSProfileName -Domain $domain -Type "TXT" -Name "_dnsauth" -Value $challenge -TTL 86400 -Comment "DNS challenge for $domain"

echo "Invoking DNS script"
pushd %~dp0
powershell.exe -File {DNSPostscriptPath} %*
echo "Exit Code : %errorlevel%"
set returnCode=%errorlevel%
popd
EXIT /B %returnCode%

#!/usr/bin/bash

set_R53_Record(){
    Profile=$1
    Domain=$2
    Type=$3
    Name=$4
    Value=$5
    TTL=$6
    Comment=$7
    DomainDot="$Domain."
    echo "Profile:$Profile Domain:$Domain"
    HOSTEDZONEID=$(/usr/local/bin/aws route53 list-hosted-zones --profile $Profile | jq '.HostedZones | .[] | select(.Name|inside('\"$DomainDot\"')) | .Id' | tr -d '"')
    cat > change-batch.json << EOL
    {"Comment":"$Comment","Changes":[{"Action":"UPSERT","ResourceRecordSet":{"Name":"$Name.$Domain","Type":"$Type","TTL":$TTL,"ResourceRecords":[{"Value":"\"$Value\""}]}}]}
EOL
    /usr/local/bin/aws route53 change-resource-record-sets --hosted-zone-id $HOSTEDZONEID --profile $Profile --change-batch file://change-batch.json
}


if [ "$#" -ne 1 ]; then
    echo "Args not found"
    exit -1;
fi

 IFS=$'\n' read -d '' -r -a lines < $1

if [ ${#lines[@]} != 3 ]; then
    echo "File not found"
    exit -1;
fi

challenge=${lines[2]}

IFS=',' read -ra domains <<< "${lines[0]}"
for domain in "${domains[@]}"; do
    set_R53_Record default $domain "TXT" "_dnsauth" $challenge 86400 "DNS challenge for $domain"
done