ロードバランサーでDV証明書を自動化するためのDNS統合を作成する

開始する前に、DV証明書のインストールを自動化するオペレーティングシステム用のDNSスクリプトを作成します。スクリプトを作成する、またはサンプルスクリプトのいずれかを変更して独自のスクリプトを定義することができます。

Windowsの場合は、ドメインの利用権を証明するためにDNS .batスクリプトと埋め込みのPowerShellポストスクリプト（.ps1、.py、.ps、またはその他形式）の2つのスクリプトが必要になります。

Linuxの場合は、ドメインの利用権を証明するためにDNS .shスクリプトが必要になります。

例：./adddnsintegration.sh -type custom

[root@c7-sowjanya-124 cli]# ./adddnsintegration.sh -type custom

Sensor CLI.  Copyright 2023, DigiCert Inc.
Add a DNS integration to automate DV certificates.

Enter alias:CustomeDNS
Script file path:/tmp/test.sh

DNS integration custom added.
After adding the DNS integration, go back to CertCentral and link the integration to the load balancer where you want to automate a DV certificate.

#ensure AWS PStools are installed incl
#https://docs.aws.amazon.com/powershell/latest/userguide/pstools-getting-set-up-windows.html
#Install-Module -Name AWS.Tools.Installer
#Install-AWSToolsModule AWS.Tools.Route53
#Set-AWSCredential -AccessKey <accesskey> -SecretKey <secretkey> -StoreAs TestDNSProfile

Import-Module AWSPowerShell
Function Set-R53Record {
 
    # Entry parameters
    Param (
		[Parameter(Mandatory=$True)] [String]$Profile,
        [Parameter(Mandatory=$True)][String]$Domain,
        [Parameter(Mandatory=$True)][String]$Type,
        [Parameter(Mandatory=$True)][String]$Name,
        [Parameter(Mandatory=$True)][String]$Value,
        [Int]$TTL = 300,
        [String]$Comment
    )
 
    $DomainDot = $Domain + "."
 
    # Create two objects for R53 update
    $Change = New-Object Amazon.Route53.Model.Change
    $Change.Action = "UPSERT"
    # CREATE: Creates a resource record set that has the specified values.
    # DELETE: Deletes an existing resource record set that has the specified values.
    # UPSERT: If a resource record set doesn't already exist, AWS creates it. If it does, Route 53 updates it with values in the request.
    $Change.ResourceRecordSet = New-Object Amazon.Route53.Model.ResourceRecordSet
    $Change.ResourceRecordSet.Name = "$Name.$Domain"
    $Change.ResourceRecordSet.Type = $Type
    $Change.ResourceRecordSet.TTL = $TTL
    # For TXT-based DNS challenges, value must be in quotes
    $challengeValue = if ($Type -eq "TXT") {"""$Value"""} else {$Value}
    $Change.ResourceRecordSet.ResourceRecords.Add(@{Value=$challengeValue})
 
    # Get hosted zone
    $HostedZone = Get-R53HostedZones -ProfileName $Profile| Where-Object { $DomainDot.EndsWith($_.Name) }
    Write-Output "Found HostedZone:$HostedZone"
    # Set final parameters and execute
    $Parameters = @{
        HostedZoneId = $HostedZone.Id
        ChangeBatch_Change = $Change # Object
        ChangeBatch_Comment = $Comment # "Edited A record"
    }
   return Edit-R53ResourceRecordSet -ProfileName $Profile @Parameters
}

if($args.Length -ne 1){
    Write-Output "Args not found"
    exit -1;
}

$fileInput = Get-Content $args[0]
if ($fileInput.Length -lt 3){
    Write-Output "File not found"
   exit -1;
}
$tempDomains = $fileInput[0].Split(",")
$challenge = $fileInput[2]
$domains = @()
foreach ($d in $tempDomains)
    {
        if ("$d" -ne "null")
        {
            Write-Output $d
            $domains = $domains += $d
        }
    }

foreach ($domain in $domains)
{     
    Set-R53Record -Profile DNSProfileName -Domain $domain -Type "TXT" -Name "_dnsauth" -Value $challenge -TTL 86400 -Comment "DNS challenge for $domain"
}

echo "Invoking DNS script"
pushd %~dp0
powershell.exe -File {DNSPostscriptPath} %*
echo "Exit Code : %errorlevel%"
set returnCode=%errorlevel%
popd
EXIT /B %returnCode%

#!/usr/bin/bash

set_R53_Record(){
    Profile=$1
    Domain=$2
    Type=$3
    Name=$4
    Value=$5
    TTL=$6
    Comment=$7
    DomainDot="$Domain."
    echo "Profile:$Profile Domain:$Domain"
    HOSTEDZONEID=$(/usr/local/bin/aws route53 list-hosted-zones --profile $Profile | jq '.HostedZones | .[] | select(.Name|inside('\"$DomainDot\"')) | .Id' | tr -d '"')
    cat > change-batch.json << EOL
    {"Comment":"$Comment","Changes":[{"Action":"UPSERT","ResourceRecordSet":{"Name":"$Name.$Domain","Type":"$Type","TTL":$TTL,"ResourceRecords":[{"Value":"\"$Value\""}]}}]}
EOL
    /usr/local/bin/aws route53 change-resource-record-sets --hosted-zone-id $HOSTEDZONEID --profile $Profile --change-batch file://change-batch.json
}


if [ "$#" -ne 1 ]; then
    echo "Args not found"
    exit -1;
fi

 IFS=$'\n' read -d '' -r -a lines < $1

if [ ${#lines[@]} != 3 ]; then
    echo "File not found"
    exit -1;
fi

challenge=${lines[2]}

IFS=',' read -ra domains <<< "${lines[0]}"
for domain in "${domains[@]}"; do
    set_R53_Record default $domain "TXT" "_dnsauth" $challenge 86400 "DNS challenge for $domain"
done