• HWIKI

    Build. Break. Explain.

    Automated SSL Certificate Management

    By h0ag's avatar h0ag | On | 289 views

    This documentation provides a professional guide to implementing the DNS-01 challenge for SSL certificates using cloudflare API. Using this method allows for wildcard certificates and renewal for internal servers not exposed to the public internet.

    1. Prerequisites

    Before starting, ensure you have the following:

    • Certbot installed on your system.
    • The Cloudflare DNS plugin for Certbot (python3-certbot-dns-cloudflare).
    • A Cloudflare API Token (not the Global API Key) with Zone:DNS:Edit and Zone:Zone:Read permissions.

    2. Cloudflare API Configuration

    Store your credentials in a restricted file to prevent unauthorized access.

    Create the configuration file:

    /etc/letsencrypt/cloudflare.ini

    bash
    # Cloudflare API token used by Certbot
dns_cloudflare_api_token=YOUR_CLOUDFLARE_API_TOKEN

    Secure the file permissions:

    bash
    chmod 600 /etc/letsencrypt/cloudflare.ini

    3. Initial Certificate Generation

    Run the following command to generate your first certificate. This example includes a wildcard entry.

    bash
    certbot certonly \
  --dns-cloudflare \
  --dns-cloudflare-credentials /etc/letsencrypt/cloudflare.ini \
  -d example.com \
  -d *.example.com \ # Wildcard certificate example
  --preferred-challenges dns-01 \
  --non-interactive \
  --agree-tos \
  -m your-email@example.com

    4. Automation with Systemd

    Modern Linux distributions recommend using systemd timers over legacy cron jobs for better logging and dependency management.

    A. The Service Unit

    This unit defines the renewal task. It includes a post-execution hook to reload your web server.

    File: /etc/systemd/system/certbot-renewal.service

    toml
    [Unit]
Description=Certbot Certificate Renewal (Cloudflare DNS)
Documentation=https://certbot.eff.org/docs/
After=network-online.target
Wants=network-online.target

[Service]
Type=oneshot
# Create log directory if missing
ExecStartPre=/usr/bin/mkdir -p /var/log/letsencrypt
# Run renewal process
ExecStart=/usr/bin/certbot renew --dns-cloudflare --dns-cloudflare-credentials /etc/letsencrypt/cloudflare.ini --quiet
# Reload web server to apply new certificates
ExecStartPost=/usr/bin/systemctl reload nginx

[Install]
WantedBy=multi-user.target

    B. The Timer Unit

    This unit schedules the service to run twice a day.

    File: /etc/systemd/system/certbot-renewal.timer

    toml
    [Unit]
Description=Run Certbot Renewal twice a day

[Timer]
# Execute every 12 hours
OnCalendar=*-*-* 05,17:00:00
RandomizedDelaySec=1h
Persistent=true

[Install]
WantedBy=timers.target

    5. Deployment and Verification

    Once the files are created, enable the automation:

    bash
    # Reload systemd configuration
systemctl daemon-reload

# Enable and start the timer
systemctl enable --now certbot-renewal.timer

    Useful Commands for Maintenance

    • Check Timer Status : systemctl list-timers certbot-renewal.timer
    • Dry Run Test : certbot renew --dry-run
    • View Execution Logs : journalctl -u certbot-renewal.service