When creating SSL certificates in AWS Certificate Manager, there is a required step before getting the certificate: Validate domain ownership. This seems obvious but to get a certificate you need to prove that you have control over the requested domain(s). There are two ways to validate domain ownership: by email or by DNS.
Use Email to Validate Domain Ownership
When using this option, ACM will send an email to the three registered contact addresses in WHOIS (Domain registrant, Technical contact, Administrative contact) then will wait for up to 72h for confirmation or it will time out.
This approach requires manual intervention which is not great for automation although there might be scenarios where this is applicable. See official AWS documentation.
Use DNS to Validate Domain Ownership
When using this option, ACM will need to know that you have control over the DNS settings on the domain, it will provide a pair name/value to be created as a CNAME record which it will use to validate and to renew if you wish so.
This approach is more suitable for automation since it doesn't require manual intervention. However, as of this writing, it's not supported yet by CloudFormation and therefore it will need to be done by using AWS CLI or API calls. Follow up the official announcement and comments. See official AWS documentation.
How to do this in the command line?
The following commands have been tested in bash on Linux 4.9.0-4-amd64 #1 SMP Debian 4.9.65-3+deb9u1, there shouldn't be much trouble if trying this on a different operation system, not tested on Windows though.
Some prerequisites:
- AWS CLI installed and configured.
- jq package installed and available in PATH.
Set the variable to store domain name and request the certificate to AWS ACM CLI command request-certificate
$ DOMAIN_NAME=abelperez.info $ SSL_CERT_ARN=`aws acm request-certificate \ --domain-name $DOMAIN_NAME \ --subject-alternative-names *.$DOMAIN_NAME \ --validation-method DNS \ --query CertificateArn \ --region us-east-1 \ --output text`
At this point we have the certificate but it's not validated yet. ACM provides values for us to create a CNAME record so they can verify domain ownership. To do that, use aws acm describe-certificate command to retrieve those values.
Now, let's store the result in a variable to prepare for extracting name and value later.
$ SSL_CERT_JSON=`aws acm describe-certificate \ --certificate-arn $SSL_CERT_ARN \ --query Certificate.DomainValidationOptions \ --region us-east-1`
Extract name and value querying the previous json using jq.
$ SSL_CERT_NAME=`echo $SSL_CERT_JSON \ | jq -r ".[] | select(.DomainName == \"$DOMAIN_NAME\").ResourceRecord.Name"` $ SSL_CERT_VALUE=`echo $SSL_CERT_JSON \ | jq -r ".[] | select(.DomainName == \"$DOMAIN_NAME\").ResourceRecord.Value"`
Let's verify that SSL_CERT_NAME and SSL_CERT_VALUE captured the right values.
$ echo $SSL_CERT_NAME _3f88376edb1eda680bd44991197xxxxx.abelperez.info. $ echo $SSL_CERT_VALUE _f528dff0e3e6cd0b637169a885xxxxxx.acm-validations.aws.
At this point, we are ready to interact with Route 53 to create the record set using the proposed values from ACM, but first we need the Hosted Zone Id, it can be copied from the console, but we can also get it from Route 53 command line filtering by domain name.
$ R53_HOSTED_ZONE=`aws route53 list-hosted-zones-by-name \ --dns-name $DOMAIN_NAME \ --query HostedZones \ | jq -r ".[] | select(.Name == \"$DOMAIN_NAME.\").Id" \ | sed 's/\/hostedzone\///'`
Route 53 gives us the hosted zone id in the form of "/hostedzone/Z2TXYZQWVABDCE", the leading "/hostedzone/" bit is stripped out using sed command. Let's verify the hosted zone is captured in the variable.
$ echo $R53_HOSTED_ZONE Z2TXYZQWVABDCE
With the hosted zone id, name and value from ACM, prepare the JSON input for route 53 change-resource-record-sets command, in this is case, Action is a CREATE, TTL can be the default 300 seconds (which is what AWS does itself through the console).
$ read -r -d '' R53_CNAME_JSON << EOM
{
"Comment": "DNS Validation CNAME record",
"Changes": [
{
"Action": "CREATE",
"ResourceRecordSet": {
"Name": "$SSL_CERT_NAME",
"Type": "CNAME",
"TTL": 300,
"ResourceRecords": [
{
"Value": "$SSL_CERT_VALUE"
}
]
}
}
]
}
EOM
We can check all variables were expanded correctly before preparing the command line.
$ echo "$R53_CNAME_JSON"
{
"Comment": "DNS Validation CNAME record",
"Changes": [
{
"Action": "CREATE",
"ResourceRecordSet": {
"Name": "_3f88376edb1eda680bd44991197xxxxx.abelperez.info.",
"Type": "CNAME",
"TTL": 300,
"ResourceRecords": [
{
"Value": "_f528dff0e3e6cd0b637169a885xxxxxx.acm-validations.aws."
}
]
}
}
]
}
Now we've verified everything is in place, finally we can create the record set using route 53 cli.
$ R53_CNAME_ID=`aws route53 change-resource-record-sets \ --hosted-zone-id $R53_HOSTED_ZONE \ --change-batch "$R53_CNAME_JSON" \ --query ChangeInfo.Id \ --output text`
This operation will return a change-id, since route 53 needs to propagate the change, it won't be available immediately, usually within 60 seconds, to ensure we can proceed, we can use the wait command. This command will block the console/script until the record set change is ready.
$ aws route53 wait resource-record-sets-changed --id $R53_CNAME_ID
After the wait, the record set is ready, now ACM needs to validate it, as per AWS docs, it can take up to several hours but in my experience it's not that long. By using another wait command, we'll block the console/script until the certificate is validated.
$ aws acm wait certificate-validated \ --certificate-arn $SSL_CERT_ARN \ --region us-east-1
Once this wait is done, we can verify that our certificate is in fact issued.
$ aws acm describe-certificate \ --certificate-arn $SSL_CERT_ARN \ --query Certificate.Status \ --region us-east-1 "ISSUED"
And this is how it's done, 100% end to end commands, no manual intervention, no console clicks, ready for automation.
No comments:
Post a Comment