Using CNAMEs for Challenge Redirection

[modemgeek]

Could someone explain how to do this.
We manage most of our customers in our AWS account. Setting up TXT records in this account is simple using the plugin. However, we also have customers who want to manage their own DNS. They will not give us access to write TXT records to their DNS. This option sounds like it could fix our problem. Customer enters a CNAME record that points to a domain we control on AWS. We then write the TXT record on our domain and we should be able to pass dns verification. However I'm getting errors that the zone is not found on AWS when trying to publish the TXT record.

For example, customer hosts www.customer.com on godaddy. they create a CNAME record _acme-challenge.www.customer.com and point it to www.hostedbyus.com

then on our domain hostedbyus.com, what record would i create to get challenge redirection to work?

[mbactol3]

First off, I am no expert, just someone who has used this module a little and done some work with SSL certificates recently.

So, seems like you want an SSL cert for *.customer.com? If you are using the aws plugin, it would expect customer.com domain to be in the AWS domain controller you are pointing at. Sounds like you might have to use the manual plugin.
BUT....
I'm not 100% sure, but I think it verifies the record type as well (as in it must be TXT). And working around this it likely not do-able on purpose. That's the whole point of the security challenge. You must have complete control of the domain to get a trusted certificate for it.. you do NOT have that level of access/control. You control hostedbyus.com. I would contend that it is the responsibility of the people that do control customer.com to obtain and provide a certificate. If your customer wants to control the domain.. they should get an SSL certificate for it.

[rmbolger]

Hey @modemgeek, thanks for the question. What you want to do is totally possible. It does involve your customers setting up the CNAME(s) in advance to point a record (or records) in your own AWS zone. There's a challenge alias section of the tutorial that might shed some more light on the details of the process. I can provide additional specifics here if you have more questions.

@mbactol3 is right that normally you can't get a cert for domains you don't own. But having your customers point their zone to your zone for particular records is effectively delegating responsibility for those records to you. And for the purposes of ACME challenges, that's proof enough to get a cert.

[rmbolger]

Here are some concrete examples with relatively common certs.

You're trying to get a cert that contains identifiers for both customer.com and www.customer.com. You've decided that the TXT record you want the customer to point to within your own zone is customer.acme.hostedbyus.com. This is a fairly arbitrary/cosmetic decision and can really be anything within hostebyus.com. You can create this in advance with a fake value as a placeholder which makes it easier to verify the customer has created their record properly. But it's not technically required. So you tell the customer to create two CNAME records on their side:

• _acme-challenge.customer.com with target customer.acme.hostedbyus.com
• _acme-challenge.www.customer.com with target customer.acme.hostedbyus.com

When that's done, you should be able to query each record and see that they're pointing to you. Then, you'd place the cert order like this:

$certNames = 'customer.com','www.customer.com'
$aliasNames = 'customer.acme.hostedbyus.com'
New-PACertificate $certNames -Plugin Route53 -PluginArgs $pArgs -DnsAlias $aliasNames

The -DnsAlias param technically takes an array such that there can be a different target record for each CNAME. But it's not required unless you've got a ton of names all pointing to the same record that would all be renewing at the same time.

Now let's do the other common case for a wildcard cert which would likely contain customer.com and *.customer.com. In this case, the customer only has to create a single CNAME record since the wildcard and root domain use the same challenge record:

• _acme-challenge.customer.com with target customer.acme.hostedbyus.com

And the resulting command is almost identical.

$certNames = 'customer.com','*.customer.com'
$aliasNames = 'customer.acme.hostedbyus.com'
New-PACertificate $certNames -Plugin Route53 -PluginArgs $pArgs -DnsAlias $aliasNames

[modemgeek]

Thank you. That explanation really helped me understand it better.
This did not work for me right off the bat. I am running v3 and noticed one of the parameters was changed in v4
New-PACertificate $certNames -Plugin Route53 -PluginArgs $pArgs -DnsAlias $aliasNames

I updated to v4 and was getting an error with the Route53 plugin
$zones = Get-R53HostedZoneList @script:AwsCredParam | Where-Object { $_.Config.PrivateZone -eq $false }
It seems that the cmdlet Get-R53HostedZoneList doesn't exist or maybe again I have outdated cmdlets. I changed Get-R53HostedZoneList to Get-R53HostedZones and it worked

I ran the entire setup and it seems to work perfectly. Now we can issue wildcard certificates using DNS validation for those customers that won't let us manage the dns.

[rmbolger]

Awesome. Glad to hear things are working for you.

It seems that the cmdlet Get-R53HostedZoneList doesn't exist or maybe again I have outdated cmdlets. I changed Get-R53HostedZoneList to Get-R53HostedZones and it worked

Thanks for the heads up on that. I hadn't heard about any changes with the AWS module. I'll definitely look into it and see if I need to make some changes to support new/old versions.

[rmbolger]

Can you verify which AWS module you're using and what version it is? Get-Module -List aws*

[modemgeek]

ModuleType Version    Name                                ExportedCommands                                                                                                                                        
---------- -------    ----                                ----------------                                                                                                                                        
Binary     3.1.39.0   AWSPowerShell                       {Clear-AGStageCache, Get-AGAccount, Get-AGApiKey, Get-AGApiKeyList...}    

[rmbolger]

Thanks. It looks like Get-R53HostedZones was renamed to Get-R53HostedZoneList in the newer AWS.Tools.Route53 module. I'll add some code that should fix compatibility with the older version while still defaulting to the new version.