README.md 3.17 KB
Newer Older
1
# acme-dns-tiny
Daniel Roesler's avatar
Daniel Roesler committed
2

3 4
[![build status](https://projects.adorsaz.ch/adrien/acme-dns-tiny/badges/master/build.svg)](https://projects.adorsaz.ch/adrien/acme-dns-tiny/commits/master)
[![coverage status](https://projects.adorsaz.ch/adrien/acme-dns-tiny/badges/master/coverage.svg)](https://projects.adorsaz.ch/adrien/acme-dns-tiny/commits/master)
5

6 7
This is a tiny, auditable script that you can throw on any secure machine to
issue and renew [Let's Encrypt](https://letsencrypt.org/) certificates with DNS
8
validation.
Daniel Roesler's avatar
Daniel Roesler committed
9

10 11
Since it has to have access to your private ACME account key and the
rights to update the DNS records of your DNS server, this code has been designed
12
to be as tiny as possible (currently less than 300 lines).
Daniel Roesler's avatar
Daniel Roesler committed
13

14 15 16 17 18 19 20
The only prerequisites are Python 3, OpenSSL and the dnspython module.

For the dnspython module, be aware that it won't work with release 1.14.0,
because this one have a bug with dynamic DNS updates.
You should either use an older version from dnspython3 module (python3 specific
code) or any release of dnspython module (pyhton2 and python3 merged code) since
1.15.0.
21

22 23
**PLEASE READ THE SOURCE CODE! YOU MUST TRUST IT!
IT HANDLES YOUR ACCOUNT PRIVATE KEYS!**
24 25 26 27 28

Note: this script is a fork of the [acme-tiny project](https://github.com/diafygi/acme-tiny)
which uses ACME HTTP verification to create signed certificates.

## Donate
Daniel Roesler's avatar
Daniel Roesler committed
29 30 31 32 33 34 35 36

If this script is useful to you, please donate to the EFF. I don't work there,
but they do fantastic work.

[https://eff.org/donate/](https://eff.org/donate/)

## How to use this script

37
See our the [HowTo Use](https://projects.adorsaz.ch/adrien/acme-dns-tiny/wikis/howto-use) wiki page for main informations.
Daniel Roesler's avatar
Daniel Roesler committed
38

39
You may be interested by the [HowTo Setup with BIND9](https://projects.adorsaz.ch/adrien/acme-dns-tiny/wikis/howto-setup-with-bind9)
40 41
page too which show a step by step example to set up the script
with a BIND9 DNS server.
Daniel Roesler's avatar
Daniel Roesler committed
42

43 44
Note that, this script can be run on any secure machine which have access to
Internet and your public DNS server.
Daniel Roesler's avatar
Daniel Roesler committed
45 46 47 48

## Permissions

The biggest problem you'll likely come across while setting up and running this
49 50 51 52 53 54 55 56 57
script is permissions.

You want to limit access for this script to:
* Your account private key
* Your Certificate Signing Request (CSR) file (without your domain key)
* Your configuration file (which contain DNS update secret)

I'd recommend to create a user specifically to run this script and the
above files. This user should *NOT* have access to your domain key!
Daniel Roesler's avatar
Daniel Roesler committed
58 59 60

**BE SURE TO:**
* Backup your account private key (e.g. `account.key`)
61 62 63
* Don't allow this script to be able to read your *domain* private key!
* Don't allow this script to be run as *root*!
* Understand and configure correctly your cron job to do all your needs !
64
(write it with your preferred language to manage your server)
Daniel Roesler's avatar
Daniel Roesler committed
65 66 67

## Feedback/Contributing

68 69
This project has a very, very limited scope and codebase. The project is happy
to receive bug reports and pull requests, but please don't add any new features.
70 71
This script must stay under ~250 lines of code to ensure it can be easily
audited by anyone who wants to run it.
Daniel Roesler's avatar
Daniel Roesler committed
72 73 74

If you want to add features for your own setup to make things easier for you,
please do! It's open source, so feel free to fork it and modify as necessary.
75

76