Commit 6d968395 authored by Adrien Dorsaz's avatar Adrien Dorsaz

v2: acme-dns-tiny: if a CNAME is defined on _acme-challenge.example.org…

v2: acme-dns-tiny: if a CNAME is defined on _acme-challenge.example.org following it to decide where to install the TXT records

Limitation: it only follows one CNAME for the moment, maybe we should
go through CNAME chain, but it will requires to detect CNAME loop too.
parent c664b31e
Pipeline #195 failed with stage
in 3 minutes and 28 seconds
......@@ -181,6 +181,11 @@ def get_crt(config, log=LOGGER):
keyauthorization = "{0}.{1}".format(token, thumbprint)
keydigest64 = _b64(hashlib.sha256(keyauthorization.encode("utf8")).digest())
dnsrr_domain = "_acme-challenge.{0}.".format(domain)
try: # a CNAME resource can be used for advanced TSIG configuration, trying to follow it
dnsrr_domain = (response.to_text() for response in resolver.query(dnsrr_domain, rdtype="CNAME"))
log.info(" - A CNAME resource has been found for this domain, will install TXT on {0}".format(dnsrr_domain))
except dns.resolver.NoAnswer as noAnswer:
log.debug(" - Not any CNAME resource has been found for this domain, will install TXT directly on {0}".format(dnsrr_domain))
dnsrr_set = dns.rrset.from_text(dnsrr_domain, config["DNS"].getint("TTL"), "IN", "TXT", '"{0}"'.format(keydigest64))
try:
_update_dns(dnsrr_set, "add")
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment